From a40dc1283291e9959f38720d7f0efbbdf5fbbdf4 Mon Sep 17 00:00:00 2001 From: research bot Date: Thu, 15 Apr 2021 19:40:20 +0000 Subject: [PATCH] updating docs and package bits [ci skip] --- .../cloud/aws_excessive_security_scanning.yml | 6 +- detections/endpoint/bits_job_persistence.yml | 8 +- .../endpoint/bitsadmin_download_file.yml | 2 +- detections/endpoint/disable_registry_tool.yml | 10 +- .../endpoint/disable_show_hidden_files.yml | 10 +- .../disable_windows_behavior_monitoring.yml | 10 +- ...disable_windows_smartscreen_protection.yml | 10 +- .../endpoint/disabling_cmd_application.yml | 10 +- .../endpoint/disabling_controlpanel.yml | 10 +- .../disabling_firewall_with_netsh.yml | 10 +- ...isabling_folderoptions_windows_feature.yml | 10 +- .../endpoint/disabling_norun_windows_app.yml | 10 +- .../disabling_systemrestore_in_registry.yml | 10 +- .../endpoint/disabling_task_manager.yml | 10 +- .../endpoint/dsquery_domain_discovery.yml | 4 +- ...cious_powershell_executed_as_a_service.yml | 2 +- .../powershell_start_bitstransfer.yml | 2 +- docs/detections.md | 1583 +- docs/detections.wiki | 1472 +- docs/mitre-map/coverage.csv | 18304 ++- docs/mitre-map/coverage.json | 11968 +- docs/mitre-map/detections.csv | 13728 ++- docs/mitre-map/detections.json | 13744 +-- docs/stories.md | 152 +- docs/stories.wiki | 272 +- package/README.md | 7 + package/README/essoc_story_detail.txt | 15 + package/README/essoc_summary.txt | 24 + package/README/essoc_usage_dashboard.txt | 51 + package/app.manifest | 46 + .../static/alert_escu_contextualize.png | Bin 0 -> 4530 bytes .../static/alert_escu_investigate.png | Bin 0 -> 4530 bytes package/appserver/static/alerticon.png | Bin 0 -> 8991 bytes .../static/analytic_story_details.css | 187 + .../static/analytic_story_details.js | 575 + package/appserver/static/escu_summary.css | 66 + package/appserver/static/escu_summary.js | 76 + package/appserver/static/feedback.js | 19 + package/appserver/static/img/escu/Slide1.PNG | Bin 0 -> 127927 bytes package/appserver/static/img/escu/Slide2.PNG | Bin 0 -> 75290 bytes package/appserver/static/img/escu/Slide3.PNG | Bin 0 -> 133781 bytes package/appserver/static/img/escu/Slide4.PNG | Bin 0 -> 188906 bytes package/appserver/static/img/escu/Slide5.PNG | Bin 0 -> 177642 bytes package/appserver/static/img/escu/Slide6.PNG | Bin 0 -> 163389 bytes package/appserver/static/img/escu/Slide7.PNG | Bin 0 -> 83664 bytes package/appserver/static/img/escu/Slide8.PNG | Bin 0 -> 220471 bytes .../static/js/lib/jquery-ui/AUTHORS.txt | 333 + .../static/js/lib/jquery-ui/LICENSE.txt | 43 + .../lib/jquery-ui/external/jquery/jquery.js | 10872 ++ .../images/ui-icons_444444_256x240.png | Bin 0 -> 6992 bytes .../images/ui-icons_555555_256x240.png | Bin 0 -> 6988 bytes .../images/ui-icons_777620_256x240.png | Bin 0 -> 4549 bytes .../images/ui-icons_777777_256x240.png | Bin 0 -> 6999 bytes .../images/ui-icons_cc0000_256x240.png | Bin 0 -> 4549 bytes .../images/ui-icons_ffffff_256x240.png | Bin 0 -> 6299 bytes .../static/js/lib/jquery-ui/index.html | 559 + .../static/js/lib/jquery-ui/jquery-ui.css | 1312 + .../static/js/lib/jquery-ui/jquery-ui.js | 18706 ++++ .../static/js/lib/jquery-ui/jquery-ui.min.css | 7 + .../static/js/lib/jquery-ui/jquery-ui.min.js | 13 + .../js/lib/jquery-ui/jquery-ui.structure.css | 886 + .../lib/jquery-ui/jquery-ui.structure.min.css | 5 + .../js/lib/jquery-ui/jquery-ui.theme.css | 443 + .../js/lib/jquery-ui/jquery-ui.theme.min.css | 5 + .../static/js/lib/jquery-ui/package.json | 74 + .../appserver/static/js/lib/showdown.min.js | 3 + package/appserver/static/js/lib/tabs.css | 19 + package/appserver/static/js/lib/tabs.js | 240 + package/bin/dnstwist.py | 400 + package/bin/escu_contextualize.py | 1 + package/bin/escu_investigate.py | 1 + package/bin/runstory.py | 1 + package/bin/splunklib/__init__.py | 19 + package/bin/splunklib/binding.py | 1373 + package/bin/splunklib/client.py | 3718 + package/bin/splunklib/data.py | 258 + .../bin/splunklib/modularinput/__init__.py | 12 + .../bin/splunklib/modularinput/argument.py | 102 + package/bin/splunklib/modularinput/event.py | 107 + .../splunklib/modularinput/event_writer.py | 84 + .../modularinput/input_definition.py | 59 + package/bin/splunklib/modularinput/scheme.py | 84 + package/bin/splunklib/modularinput/script.py | 176 + package/bin/splunklib/modularinput/utils.py | 72 + .../modularinput/validation_definition.py | 83 + package/bin/splunklib/ordereddict.py | 128 + package/bin/splunklib/results.py | 288 + .../bin/splunklib/searchcommands/__init__.py | 155 + .../splunklib/searchcommands/decorators.py | 447 + .../splunklib/searchcommands/environment.py | 122 + .../searchcommands/eventing_command.py | 142 + .../searchcommands/external_search_command.py | 227 + .../searchcommands/generating_command.py | 320 + .../bin/splunklib/searchcommands/internals.py | 786 + .../searchcommands/reporting_command.py | 280 + .../searchcommands/search_command.py | 1101 + .../searchcommands/streaming_command.py | 188 + .../splunklib/searchcommands/validators.py | 384 + package/default/analytic_stories.conf | 1870 + package/default/analyticstories.conf | 5878 + package/default/app.conf | 30 + package/default/collections.conf | 55 + package/default/commands.conf | 10 + package/default/content-version.conf | 2 + package/default/data/ui/nav/default.xml | 9 + ...l_backup_logs_for_host___response_task.xml | 9 + ...tes_activity_by_src_ip___response_task.xml | 9 + ...ity_hub_alerts_by_dest___response_task.xml | 9 + ...ivities_by_accesskeyid___response_task.xml | 9 + ...user_activities_by_arn___response_task.xml | 9 + ...rk_acl_details_from_id___response_task.xml | 9 + ...details_via_resourceid___response_task.xml | 9 + ...details_via_bucketname___response_task.xml | 9 + ...tes_activity_by_src_ip___response_task.xml | 9 + ...aws_activity_from_city___response_task.xml | 9 + ..._activity_from_country___response_task.xml | 9 + ...tivity_from_ip_address___response_task.xml | 9 + ...s_activity_from_region___response_task.xml | 9 + ...ckup_logs_for_endpoint___response_task.xml | 9 + ...cate_logs_for_a_domain___response_task.xml | 9 + ...ver_history_for_a_host___response_task.xml | 9 + ..._get_dns_traffic_ratio___response_task.xml | 9 + ..._details_by_instanceid___response_task.xml | 9 + ...get_ec2_launch_details___response_task.xml | 9 + ...h_panel_get_email_info___response_task.xml | 9 + ...s_from_specific_sender___response_task.xml | 9 + ...rence_of_a_mac_address___response_task.xml | 9 + ...story_of_email_sources___response_task.xml | 9 + ...fications_for_endpoint___response_task.xml | 9 + ...modifications_for_user___response_task.xml | 9 + ...el_get_notable_history___response_task.xml | 9 + ...en_cobra_threat_actors___response_task.xml | 9 + ...et_parent_process_info___response_task.xml | 9 + ..._process_file_activity___response_task.xml | 9 + ...panel_get_process_info___response_task.xml | 9 + ...tion_for_port_activity___response_task.xml | 9 + ...le_for_the_dns_traffic___response_task.xml | 9 + ..._wmi_activity_for_host___response_task.xml | 9 + ...rmation_via_session_id___response_task.xml | 9 + ...vities_via_region_name___response_task.xml | 9 + ...tivities_by_user_field___response_task.xml | 9 + ..._multiple_destinations___response_task.xml | 9 + ...rk_traffic_from_src_ip___response_task.xml | 9 + ...e_okta_activity_by_app___response_task.xml | 9 + ...activity_by_ip_address___response_task.xml | 9 + ...pass_the_hash_attempts___response_task.xml | 9 + ...ss_the_ticket_attempts___response_task.xml | 9 + ...e_previous_unseen_user___response_task.xml | 9 + ...esktop_authentications___response_task.xml | 9 + ...strings_in_http_header___response_task.xml | 9 + ...ser_activities_in_okta___response_task.xml | 9 + ...ate_web_posts_from_src___response_task.xml | 9 + .../data/ui/views/analytic_story_details.xml | 21 + .../default/data/ui/views/escu_summary.xml | 458 + package/default/data/ui/views/escu_usage.xml | 152 + .../ui/views/explore_analytic_stories.xml | 81 + package/default/data/ui/views/feedback.xml | 13 + package/default/distsearch.conf | 5 + package/default/es_investigations.conf | 1498 + package/default/macros.conf | 1753 + package/default/restmap.conf | 6 + package/default/savedsearches.conf | 17024 +++ package/default/searchbnf.conf | 26 + package/default/transforms.conf | 254 + package/default/usage_searches.conf | 73 + package/default/use_case_library.conf | 5878 + package/default/workflow_actions.conf | 360 + package/lookups/aws_service_accounts.csv | 1 + .../baseline_blocked_outbound_connections.csv | 1 + package/lookups/brand_monitoring.csv | 1 + package/lookups/csc_lookup.csv | 21 + package/lookups/discovered_dns_records.csv | 1 + package/lookups/domains.csv | 1 + .../lookups/dynamic_dns_providers_default.csv | 91976 ++++++++++++++++ .../lookups/dynamic_dns_providers_local.csv | 1 + package/lookups/escu_search_id.csv | 1 + .../is_suspicious_file_extension_lookup.csv | 52 + package/lookups/is_windows_system_file.csv | 563 + package/lookups/legit_domains.csv | 20 + package/lookups/mitre_enrichment.csv | 440 + .../lookups/network_acl_activity_baseline.csv | 1 + ...eviously_seen_S3_access_from_remote_ip.csv | 1 + ...viously_seen_api_calls_from_user_roles.csv | 1 + ...iously_seen_aws_cross_account_activity.csv | 1 + .../lookups/previously_seen_aws_regions.csv | 1 + .../previously_seen_cmd_line_arguments.csv | 1 + ...viously_seen_ec2_modifications_by_user.csv | 1 + .../lookups/prohibited_apps_launching_cmd.csv | 17 + package/lookups/prohibited_processes.csv | 20 + package/lookups/prohibited_softwares.csv | 20 + package/lookups/ransomware_extensions.csv | 290 + package/lookups/ransomware_notes.csv | 61 + .../rare_process_allow_list_default.csv | 7 + .../lookups/rare_process_allow_list_local.csv | 1 + package/lookups/s3_deletion_baseline.csv | 1 + .../security_group_activity_baseline.csv | 1 + package/lookups/security_services.csv | 5 + package/lookups/suspicious_files.csv | 4 + .../lookups/uncommon_processes_default.csv | 9 + package/lookups/uncommon_processes_local.csv | 1 + package/metadata/default.meta | 23 + package/static/appIcon.png | Bin 0 -> 3658 bytes package/static/appIconAlt.png | Bin 0 -> 2656 bytes package/static/appIconAlt_2x.png | Bin 0 -> 7442 bytes package/static/appIcon_2x.png | Bin 0 -> 3657 bytes 205 files changed, 214508 insertions(+), 21978 deletions(-) create mode 100644 package/README.md create mode 100644 package/README/essoc_story_detail.txt create mode 100644 package/README/essoc_summary.txt create mode 100644 package/README/essoc_usage_dashboard.txt create mode 100644 package/app.manifest create mode 100644 package/appserver/static/alert_escu_contextualize.png create mode 100644 package/appserver/static/alert_escu_investigate.png create mode 100644 package/appserver/static/alerticon.png create mode 100644 package/appserver/static/analytic_story_details.css create mode 100644 package/appserver/static/analytic_story_details.js create mode 100644 package/appserver/static/escu_summary.css create mode 100644 package/appserver/static/escu_summary.js create mode 100644 package/appserver/static/feedback.js create mode 100644 package/appserver/static/img/escu/Slide1.PNG create mode 100644 package/appserver/static/img/escu/Slide2.PNG create mode 100644 package/appserver/static/img/escu/Slide3.PNG create mode 100644 package/appserver/static/img/escu/Slide4.PNG create mode 100644 package/appserver/static/img/escu/Slide5.PNG create mode 100644 package/appserver/static/img/escu/Slide6.PNG create mode 100644 package/appserver/static/img/escu/Slide7.PNG create mode 100644 package/appserver/static/img/escu/Slide8.PNG create mode 100644 package/appserver/static/js/lib/jquery-ui/AUTHORS.txt create mode 100644 package/appserver/static/js/lib/jquery-ui/LICENSE.txt create mode 100644 package/appserver/static/js/lib/jquery-ui/external/jquery/jquery.js create mode 100644 package/appserver/static/js/lib/jquery-ui/images/ui-icons_444444_256x240.png create mode 100644 package/appserver/static/js/lib/jquery-ui/images/ui-icons_555555_256x240.png create mode 100644 package/appserver/static/js/lib/jquery-ui/images/ui-icons_777620_256x240.png create mode 100644 package/appserver/static/js/lib/jquery-ui/images/ui-icons_777777_256x240.png create mode 100644 package/appserver/static/js/lib/jquery-ui/images/ui-icons_cc0000_256x240.png create mode 100644 package/appserver/static/js/lib/jquery-ui/images/ui-icons_ffffff_256x240.png create mode 100644 package/appserver/static/js/lib/jquery-ui/index.html create mode 100644 package/appserver/static/js/lib/jquery-ui/jquery-ui.css create mode 100644 package/appserver/static/js/lib/jquery-ui/jquery-ui.js create mode 100644 package/appserver/static/js/lib/jquery-ui/jquery-ui.min.css create mode 100644 package/appserver/static/js/lib/jquery-ui/jquery-ui.min.js create mode 100644 package/appserver/static/js/lib/jquery-ui/jquery-ui.structure.css create mode 100644 package/appserver/static/js/lib/jquery-ui/jquery-ui.structure.min.css create mode 100644 package/appserver/static/js/lib/jquery-ui/jquery-ui.theme.css create mode 100644 package/appserver/static/js/lib/jquery-ui/jquery-ui.theme.min.css create mode 100644 package/appserver/static/js/lib/jquery-ui/package.json create mode 100644 package/appserver/static/js/lib/showdown.min.js create mode 100644 package/appserver/static/js/lib/tabs.css create mode 100644 package/appserver/static/js/lib/tabs.js create mode 100755 package/bin/dnstwist.py create mode 100644 package/bin/escu_contextualize.py create mode 100644 package/bin/escu_investigate.py create mode 100644 package/bin/runstory.py create mode 100755 package/bin/splunklib/__init__.py create mode 100755 package/bin/splunklib/binding.py create mode 100755 package/bin/splunklib/client.py create mode 100755 package/bin/splunklib/data.py create mode 100755 package/bin/splunklib/modularinput/__init__.py create mode 100755 package/bin/splunklib/modularinput/argument.py create mode 100755 package/bin/splunklib/modularinput/event.py create mode 100755 package/bin/splunklib/modularinput/event_writer.py create mode 100755 package/bin/splunklib/modularinput/input_definition.py create mode 100755 package/bin/splunklib/modularinput/scheme.py create mode 100755 package/bin/splunklib/modularinput/script.py create mode 100755 package/bin/splunklib/modularinput/utils.py create mode 100755 package/bin/splunklib/modularinput/validation_definition.py create mode 100755 package/bin/splunklib/ordereddict.py create mode 100755 package/bin/splunklib/results.py create mode 100755 package/bin/splunklib/searchcommands/__init__.py create mode 100755 package/bin/splunklib/searchcommands/decorators.py create mode 100755 package/bin/splunklib/searchcommands/environment.py create mode 100755 package/bin/splunklib/searchcommands/eventing_command.py create mode 100755 package/bin/splunklib/searchcommands/external_search_command.py create mode 100755 package/bin/splunklib/searchcommands/generating_command.py create mode 100755 package/bin/splunklib/searchcommands/internals.py create mode 100755 package/bin/splunklib/searchcommands/reporting_command.py create mode 100755 package/bin/splunklib/searchcommands/search_command.py create mode 100755 package/bin/splunklib/searchcommands/streaming_command.py create mode 100755 package/bin/splunklib/searchcommands/validators.py create mode 100644 package/default/analytic_stories.conf create mode 100644 package/default/analyticstories.conf create mode 100644 package/default/app.conf create mode 100644 package/default/collections.conf create mode 100644 package/default/commands.conf create mode 100644 package/default/content-version.conf create mode 100644 package/default/data/ui/nav/default.xml create mode 100644 package/default/data/ui/panels/workbench_panel_all_backup_logs_for_host___response_task.xml create mode 100644 package/default/data/ui/panels/workbench_panel_amazon_eks_kubernetes_activity_by_src_ip___response_task.xml create mode 100644 package/default/data/ui/panels/workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task.xml create mode 100644 package/default/data/ui/panels/workbench_panel_aws_investigate_user_activities_by_accesskeyid___response_task.xml create mode 100644 package/default/data/ui/panels/workbench_panel_aws_investigate_user_activities_by_arn___response_task.xml create mode 100644 package/default/data/ui/panels/workbench_panel_aws_network_acl_details_from_id___response_task.xml create mode 100644 package/default/data/ui/panels/workbench_panel_aws_network_interface_details_via_resourceid___response_task.xml create mode 100644 package/default/data/ui/panels/workbench_panel_aws_s3_bucket_details_via_bucketname___response_task.xml create mode 100644 package/default/data/ui/panels/workbench_panel_gcp_kubernetes_activity_by_src_ip___response_task.xml create mode 100644 package/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_city___response_task.xml create mode 100644 package/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_country___response_task.xml create mode 100644 package/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_ip_address___response_task.xml create mode 100644 package/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_region___response_task.xml create mode 100644 package/default/data/ui/panels/workbench_panel_get_backup_logs_for_endpoint___response_task.xml create mode 100644 package/default/data/ui/panels/workbench_panel_get_certificate_logs_for_a_domain___response_task.xml create mode 100644 package/default/data/ui/panels/workbench_panel_get_dns_server_history_for_a_host___response_task.xml create mode 100644 package/default/data/ui/panels/workbench_panel_get_dns_traffic_ratio___response_task.xml create mode 100644 package/default/data/ui/panels/workbench_panel_get_ec2_instance_details_by_instanceid___response_task.xml create mode 100644 package/default/data/ui/panels/workbench_panel_get_ec2_launch_details___response_task.xml create mode 100644 package/default/data/ui/panels/workbench_panel_get_email_info___response_task.xml create mode 100644 package/default/data/ui/panels/workbench_panel_get_emails_from_specific_sender___response_task.xml create mode 100644 package/default/data/ui/panels/workbench_panel_get_first_occurrence_and_last_occurrence_of_a_mac_address___response_task.xml create mode 100644 package/default/data/ui/panels/workbench_panel_get_history_of_email_sources___response_task.xml create mode 100644 package/default/data/ui/panels/workbench_panel_get_logon_rights_modifications_for_endpoint___response_task.xml create mode 100644 package/default/data/ui/panels/workbench_panel_get_logon_rights_modifications_for_user___response_task.xml create mode 100644 package/default/data/ui/panels/workbench_panel_get_notable_history___response_task.xml create mode 100644 package/default/data/ui/panels/workbench_panel_get_outbound_emails_to_hidden_cobra_threat_actors___response_task.xml create mode 100644 package/default/data/ui/panels/workbench_panel_get_parent_process_info___response_task.xml create mode 100644 package/default/data/ui/panels/workbench_panel_get_process_file_activity___response_task.xml create mode 100644 package/default/data/ui/panels/workbench_panel_get_process_info___response_task.xml create mode 100644 package/default/data/ui/panels/workbench_panel_get_process_information_for_port_activity___response_task.xml create mode 100644 package/default/data/ui/panels/workbench_panel_get_process_responsible_for_the_dns_traffic___response_task.xml create mode 100644 package/default/data/ui/panels/workbench_panel_get_sysmon_wmi_activity_for_host___response_task.xml create mode 100644 package/default/data/ui/panels/workbench_panel_get_web_session_information_via_session_id___response_task.xml create mode 100644 package/default/data/ui/panels/workbench_panel_investigate_aws_activities_via_region_name___response_task.xml create mode 100644 package/default/data/ui/panels/workbench_panel_investigate_aws_user_activities_by_user_field___response_task.xml create mode 100644 package/default/data/ui/panels/workbench_panel_investigate_failed_logins_for_multiple_destinations___response_task.xml create mode 100644 package/default/data/ui/panels/workbench_panel_investigate_network_traffic_from_src_ip___response_task.xml create mode 100644 package/default/data/ui/panels/workbench_panel_investigate_okta_activity_by_app___response_task.xml create mode 100644 package/default/data/ui/panels/workbench_panel_investigate_okta_activity_by_ip_address___response_task.xml create mode 100644 package/default/data/ui/panels/workbench_panel_investigate_pass_the_hash_attempts___response_task.xml create mode 100644 package/default/data/ui/panels/workbench_panel_investigate_pass_the_ticket_attempts___response_task.xml create mode 100644 package/default/data/ui/panels/workbench_panel_investigate_previous_unseen_user___response_task.xml create mode 100644 package/default/data/ui/panels/workbench_panel_investigate_successful_remote_desktop_authentications___response_task.xml create mode 100644 package/default/data/ui/panels/workbench_panel_investigate_suspicious_strings_in_http_header___response_task.xml create mode 100644 package/default/data/ui/panels/workbench_panel_investigate_user_activities_in_okta___response_task.xml create mode 100644 package/default/data/ui/panels/workbench_panel_investigate_web_posts_from_src___response_task.xml create mode 100644 package/default/data/ui/views/analytic_story_details.xml create mode 100644 package/default/data/ui/views/escu_summary.xml create mode 100644 package/default/data/ui/views/escu_usage.xml create mode 100644 package/default/data/ui/views/explore_analytic_stories.xml create mode 100644 package/default/data/ui/views/feedback.xml create mode 100644 package/default/distsearch.conf create mode 100644 package/default/es_investigations.conf create mode 100644 package/default/macros.conf create mode 100644 package/default/restmap.conf create mode 100644 package/default/savedsearches.conf create mode 100644 package/default/searchbnf.conf create mode 100644 package/default/transforms.conf create mode 100644 package/default/usage_searches.conf create mode 100644 package/default/use_case_library.conf create mode 100644 package/default/workflow_actions.conf create mode 100644 package/lookups/aws_service_accounts.csv create mode 100644 package/lookups/baseline_blocked_outbound_connections.csv create mode 100644 package/lookups/brand_monitoring.csv create mode 100644 package/lookups/csc_lookup.csv create mode 100644 package/lookups/discovered_dns_records.csv create mode 100644 package/lookups/domains.csv create mode 100644 package/lookups/dynamic_dns_providers_default.csv create mode 100644 package/lookups/dynamic_dns_providers_local.csv create mode 100644 package/lookups/escu_search_id.csv create mode 100644 package/lookups/is_suspicious_file_extension_lookup.csv create mode 100644 package/lookups/is_windows_system_file.csv create mode 100644 package/lookups/legit_domains.csv create mode 100644 package/lookups/mitre_enrichment.csv create mode 100644 package/lookups/network_acl_activity_baseline.csv create mode 100644 package/lookups/previously_seen_S3_access_from_remote_ip.csv create mode 100644 package/lookups/previously_seen_api_calls_from_user_roles.csv create mode 100644 package/lookups/previously_seen_aws_cross_account_activity.csv create mode 100644 package/lookups/previously_seen_aws_regions.csv create mode 100644 package/lookups/previously_seen_cmd_line_arguments.csv create mode 100644 package/lookups/previously_seen_ec2_modifications_by_user.csv create mode 100644 package/lookups/prohibited_apps_launching_cmd.csv create mode 100644 package/lookups/prohibited_processes.csv create mode 100644 package/lookups/prohibited_softwares.csv create mode 100644 package/lookups/ransomware_extensions.csv create mode 100644 package/lookups/ransomware_notes.csv create mode 100644 package/lookups/rare_process_allow_list_default.csv create mode 100644 package/lookups/rare_process_allow_list_local.csv create mode 100644 package/lookups/s3_deletion_baseline.csv create mode 100644 package/lookups/security_group_activity_baseline.csv create mode 100644 package/lookups/security_services.csv create mode 100644 package/lookups/suspicious_files.csv create mode 100644 package/lookups/uncommon_processes_default.csv create mode 100644 package/lookups/uncommon_processes_local.csv create mode 100644 package/metadata/default.meta create mode 100644 package/static/appIcon.png create mode 100644 package/static/appIconAlt.png create mode 100644 package/static/appIconAlt_2x.png create mode 100644 package/static/appIcon_2x.png diff --git a/detections/cloud/aws_excessive_security_scanning.yml b/detections/cloud/aws_excessive_security_scanning.yml index be06ec9df0..1a9ccb38e5 100644 --- a/detections/cloud/aws_excessive_security_scanning.yml +++ b/detections/cloud/aws_excessive_security_scanning.yml @@ -22,8 +22,11 @@ tags: analytic_story: - AWS User Monitoring asset_type: AWS Account + automated_detection_testing: passed cis20: - CIS 13 + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1526/aws_security_scanner/aws_security_scanner.json kill_chain_phases: - Actions on Objectives mitre_attack_id: @@ -48,6 +51,3 @@ tags: risk_object_type: system risk_score: 20 security_domain: network - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1526/aws_security_scanner/aws_security_scanner.json diff --git a/detections/endpoint/bits_job_persistence.yml b/detections/endpoint/bits_job_persistence.yml index f0444e99c5..e455aba1d1 100644 --- a/detections/endpoint/bits_job_persistence.yml +++ b/detections/endpoint/bits_job_persistence.yml @@ -9,8 +9,10 @@ datamodel: description: The following query identifies Microsoft Background Intelligent Transfer Service utility `bitsadmin.exe` scheduling a BITS job to persist on an endpoint. The query identifies the parameters used to create, resume or add a file to a BITS - job. Typically seen combined in a oneliner or ran in sequence. If identified, review the BITS job created and capture any files written to disk. It is possible for BITS to be used to upload files and this may require further network data analysis to identify. You can use `bitsadmin /list /verbose` - to list out the jobs during investigation. + job. Typically seen combined in a oneliner or ran in sequence. If identified, review + the BITS job created and capture any files written to disk. It is possible for BITS + to be used to upload files and this may require further network data analysis to + identify. You can use `bitsadmin /list /verbose` to list out the jobs during investigation. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=bitsadmin.exe Processes.process IN (*create*, *addfile*, *setnotifyflags*, *setnotifycmdline*, @@ -32,6 +34,7 @@ references: tags: analytic_story: - BITS Jobs + automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log kill_chain_phases: @@ -50,4 +53,3 @@ tags: - Processes.user - Processes.dest security_domain: endpoint - automated_detection_testing: passed diff --git a/detections/endpoint/bitsadmin_download_file.yml b/detections/endpoint/bitsadmin_download_file.yml index a7fa7ba5c3..b25ad8dd5a 100644 --- a/detections/endpoint/bitsadmin_download_file.yml +++ b/detections/endpoint/bitsadmin_download_file.yml @@ -38,6 +38,7 @@ tags: analytic_story: - Ingress Tool Transfer - BITS Jobs + automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log kill_chain_phases: @@ -57,4 +58,3 @@ tags: - Processes.user - Processes.dest security_domain: endpoint - automated_detection_testing: passed diff --git a/detections/endpoint/disable_registry_tool.yml b/detections/endpoint/disable_registry_tool.yml index 3f31a7ffa2..692aff2d33 100644 --- a/detections/endpoint/disable_registry_tool.yml +++ b/detections/endpoint/disable_registry_tool.yml @@ -26,6 +26,11 @@ references: tags: analytic_story: - Windows Defense Evasion Tactics + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -42,8 +47,3 @@ tags: - Registry.dest - Registry.registry_value_name security_domain: endpoint - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log diff --git a/detections/endpoint/disable_show_hidden_files.yml b/detections/endpoint/disable_show_hidden_files.yml index 036ea045f8..19047251b2 100644 --- a/detections/endpoint/disable_show_hidden_files.yml +++ b/detections/endpoint/disable_show_hidden_files.yml @@ -28,6 +28,11 @@ references: tags: analytic_story: - Windows Defense Evasion Tactics + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -45,8 +50,3 @@ tags: - Registry.dest - Registry.registry_value_nam security_domain: endpoint - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log diff --git a/detections/endpoint/disable_windows_behavior_monitoring.yml b/detections/endpoint/disable_windows_behavior_monitoring.yml index 7c5ab7d25e..92760eaeea 100644 --- a/detections/endpoint/disable_windows_behavior_monitoring.yml +++ b/detections/endpoint/disable_windows_behavior_monitoring.yml @@ -28,6 +28,11 @@ references: tags: analytic_story: - Windows Defense Evasion Tactics + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -44,8 +49,3 @@ tags: - Registry.dest - Registry.registry_value_name security_domain: endpoint - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log diff --git a/detections/endpoint/disable_windows_smartscreen_protection.yml b/detections/endpoint/disable_windows_smartscreen_protection.yml index b127627da0..c86d9eff68 100644 --- a/detections/endpoint/disable_windows_smartscreen_protection.yml +++ b/detections/endpoint/disable_windows_smartscreen_protection.yml @@ -26,6 +26,11 @@ references: tags: analytic_story: - Windows Defense Evasion Tactics + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -42,8 +47,3 @@ tags: - Registry.dest - Registry.registry_value_nam security_domain: endpoint - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log diff --git a/detections/endpoint/disabling_cmd_application.yml b/detections/endpoint/disabling_cmd_application.yml index 60d544c9bb..2fbb659e41 100644 --- a/detections/endpoint/disabling_cmd_application.yml +++ b/detections/endpoint/disabling_cmd_application.yml @@ -25,6 +25,11 @@ references: tags: analytic_story: - Windows Defense Evasion Tactics + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -41,8 +46,3 @@ tags: - Registry.dest - Registry.registry_value_name security_domain: endpoint - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log diff --git a/detections/endpoint/disabling_controlpanel.yml b/detections/endpoint/disabling_controlpanel.yml index f4c03a35b8..d25066e65d 100644 --- a/detections/endpoint/disabling_controlpanel.yml +++ b/detections/endpoint/disabling_controlpanel.yml @@ -24,6 +24,11 @@ references: tags: analytic_story: - Windows Defense Evasion Tactics + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -40,8 +45,3 @@ tags: - Registry.dest - Registry.registry_value_name security_domain: endpoint - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log diff --git a/detections/endpoint/disabling_firewall_with_netsh.yml b/detections/endpoint/disabling_firewall_with_netsh.yml index 03fff72233..572993638b 100644 --- a/detections/endpoint/disabling_firewall_with_netsh.yml +++ b/detections/endpoint/disabling_firewall_with_netsh.yml @@ -26,6 +26,11 @@ references: tags: analytic_story: - Windows Defense Evasion Tactics + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -45,8 +50,3 @@ tags: - Processes.process_id - Processes.parent_process_id security_domain: endpoint - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log diff --git a/detections/endpoint/disabling_folderoptions_windows_feature.yml b/detections/endpoint/disabling_folderoptions_windows_feature.yml index 59adce28fc..25071310bb 100644 --- a/detections/endpoint/disabling_folderoptions_windows_feature.yml +++ b/detections/endpoint/disabling_folderoptions_windows_feature.yml @@ -26,6 +26,11 @@ references: tags: analytic_story: - Windows Defense Evasion Tactics + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -42,8 +47,3 @@ tags: - Registry.dest - Registry.registry_value_name security_domain: endpoint - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log diff --git a/detections/endpoint/disabling_norun_windows_app.yml b/detections/endpoint/disabling_norun_windows_app.yml index e77ffbd10c..a6d5beef11 100644 --- a/detections/endpoint/disabling_norun_windows_app.yml +++ b/detections/endpoint/disabling_norun_windows_app.yml @@ -27,6 +27,11 @@ references: tags: analytic_story: - Windows Defense Evasion Tactics + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -43,8 +48,3 @@ tags: - Registry.dest - Registry.registry_value_name security_domain: endpoint - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log diff --git a/detections/endpoint/disabling_systemrestore_in_registry.yml b/detections/endpoint/disabling_systemrestore_in_registry.yml index f0ed94188f..0de4f02151 100644 --- a/detections/endpoint/disabling_systemrestore_in_registry.yml +++ b/detections/endpoint/disabling_systemrestore_in_registry.yml @@ -27,6 +27,11 @@ references: tags: analytic_story: - Windows Defense Evasion Tactics + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -43,8 +48,3 @@ tags: - Registry.dest - Registry.registry_value_name security_domain: endpoint - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log diff --git a/detections/endpoint/disabling_task_manager.yml b/detections/endpoint/disabling_task_manager.yml index f1ce08549d..35d551fed1 100644 --- a/detections/endpoint/disabling_task_manager.yml +++ b/detections/endpoint/disabling_task_manager.yml @@ -26,6 +26,11 @@ references: tags: analytic_story: - Windows Defense Evasion Tactics + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -42,8 +47,3 @@ tags: - Registry.dest - Registry.registry_value_name security_domain: endpoint - automated_detection_testing: passed - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log diff --git a/detections/endpoint/dsquery_domain_discovery.yml b/detections/endpoint/dsquery_domain_discovery.yml index 8e3d815a65..349876a1bc 100644 --- a/detections/endpoint/dsquery_domain_discovery.yml +++ b/detections/endpoint/dsquery_domain_discovery.yml @@ -10,7 +10,7 @@ description: 'The following analytic identifies "dsquery.exe" execution with arg looking for `TrustedDomain` query directly on the command-line. This is typically indicative of an Administrator or adversary perform domain trust discovery. Note that this query does not identify any other variations of "Dsquery.exe" usage.\ - + Within this detection, it is assumed `dsquery.exe` is not moved or renamed.\ The search will return the first time and last time these command-line arguments @@ -46,6 +46,7 @@ references: tags: analytic_story: - Domain Trust Discovery + automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1482/atomic_red_team/windows-sysmon.log kill_chain_phases: @@ -63,4 +64,3 @@ tags: - Processes.user - Processes.dest security_domain: endpoint - automated_detection_testing: passed diff --git a/detections/endpoint/malicious_powershell_executed_as_a_service.yml b/detections/endpoint/malicious_powershell_executed_as_a_service.yml index 87849d074d..87500782d1 100644 --- a/detections/endpoint/malicious_powershell_executed_as_a_service.yml +++ b/detections/endpoint/malicious_powershell_executed_as_a_service.yml @@ -26,6 +26,7 @@ references: tags: analytic_story: - Malicious Powershell + automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1569.002/atomic_red_team/windows-system.log kill_chain_phases: @@ -46,4 +47,3 @@ tags: - Service_Account - user security_domain: endpoint - automated_detection_testing: passed diff --git a/detections/endpoint/powershell_start_bitstransfer.yml b/detections/endpoint/powershell_start_bitstransfer.yml index 01fa11718a..842a7805d4 100644 --- a/detections/endpoint/powershell_start_bitstransfer.yml +++ b/detections/endpoint/powershell_start_bitstransfer.yml @@ -31,6 +31,7 @@ references: tags: analytic_story: - BITS Jobs + automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log kill_chain_phases: @@ -49,4 +50,3 @@ tags: - Processes.user - Processes.dest security_domain: endpoint - automated_detection_testing: passed diff --git a/docs/detections.md b/docs/detections.md index e71e6fc596..40c9ec8b9e 100644 --- a/docs/detections.md +++ b/docs/detections.md @@ -43,6 +43,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by +- [AWS Excessive Security Scanning](#aws-excessive-security-scanning) + + + - [AWS Network Access Control List Created with All Open Ports](#aws-network-access-control-list-created-with-all-open-ports) @@ -136,6 +140,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + @@ -240,6 +248,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + @@ -460,6 +470,28 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + + + + + + + + + + + + + + + + + + + @@ -596,6 +628,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + @@ -910,6 +944,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + @@ -989,6 +1025,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + @@ -1044,6 +1082,14 @@ All the detections shipped to different Splunk products. Below is a breakdown by +- [BITS Job Persistence](#bits-job-persistence) + + + +- [BITSAdmin Download File](#bitsadmin-download-file) + + + - [Batch File Write to System32](#batch-file-write-to-system32) @@ -1196,6 +1242,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by +- [DSQuery Domain Discovery](#dsquery-domain-discovery) + + + - [Deleting Shadow Copies](#deleting-shadow-copies) @@ -1452,10 +1502,54 @@ All the detections shipped to different Splunk products. Below is a breakdown by +- [Disable Registry Tool](#disable-registry-tool) + + + +- [Disable Show Hidden Files](#disable-show-hidden-files) + + + +- [Disable Windows Behavior Monitoring](#disable-windows-behavior-monitoring) + + + +- [Disable Windows SmartScreen Protection](#disable-windows-smartscreen-protection) + + + +- [Disabling CMD Application](#disabling-cmd-application) + + + +- [Disabling ControlPanel](#disabling-controlpanel) + + + +- [Disabling Firewall with Netsh](#disabling-firewall-with-netsh) + + + +- [Disabling FolderOptions Windows Feature](#disabling-folderoptions-windows-feature) + + + +- [Disabling NoRun Windows App](#disabling-norun-windows-app) + + + - [Disabling Remote User Account Control](#disabling-remote-user-account-control) +- [Disabling SystemRestore In Registry](#disabling-systemrestore-in-registry) + + + +- [Disabling Task Manager](#disabling-task-manager) + + + - [Dump LSASS via comsvcs DLL](#dump-lsass-via-comsvcs-dll) @@ -1656,6 +1750,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by +- [Malicious Powershell Executed As A Service](#malicious-powershell-executed-as-a-service) + + + @@ -1726,6 +1824,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by +- [PowerShell Start-BitsTransfer](#powershell-start-bitstransfer) + + + - [Probing Access with Stolen Credentials via PowerSploit modules](#probing-access-with-stolen-credentials-via-powersploit-modules) @@ -2324,6 +2426,12 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + + + @@ -2347,6 +2455,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + - [Detect ARP Poisoning](#detect-arp-poisoning) @@ -2548,6 +2658,28 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + + + + + + + + + + + + + + + + + + + @@ -2760,6 +2892,10 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + @@ -3261,6 +3397,14 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + + + + + @@ -3375,6 +3519,28 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + + + + + + + + + + + + + + + + + + + @@ -3527,6 +3693,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + @@ -3735,6 +3903,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + @@ -4070,6 +4240,14 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + + + + + @@ -4348,6 +4526,30 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + + + + + + + + + + + + + + + + + + + + + + + @@ -4510,6 +4712,8 @@ All the detections shipped to different Splunk products. Below is a breakdown by + + @@ -5489,6 +5693,80 @@ Sensitive object access is not necessarily malicious but user and object context #### Test Dataset +_version_: 1 + + +--- + +### AWS Excessive Security Scanning +This search looks for CloudTrail events and analyse the amount of eventNames which starts with Describe by a single user. This indicates that this user scans the configuration of your AWS cloud environment. + +- **Product**: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: +- **ATT&CK**: [T1526](https://attack.mitre.org/techniques/T1526/) +- **Last Updated**: 2021-04-13 + +
+ details + +#### Search +``` +`cloudtrail` eventName=Describe* OR eventName=List* OR eventName=Get* +| stats dc(eventName) as dc_events min(_time) as firstTime max(_time) as lastTime values(eventName) as eventName values(src) as src values(userAgent) as userAgent by user userIdentity.arn +| where dc_events > 50 +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +|`aws_excessive_security_scanning_filter` +``` +#### Associated Analytic Story + +* AWS User Monitoring + + +#### How To Implement +You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs. + +#### Required field + +* _time + +* eventName + +* src + +* userAgent + +* user + +* userIdentity.arn + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1526 | Cloud Service Discovery | Discovery | + + +#### Kill Chain Phase + +* Actions on Objectives + + +#### Known False Positives +While this search has no known false positives. + +#### Reference + +* https://github.com/aquasecurity/cloudsploit + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1526/aws_security_scanner/aws_security_scanner.json + + _version_: 1
@@ -6828,6 +7106,8 @@ The following analytic identifies the use of PowerShell downloading a file using * Malicious PowerShell +* Ingress Tool Transfer + #### How To Implement To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -6914,6 +7194,8 @@ The following analytic identifies the use of PowerShell downloading a file using * HAFNIUM Group +* Ingress Tool Transfer + #### How To Implement To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -7648,6 +7930,169 @@ Administrators may modify the boot configuration. * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log +_version_: 1 + + +--- + +### BITS Job Persistence +The following query identifies Microsoft Background Intelligent Transfer Service utility `bitsadmin.exe` scheduling a BITS job to persist on an endpoint. The query identifies the parameters used to create, resume or add a file to a BITS job. Typically seen combined in a oneliner or ran in sequence. If identified, review the BITS job created and capture any files written to disk. It is possible for BITS to be used to upload files and this may require further network data analysis to identify. You can use `bitsadmin /list /verbose` to list out the jobs during investigation. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1197](https://attack.mitre.org/techniques/T1197/) +- **Last Updated**: 2021-03-29 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=bitsadmin.exe Processes.process IN (*create*, *addfile*, *setnotifyflags*, *setnotifycmdline*, *setminretrydelay*, *setcustomheaders*, *resume* ) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `bits_job_persistence_filter` +``` +#### Associated Analytic Story + +* BITS Jobs + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. + +#### Required field + +* _time + +* Processes.process + +* Processes.parent_process + +* Processes.process_name + +* Processes.user + +* Processes.dest + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1197 | BITS Jobs | Defense Evasion, Persistence | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +Limited false positives will be present. Typically, applications will use `BitsAdmin.exe`. Any filtering should be done based on command-line arguments (legitimate applications) or parent process. + +#### Reference + +* https://attack.mitre.org/techniques/T1197/ + +* https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/bitsadmin + +* https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1197/T1197.md#atomic-test-3---persist-download--execute + +* https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/ + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log + + +_version_: 1 +
+ +--- + +### BITSAdmin Download File +The following query identifies Microsoft Background Intelligent Transfer Service utility `bitsadmin.exe` using the `transfer` parameter to download a remote object. In addition, look for `download` or `upload` on the command-line, the switches are not required to perform a transfer. Capture any files downloaded. Review the reputation of the IP or domain used. Typically once executed, a follow on command will be used to execute the dropped file. Note that the network connection or file modification events related will not spawn or create from `bitsadmin.exe`, but the artifacts will appear in a parallel process of `svchost.exe` with a command-line similar to `svchost.exe -k netsvcs -s BITS`. It's important to review all parallel and child processes to capture any behaviors and artifacts. In some suspicious and malicious instances, BITS jobs will be created. You can use `bitsadmin /list /verbose` to list out the jobs during investigation. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1197](https://attack.mitre.org/techniques/T1197/), [T1105](https://attack.mitre.org/techniques/T1105/) +- **Last Updated**: 2021-03-26 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=bitsadmin.exe Processes.process=*transfer* by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `bitsadmin_download_file_filter` +``` +#### Associated Analytic Story + +* Ingress Tool Transfer + +* BITS Jobs + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. + +#### Required field + +* _time + +* Processes.process + +* Processes.parent_process + +* Processes.process_name + +* Processes.user + +* Processes.dest + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1197 | BITS Jobs | Defense Evasion, Persistence | +| T1105 | Ingress Tool Transfer | Command and Control | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +Limited false positives, however it may be required to filter based on parent process name or network connection. + +#### Reference + +* https://github.com/redcanaryco/atomic-red-team/blob/8eb52117b748d378325f7719554a896e37bccec7/atomics/T1105/T1105.md#atomic-test-9---windows---bitsadmin-bits-download + +* https://github.com/redcanaryco/atomic-red-team/blob/bc705cb7aaa5f26f2d96585fac8e4c7052df0ff9/atomics/T1197/T1197.md + +* https://docs.microsoft.com/en-us/windows/win32/bits/bitsadmin-tool + +* https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log + + _version_: 1
@@ -11162,6 +11607,89 @@ _version_: 3 --- +### DSQuery Domain Discovery +The following analytic identifies "dsquery.exe" execution with arguments looking for `TrustedDomain` query directly on the command-line. This is typically indicative of an Administrator or adversary perform domain trust discovery. Note that this query does not identify any other variations of "Dsquery.exe" usage.\ +Within this detection, it is assumed `dsquery.exe` is not moved or renamed.\ +The search will return the first time and last time these command-line arguments were used for these executions, as well as the target system, the user, process "dsquery.exe" and its parent process.\ +DSQuery.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64` and only on Server operating system.\ +The following DLL(s) are loaded when DSQuery.exe is launched `dsquery.dll`. If found loaded by another process, it is possible dsquery is running within that process context in memory.\ +In addition to trust discovery, review parallel processes for additional behaviors performed. Identify the parent process and capture any files (batch files, for example) being used. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1482](https://attack.mitre.org/techniques/T1482/) +- **Last Updated**: 2021-03-31 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=dsquery.exe Processes.process=*trustedDomain* by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `dsquery_domain_discovery_filter` +``` +#### Associated Analytic Story + +* Domain Trust Discovery + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. + +#### Required field + +* _time + +* Processes.process_name + +* Processes.process + +* Processes.user + +* Processes.dest + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1482 | Domain Trust Discovery | Discovery | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +Limited false positives. If there is a true false positive, filter based on command-line or parent process. + +#### Reference + +* https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1482/T1482.md + +* http://www.harmj0y.net/blog/redteaming/a-guide-to-attacking-domain-trusts/ + +* https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732952(v=ws.11) + +* https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc754232(v=ws.11) + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1482/atomic_red_team/windows-sysmon.log + + +_version_: 1 +
+ +--- + ### Deleting Shadow Copies The vssadmin.exe utility is used to interact with the Volume Shadow Copy Service. Wmic is an interface to the Windows Management Instrumentation. This search looks for either of these tools being used to delete shadow copies. @@ -14212,17 +14740,19 @@ The test data is converted from Windows Security Event logs generated from Attac #### Required field -* logon_process +* signature_id -* dest_user_primary_artifact +* authentication_type * _time -* event_code +* authentication_method -* dest_ip_primary_artifact +* origin_device_domain -* logon_type +* dest_user_id + +* dest_device_id @@ -17800,6 +18330,717 @@ _version_: 3 --- +### Disable Registry Tool +This search is to identifies modification of registry to disable the regedit or registry tools of windows operating system. Since registry tool is a swiss knife in analyzing registry, malware such as RAT or trojan Spy disable this application to prevent the removal of their registry entry such as persistence, file less components and defense evasion. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1562.001](https://attack.mitre.org/techniques/T1562.001/) +- **Last Updated**: 2021-03-31 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableRegistryTools" Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest +| `drop_dm_object_name(Registry)` +| `security_content_ctime(firstTime)` +|`security_content_ctime(lastTime)` +| `disable_registry_tool_filter` +``` +#### Associated Analytic Story + +* Windows Defense Evasion Tactics + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. + +#### Required field + +* _time + +* Registry.registry_key_name + +* Registry.registry_path + +* Registry.user + +* Registry.dest + +* Registry.registry_value_name + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1562.001 | Disable or Modify Tools | Defense Evasion | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +admin may disable this application for non technical user. + +#### Reference + +* https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + + +_version_: 1 +
+ +--- + +### Disable Show Hidden Files +The following search is to idetifies a modification in registry to prevent the user seeing all the files with hidden attributes. This event or techniques are known on some worm and trojan spy malware that will drop hidden files on the infected machine. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1564.001](https://attack.mitre.org/techniques/T1564.001/), [T1562.001](https://attack.mitre.org/techniques/T1562.001/) +- **Last Updated**: 2021-03-31 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt" Registry.registry_value_name = "DWORD (0x00000001)") OR (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowSuperHidden" Registry.registry_value_name = "DWORD (0x00000000)") by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest +| `drop_dm_object_name(Registry)` +| `security_content_ctime(firstTime)` +|`security_content_ctime(lastTime)` +| `disable_show_hidden_files_filter` +``` +#### Associated Analytic Story + +* Windows Defense Evasion Tactics + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. + +#### Required field + +* _time + +* Registry.registry_key_name + +* Registry.registry_path + +* Registry.user + +* Registry.dest + +* Registry.registry_value_nam + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1564.001 | Hidden Files and Directories | Defense Evasion | +| T1562.001 | Disable or Modify Tools | Defense Evasion | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +unknown + +#### Reference + +* https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Tiotua-P/detailed-analysis.aspx + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + + +_version_: 1 +
+ +--- + +### Disable Windows Behavior Monitoring +This search is to identifies a modification in registry to disable the windows denfender real time behavior monitoring. This event or technique is commonly seen in RAT, bot, or Trojan to disable AV to evade detections. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1562.001](https://attack.mitre.org/techniques/T1562.001/) +- **Last Updated**: 2021-03-31 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableBehaviorMonitoring" OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableOnAccessProtection" OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableScanOnRealtimeEnable" Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest +| `drop_dm_object_name(Registry)` +| `security_content_ctime(firstTime)` +|`security_content_ctime(lastTime)` +| `disable_windows_behavior_monitoring_filter` +``` +#### Associated Analytic Story + +* Windows Defense Evasion Tactics + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. + +#### Required field + +* _time + +* Registry.registry_key_name + +* Registry.registry_path + +* Registry.user + +* Registry.dest + +* Registry.registry_value_name + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1562.001 | Disable or Modify Tools | Defense Evasion | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +admin or user may choose to disable this windows features. + +#### Reference + +* https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + + +_version_: 1 +
+ +--- + +### Disable Windows SmartScreen Protection +The following search identifies a modification of registry to disable the smartscreen protection of windows machine. This is windows feature provide an early warning system against website that might engage in phishing attack or malware distribution. This modification are seen in RAT malware to cover their tracks upon downloading other of its component or other payload. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1562.001](https://attack.mitre.org/techniques/T1562.001/) +- **Last Updated**: 2021-03-31 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SmartScreenEnabled" Registry.registry_value_name = "Off" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest +| `drop_dm_object_name(Registry)` +| `security_content_ctime(firstTime)` +|`security_content_ctime(lastTime)` +| `disable_windows_smartscreen_protection_filter` +``` +#### Associated Analytic Story + +* Windows Defense Evasion Tactics + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. + +#### Required field + +* _time + +* Registry.registry_key_name + +* Registry.registry_path + +* Registry.user + +* Registry.dest + +* Registry.registry_value_nam + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1562.001 | Disable or Modify Tools | Defense Evasion | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +admin or user may choose to disable this windows features. + +#### Reference + +* https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + + +_version_: 1 +
+ +--- + +### Disabling CMD Application +this search is to identify modification in registry to disable cmd prompt application. This technique is commonly seen in RAT, Trojan or WORM to prevent triaging or deleting there samples through cmd application which is one of the tool of analyst to traverse on directory and files. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1562.001](https://attack.mitre.org/techniques/T1562.001/) +- **Last Updated**: 2021-03-31 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\DisableCMD" Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest +| `drop_dm_object_name(Registry)` +| `security_content_ctime(firstTime)` +|`security_content_ctime(lastTime)` +| `disabling_cmd_application_filter` +``` +#### Associated Analytic Story + +* Windows Defense Evasion Tactics + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. + +#### Required field + +* _time + +* Registry.registry_key_name + +* Registry.registry_path + +* Registry.user + +* Registry.dest + +* Registry.registry_value_name + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1562.001 | Disable or Modify Tools | Defense Evasion | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +admin may disable this application for non technical user. + +#### Reference + +* https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + + +_version_: 1 +
+ +--- + +### Disabling ControlPanel +this search is to identify registry modification to disable control panel window. This technique is commonly seen in malware to prevent their artifacts , persistence removed on the infected machine. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1562.001](https://attack.mitre.org/techniques/T1562.001/) +- **Last Updated**: 2021-03-31 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel" Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest +| `drop_dm_object_name(Registry)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `disabling_controlpanel_filter` +``` +#### Associated Analytic Story + +* Windows Defense Evasion Tactics + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. + +#### Required field + +* _time + +* Registry.registry_key_name + +* Registry.registry_path + +* Registry.user + +* Registry.dest + +* Registry.registry_value_name + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1562.001 | Disable or Modify Tools | Defense Evasion | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +admin may disable this application for non technical user. + +#### Reference + +* https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + + +_version_: 1 +
+ +--- + +### Disabling Firewall with Netsh +This search is to identifies suspicious firewall disabling using netsh application. this technique is commonly seen in malware that tries to communicate or download its component or other payload to its C2 server. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1562.001](https://attack.mitre.org/techniques/T1562.001/) +- **Last Updated**: 2021-03-31 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=netsh.exe Processes.process= "*firewall*" (Processes.process= "*off*" OR Processes.process= "*disable*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `disabling_firewall_with_netsh_filter` +``` +#### Associated Analytic Story + +* Windows Defense Evasion Tactics + + +#### How To Implement +You must be ingesting data that records the filesystem activity from your hosts to populate the Endpoint file-system data model node. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data. + +#### Required field + +* _time + +* Processes.process_name + +* Processes.process + +* Processes.dest + +* Processes.user + +* Processes.parent_process + +* Processes.process_name + +* Processes.process_id + +* Processes.parent_process_id + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1562.001 | Disable or Modify Tools | Defense Evasion | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +admin may disable firewall during testing or fixing network problem. + +#### Reference + +* https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.htm + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + + +_version_: 1 +
+ +--- + +### Disabling FolderOptions Windows Feature +This search is to identify registry modification to disable folder options feature of windows to show hidden files, file extension and etc. This technique used by malware in combination if disabling show hidden files feature to hide their files and also to hide the file extension to lure the user base on file icons or fake file extensions. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1562.001](https://attack.mitre.org/techniques/T1562.001/) +- **Last Updated**: 2021-03-31 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoFolderOptions" Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest +| `drop_dm_object_name(Registry)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `disabling_folderoptions_windows_feature_filter` +``` +#### Associated Analytic Story + +* Windows Defense Evasion Tactics + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. + +#### Required field + +* _time + +* Registry.registry_key_name + +* Registry.registry_path + +* Registry.user + +* Registry.dest + +* Registry.registry_value_name + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1562.001 | Disable or Modify Tools | Defense Evasion | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +admin may disable this application for non technical user. + +#### Reference + +* https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + + +_version_: 1 +
+ +--- + +### Disabling NoRun Windows App +This search is to identify modification of registry to disable run application in window start menu. this application is known to be a helpful shortcut to windows OS user to run known application and also to execute some reg or batch script. This technique is used malware to make cleaning of its infection more harder by preventing known application run easily through run shortcut. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1562.001](https://attack.mitre.org/techniques/T1562.001/) +- **Last Updated**: 2021-03-31 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoRun" Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest +| `drop_dm_object_name(Registry)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `disabling_norun_windows_app_filter` +``` +#### Associated Analytic Story + +* Windows Defense Evasion Tactics + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. + +#### Required field + +* _time + +* Registry.registry_key_name + +* Registry.registry_path + +* Registry.user + +* Registry.dest + +* Registry.registry_value_name + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1562.001 | Disable or Modify Tools | Defense Evasion | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +admin may disable this application for non technical user. + +#### Reference + +* https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry + +* https://blog.malwarebytes.com/detections/pum-optional-norun/ + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + + +_version_: 1 +
+ +--- + ### Disabling Remote User Account Control The search looks for modifications to registry keys that control the enforcement of Windows User Account Control (UAC). @@ -17874,6 +19115,164 @@ _version_: 4 --- +### Disabling SystemRestore In Registry +The following search identifies the modification of registry related in disabling the system restore of a machine. This event or behavior are seen in some RAT malware to make the restore of the infected machine difficult and keep their infection on the box. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1562.001](https://attack.mitre.org/techniques/T1562.001/) +- **Last Updated**: 2021-03-31 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableSR" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableConfig" Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest +| `drop_dm_object_name(Registry)` +| `security_content_ctime(firstTime)` +|`security_content_ctime(lastTime)` +| `disabling_systemrestore_in_registry_filter` +``` +#### Associated Analytic Story + +* Windows Defense Evasion Tactics + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. + +#### Required field + +* _time + +* Registry.registry_key_name + +* Registry.registry_path + +* Registry.user + +* Registry.dest + +* Registry.registry_value_name + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1562.001 | Disable or Modify Tools | Defense Evasion | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +in some cases admin can disable systemrestore on a machine. + +#### Reference + +* https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + + +_version_: 1 +
+ +--- + +### Disabling Task Manager +This search is to identifies modification of registry to disable the task manager of windows operating system. this event or technique are commonly seen in malware such as RAT, Trojan, TrojanSpy or worm to prevent the user to terminate their process. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1562.001](https://attack.mitre.org/techniques/T1562.001/) +- **Last Updated**: 2021-03-31 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableTaskMgr" Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest +| `drop_dm_object_name(Registry)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `disabling_task_manager_filter` +``` +#### Associated Analytic Story + +* Windows Defense Evasion Tactics + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. + +#### Required field + +* _time + +* Registry.registry_key_name + +* Registry.registry_path + +* Registry.user + +* Registry.dest + +* Registry.registry_value_name + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1562.001 | Disable or Modify Tools | Defense Evasion | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +admin may disable this application for non technical user. + +#### Reference + +* https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry + +* https://blog.talosintelligence.com/2020/05/threat-roundup-0424-0501.html + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + + +_version_: 1 +
+ +--- + ### Dump LSASS via comsvcs DLL Detect the usage of comsvcs.dll for dumping the lsass process. @@ -22708,6 +24107,96 @@ _version_: 4 --- +### Malicious Powershell Executed As A Service +This detection is to identify the abuse the Windows SC.exe to execute malicious commands or payloads via PowerShell. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1569.002](https://attack.mitre.org/techniques/T1569.002/) +- **Last Updated**: 2021-04-07 + +
+ details + +#### Search +``` + `wineventlog_system` EventCode=7045 +| eval l_Service_File_Name=lower(Service_File_Name) +| regex l_Service_File_Name="powershell[.\s] +|powershell_ise[.\s] +|pwsh[.\s] +|psexec[.\s]" +| regex l_Service_File_Name="-nop[rofile]* +|-w[indowstyle]*\s+hid[den]* +|-noe[xit]* +|-enc[odedcommand]*" +| stats count min(_time) as firstTime max(_time) as lastTime by EventCode Service_File_Name Service_Name Service_Start_Type Service_Type Service_Account user +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `malicious_powershell_executed_as_a_service_filter` +``` +#### Associated Analytic Story + +* Malicious Powershell + + +#### How To Implement +To successfully implement this search, you need to be ingesting Windows System logs with the Service name, Service File Name Service Start type, and Service Type from your endpoints. + +#### Required field + +* EventCode + +* Service_File_Name + +* Service_Type + +* _time + +* Service_Name + +* Service_Start_Type + +* Service_Account + +* user + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1569.002 | Service Execution | Execution | + + +#### Kill Chain Phase + +* Privilege Escalation + + +#### Known False Positives +Creating a hidden powershell service is rare and could key off of those instances. + +#### Reference + +* https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/dosfuscation-report.pdf + +* http://az4n6.blogspot.com/2017/ + +* https://www.danielbohannon.com/blog-1/2017/3/12/powershell-execution-argument-obfuscation-how-it-can-make-detection-easier + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1569.002/atomic_red_team/windows-system.log + + +_version_: 1 +
+ +--- + ### Monitor DNS For Brand Abuse This search looks for DNS requests for faux domains similar to the domains that you want to have monitored for abuse. @@ -23133,6 +24622,8 @@ This search looks for the execution of `nltest.exe` with command-line arguments * Ryuk Ransomware +* Domain Trust Discovery + #### How To Implement To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -24778,6 +26269,82 @@ Because of imbalance of anomaly data in training, the model will less likely rep #### Test Dataset +_version_: 1 + + +--- + +### PowerShell Start-BitsTransfer +Start-BitsTransfer is the PowerShell "version" of BitsAdmin.exe. Similar functionality is present. This technique variation is not as commonly used by adversaries, but has been abused in the past. Lesser known uses include the ability to set the `-TransferType` to `Upload` for exfiltration of files. In an instance where `Upload` is used, it is highly possible files will be archived. During triage, review parallel processes and process lineage. Capture any files on disk and review. For the remote domain or IP, what is the reputation? + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1197](https://attack.mitre.org/techniques/T1197/) +- **Last Updated**: 2021-03-29 + +
+ details + +#### Search +``` + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe Processes.process=*start-bitstransfer* by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `powershell_start_bitstransfer_filter` +``` +#### Associated Analytic Story + +* BITS Jobs + + +#### How To Implement +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. + +#### Required field + +* _time + +* Processes.process + +* Processes.parent_process + +* Processes.process_name + +* Processes.user + +* Processes.dest + + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1197 | BITS Jobs | Defense Evasion, Persistence | + + +#### Kill Chain Phase + +* Exploitation + + +#### Known False Positives +Limited false positives. It is possible administrators will utilize Start-BitsTransfer for administrative tasks, otherwise filter based parent process or command-line arguments. + +#### Reference + +* https://isc.sans.edu/diary/Investigating+Microsoft+BITS+Activity/23281 + +* https://docs.microsoft.com/en-us/windows/win32/bits/using-windows-powershell-to-create-bits-transfer-jobs + + +#### Test Dataset + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log + + _version_: 1
@@ -27510,7 +29077,7 @@ This search monitors for remote modifications to registry keys. #### Search ``` -| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="\\\\*" by Registry.dest , Registry.user +| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="\\\\*" by Registry.dest , Registry.user | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` @@ -29501,7 +31068,7 @@ This search looks for changes to registry values that control Windows file assoc | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | join [ -| tstats `security_content_summariesonly` values(Registry.registry_path) as registry_path count FROM datamodel=Endpoint.Registry where Registry.registry_path=*\\Explorer\\FileExts* by Registry.process_id Registry.dest +| tstats `security_content_summariesonly` values(Registry.registry_path) as registry_path count from datamodel=Endpoint.Registry where Registry.registry_path=*\\Explorer\\FileExts* by Registry.process_id Registry.dest | `drop_dm_object_name("Registry")` | table process_id dest registry_path] | `suspicious_changes_to_file_associations_filter` @@ -33464,6 +35031,8 @@ This search looks for the execution of `adfind.exe` with command-line arguments * NOBELIUM Group +* Domain Trust Discovery + #### How To Implement To successfully implement this search, you need to be ingesting logs with the process name, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. diff --git a/docs/detections.wiki b/docs/detections.wiki index 9a59c287b8..bba9ca3b01 100644 --- a/docs/detections.wiki +++ b/docs/detections.wiki @@ -1490,6 +1490,85 @@ bucket with S3 encryption * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1486/s3_file_encryption/aws_cloudtrail_events.json +''version'': 1 + + + +---- + +===Aws excessive security scanning=== +This search looks for CloudTrail events and analyse the amount of eventNames which starts with Describe by a single user. This indicates that this user scans the configuration of your AWS cloud environment. + +* '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1526/ T1526] +* '''Last Updated''': 2021-04-13 + +
+
+ +====Search==== +`cloudtrail` eventName=Describe* OR eventName=List* OR eventName=Get* +| stats dc(eventName) as dc_events min(_time) as firstTime max(_time) as lastTime values(eventName) as eventName values(src) as src values(userAgent) as userAgent by user userIdentity.arn +| where dc_events > 50 +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +|`aws_excessive_security_scanning_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#AWS_User_Monitoring|AWS User Monitoring]] + + +====How To Implement==== +You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs. + +====Required field==== + +* _time + +* eventName + +* src + +* userAgent + +* user + +* userIdentity.arn + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1526 +| Cloud Service Discovery +| Discovery +|} + + +====Kill Chain Phase==== + +* Actions on Objectives + + +====Known False Positives==== +While this search has no known false positives. + +====Reference==== + +* https://github.com/aquasecurity/cloudsploit + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1526/aws_security_scanner/aws_security_scanner.json + + ''version'': 1
@@ -10418,7 +10497,7 @@ This search monitors for remote modifications to registry keys. ====Search==== -| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="\\\\*" by Registry.dest , Registry.user +| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="\\\\*" by Registry.dest , Registry.user | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` @@ -10719,7 +10798,7 @@ This search looks for changes to registry values that control Windows file assoc | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | join [ -| tstats `security_content_summariesonly` values(Registry.registry_path) as registry_path count FROM datamodel=Endpoint.Registry where Registry.registry_path=*\\Explorer\\FileExts* by Registry.process_id Registry.dest +| tstats `security_content_summariesonly` values(Registry.registry_path) as registry_path count from datamodel=Endpoint.Registry where Registry.registry_path=*\\Explorer\\FileExts* by Registry.process_id Registry.dest | `drop_dm_object_name("Registry")` | table process_id dest registry_path] | `suspicious_changes_to_file_associations_filter` @@ -11662,6 +11741,8 @@ The following analytic identifies the use of PowerShell downloading a file using * [[Documentation:ESSOC:stories:UseCase#Malicious_PowerShell|Malicious PowerShell]] +* [[Documentation:ESSOC:stories:UseCase#Ingress_Tool_Transfer|Ingress Tool Transfer]] + ====How To Implement==== To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -11753,6 +11834,8 @@ The following analytic identifies the use of PowerShell downloading a file using * [[Documentation:ESSOC:stories:UseCase#HAFNIUM_Group|HAFNIUM Group]] +* [[Documentation:ESSOC:stories:UseCase#Ingress_Tool_Transfer|Ingress Tool Transfer]] + ====How To Implement==== To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -12612,6 +12695,182 @@ Administrators may modify the boot configuration. * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log +''version'': 1 + + + +---- + +===Bits job persistence=== +The following query identifies Microsoft Background Intelligent Transfer Service utility `bitsadmin.exe` scheduling a BITS job to persist on an endpoint. The query identifies the parameters used to create, resume or add a file to a BITS job. Typically seen combined in a oneliner or ran in sequence. If identified, review the BITS job created and capture any files written to disk. It is possible for BITS to be used to upload files and this may require further network data analysis to identify. You can use `bitsadmin /list /verbose` to list out the jobs during investigation. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1197/ T1197] +* '''Last Updated''': 2021-03-29 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=bitsadmin.exe Processes.process IN (*create*, *addfile*, *setnotifyflags*, *setnotifycmdline*, *setminretrydelay*, *setcustomheaders*, *resume* ) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `bits_job_persistence_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#BITS_Jobs|BITS Jobs]] + + +====How To Implement==== +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. + +====Required field==== + +* _time + +* Processes.process + +* Processes.parent_process + +* Processes.process_name + +* Processes.user + +* Processes.dest + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1197 +| BITS Jobs +| Defense Evasion, Persistence +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +Limited false positives will be present. Typically, applications will use `BitsAdmin.exe`. Any filtering should be done based on command-line arguments (legitimate applications) or parent process. + +====Reference==== + +* https://attack.mitre.org/techniques/T1197/ + +* https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/bitsadmin + +* https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1197/T1197.md#atomic-test-3---persist-download--execute + +* https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/ + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log + + +''version'': 1 +
+
+ +---- + +===Bitsadmin download file=== +The following query identifies Microsoft Background Intelligent Transfer Service utility `bitsadmin.exe` using the `transfer` parameter to download a remote object. In addition, look for `download` or `upload` on the command-line, the switches are not required to perform a transfer. Capture any files downloaded. Review the reputation of the IP or domain used. Typically once executed, a follow on command will be used to execute the dropped file. Note that the network connection or file modification events related will not spawn or create from `bitsadmin.exe`, but the artifacts will appear in a parallel process of `svchost.exe` with a command-line similar to `svchost.exe -k netsvcs -s BITS`. It's important to review all parallel and child processes to capture any behaviors and artifacts. In some suspicious and malicious instances, BITS jobs will be created. You can use `bitsadmin /list /verbose` to list out the jobs during investigation. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1197/ T1197], [https://attack.mitre.org/techniques/T1105/ T1105] +* '''Last Updated''': 2021-03-26 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=bitsadmin.exe Processes.process=*transfer* by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `bitsadmin_download_file_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Ingress_Tool_Transfer|Ingress Tool Transfer]] + +* [[Documentation:ESSOC:stories:UseCase#BITS_Jobs|BITS Jobs]] + + +====How To Implement==== +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. + +====Required field==== + +* _time + +* Processes.process + +* Processes.parent_process + +* Processes.process_name + +* Processes.user + +* Processes.dest + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1197 +| BITS Jobs +| Defense Evasion, Persistence +|- +| T1105 +| Ingress Tool Transfer +| Command and Control +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +Limited false positives, however it may be required to filter based on parent process name or network connection. + +====Reference==== + +* https://github.com/redcanaryco/atomic-red-team/blob/8eb52117b748d378325f7719554a896e37bccec7/atomics/T1105/T1105.md#atomic-test-9---windows---bitsadmin-bits-download + +* https://github.com/redcanaryco/atomic-red-team/blob/bc705cb7aaa5f26f2d96585fac8e4c7052df0ff9/atomics/T1197/T1197.md + +* https://docs.microsoft.com/en-us/windows/win32/bits/bitsadmin-tool + +* https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log + + ''version'': 1
@@ -15057,6 +15316,94 @@ None identified. * https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logPowerShellModule.log +''version'': 1 + + + +---- + +===Dsquery domain discovery=== +The following analytic identifies "dsquery.exe" execution with arguments looking for `TrustedDomain` query directly on the command-line. This is typically indicative of an Administrator or adversary perform domain trust discovery. Note that this query does not identify any other variations of "Dsquery.exe" usage.\ +Within this detection, it is assumed `dsquery.exe` is not moved or renamed.\ +The search will return the first time and last time these command-line arguments were used for these executions, as well as the target system, the user, process "dsquery.exe" and its parent process.\ +DSQuery.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64` and only on Server operating system.\ +The following DLL(s) are loaded when DSQuery.exe is launched `dsquery.dll`. If found loaded by another process, it is possible dsquery is running within that process context in memory.\ +In addition to trust discovery, review parallel processes for additional behaviors performed. Identify the parent process and capture any files (batch files, for example) being used. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1482/ T1482] +* '''Last Updated''': 2021-03-31 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=dsquery.exe Processes.process=*trustedDomain* by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `dsquery_domain_discovery_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Domain_Trust_Discovery|Domain Trust Discovery]] + + +====How To Implement==== +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. + +====Required field==== + +* _time + +* Processes.process_name + +* Processes.process + +* Processes.user + +* Processes.dest + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1482 +| Domain Trust Discovery +| Discovery +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +Limited false positives. If there is a true false positive, filter based on command-line or parent process. + +====Reference==== + +* https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1482/T1482.md + +* http://www.harmj0y.net/blog/redteaming/a-guide-to-attacking-domain-trusts/ + +* https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732952(v=ws.11) + +* https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc754232(v=ws.11) + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1482/atomic_red_team/windows-sysmon.log + + ''version'': 1
@@ -16718,17 +17065,19 @@ The test data is converted from Windows Security Event logs generated from Attac ====Required field==== -* logon_process +* signature_id -* dest_user_primary_artifact +* authentication_type * _time -* event_code +* authentication_method -* dest_ip_primary_artifact +* origin_device_domain -* logon_type +* dest_user_id + +* dest_device_id @@ -18566,6 +18915,765 @@ While legitimate, these NirSoft tools are prone to abuse. You should verfiy that ---- +===Disable registry tool=== +This search is to identifies modification of registry to disable the regedit or registry tools of windows operating system. Since registry tool is a swiss knife in analyzing registry, malware such as RAT or trojan Spy disable this application to prevent the removal of their registry entry such as persistence, file less components and defense evasion. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562.001/ T1562.001] +* '''Last Updated''': 2021-03-31 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableRegistryTools" Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest +| `drop_dm_object_name(Registry)` +| `security_content_ctime(firstTime)` +|`security_content_ctime(lastTime)` +| `disable_registry_tool_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Windows_Defense_Evasion_Tactics|Windows Defense Evasion Tactics]] + + +====How To Implement==== +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. + +====Required field==== + +* _time + +* Registry.registry_key_name + +* Registry.registry_path + +* Registry.user + +* Registry.dest + +* Registry.registry_value_name + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1562.001 +| Disable or Modify Tools +| Defense Evasion +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +admin may disable this application for non technical user. + +====Reference==== + +* https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + + +''version'': 1 +
+
+ +---- + +===Disable show hidden files=== +The following search is to idetifies a modification in registry to prevent the user seeing all the files with hidden attributes. This event or techniques are known on some worm and trojan spy malware that will drop hidden files on the infected machine. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1564.001/ T1564.001], [https://attack.mitre.org/techniques/T1562.001/ T1562.001] +* '''Last Updated''': 2021-03-31 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt" Registry.registry_value_name = "DWORD (0x00000001)") OR (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowSuperHidden" Registry.registry_value_name = "DWORD (0x00000000)") by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest +| `drop_dm_object_name(Registry)` +| `security_content_ctime(firstTime)` +|`security_content_ctime(lastTime)` +| `disable_show_hidden_files_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Windows_Defense_Evasion_Tactics|Windows Defense Evasion Tactics]] + + +====How To Implement==== +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. + +====Required field==== + +* _time + +* Registry.registry_key_name + +* Registry.registry_path + +* Registry.user + +* Registry.dest + +* Registry.registry_value_nam + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1564.001 +| Hidden Files and Directories +| Defense Evasion +|- +| T1562.001 +| Disable or Modify Tools +| Defense Evasion +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +unknown + +====Reference==== + +* https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Tiotua-P/detailed-analysis.aspx + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + + +''version'': 1 +
+
+ +---- + +===Disable windows behavior monitoring=== +This search is to identifies a modification in registry to disable the windows denfender real time behavior monitoring. This event or technique is commonly seen in RAT, bot, or Trojan to disable AV to evade detections. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562.001/ T1562.001] +* '''Last Updated''': 2021-03-31 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableBehaviorMonitoring" OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableOnAccessProtection" OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableScanOnRealtimeEnable" Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest +| `drop_dm_object_name(Registry)` +| `security_content_ctime(firstTime)` +|`security_content_ctime(lastTime)` +| `disable_windows_behavior_monitoring_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Windows_Defense_Evasion_Tactics|Windows Defense Evasion Tactics]] + + +====How To Implement==== +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. + +====Required field==== + +* _time + +* Registry.registry_key_name + +* Registry.registry_path + +* Registry.user + +* Registry.dest + +* Registry.registry_value_name + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1562.001 +| Disable or Modify Tools +| Defense Evasion +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +admin or user may choose to disable this windows features. + +====Reference==== + +* https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + + +''version'': 1 +
+
+ +---- + +===Disable windows smartscreen protection=== +The following search identifies a modification of registry to disable the smartscreen protection of windows machine. This is windows feature provide an early warning system against website that might engage in phishing attack or malware distribution. This modification are seen in RAT malware to cover their tracks upon downloading other of its component or other payload. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562.001/ T1562.001] +* '''Last Updated''': 2021-03-31 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SmartScreenEnabled" Registry.registry_value_name = "Off" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest +| `drop_dm_object_name(Registry)` +| `security_content_ctime(firstTime)` +|`security_content_ctime(lastTime)` +| `disable_windows_smartscreen_protection_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Windows_Defense_Evasion_Tactics|Windows Defense Evasion Tactics]] + + +====How To Implement==== +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. + +====Required field==== + +* _time + +* Registry.registry_key_name + +* Registry.registry_path + +* Registry.user + +* Registry.dest + +* Registry.registry_value_nam + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1562.001 +| Disable or Modify Tools +| Defense Evasion +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +admin or user may choose to disable this windows features. + +====Reference==== + +* https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + + +''version'': 1 +
+
+ +---- + +===Disabling cmd application=== +this search is to identify modification in registry to disable cmd prompt application. This technique is commonly seen in RAT, Trojan or WORM to prevent triaging or deleting there samples through cmd application which is one of the tool of analyst to traverse on directory and files. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562.001/ T1562.001] +* '''Last Updated''': 2021-03-31 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\DisableCMD" Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest +| `drop_dm_object_name(Registry)` +| `security_content_ctime(firstTime)` +|`security_content_ctime(lastTime)` +| `disabling_cmd_application_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Windows_Defense_Evasion_Tactics|Windows Defense Evasion Tactics]] + + +====How To Implement==== +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. + +====Required field==== + +* _time + +* Registry.registry_key_name + +* Registry.registry_path + +* Registry.user + +* Registry.dest + +* Registry.registry_value_name + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1562.001 +| Disable or Modify Tools +| Defense Evasion +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +admin may disable this application for non technical user. + +====Reference==== + +* https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + + +''version'': 1 +
+
+ +---- + +===Disabling controlpanel=== +this search is to identify registry modification to disable control panel window. This technique is commonly seen in malware to prevent their artifacts , persistence removed on the infected machine. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562.001/ T1562.001] +* '''Last Updated''': 2021-03-31 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel" Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest +| `drop_dm_object_name(Registry)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `disabling_controlpanel_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Windows_Defense_Evasion_Tactics|Windows Defense Evasion Tactics]] + + +====How To Implement==== +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. + +====Required field==== + +* _time + +* Registry.registry_key_name + +* Registry.registry_path + +* Registry.user + +* Registry.dest + +* Registry.registry_value_name + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1562.001 +| Disable or Modify Tools +| Defense Evasion +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +admin may disable this application for non technical user. + +====Reference==== + +* https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + + +''version'': 1 +
+
+ +---- + +===Disabling firewall with netsh=== +This search is to identifies suspicious firewall disabling using netsh application. this technique is commonly seen in malware that tries to communicate or download its component or other payload to its C2 server. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562.001/ T1562.001] +* '''Last Updated''': 2021-03-31 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=netsh.exe Processes.process= "*firewall*" (Processes.process= "*off*" OR Processes.process= "*disable*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `disabling_firewall_with_netsh_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Windows_Defense_Evasion_Tactics|Windows Defense Evasion Tactics]] + + +====How To Implement==== +You must be ingesting data that records the filesystem activity from your hosts to populate the Endpoint file-system data model node. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data. + +====Required field==== + +* _time + +* Processes.process_name + +* Processes.process + +* Processes.dest + +* Processes.user + +* Processes.parent_process + +* Processes.process_name + +* Processes.process_id + +* Processes.parent_process_id + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1562.001 +| Disable or Modify Tools +| Defense Evasion +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +admin may disable firewall during testing or fixing network problem. + +====Reference==== + +* https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.htm + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + + +''version'': 1 +
+
+ +---- + +===Disabling folderoptions windows feature=== +This search is to identify registry modification to disable folder options feature of windows to show hidden files, file extension and etc. This technique used by malware in combination if disabling show hidden files feature to hide their files and also to hide the file extension to lure the user base on file icons or fake file extensions. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562.001/ T1562.001] +* '''Last Updated''': 2021-03-31 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoFolderOptions" Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest +| `drop_dm_object_name(Registry)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `disabling_folderoptions_windows_feature_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Windows_Defense_Evasion_Tactics|Windows Defense Evasion Tactics]] + + +====How To Implement==== +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. + +====Required field==== + +* _time + +* Registry.registry_key_name + +* Registry.registry_path + +* Registry.user + +* Registry.dest + +* Registry.registry_value_name + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1562.001 +| Disable or Modify Tools +| Defense Evasion +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +admin may disable this application for non technical user. + +====Reference==== + +* https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + + +''version'': 1 +
+
+ +---- + +===Disabling norun windows app=== +This search is to identify modification of registry to disable run application in window start menu. this application is known to be a helpful shortcut to windows OS user to run known application and also to execute some reg or batch script. This technique is used malware to make cleaning of its infection more harder by preventing known application run easily through run shortcut. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562.001/ T1562.001] +* '''Last Updated''': 2021-03-31 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoRun" Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest +| `drop_dm_object_name(Registry)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `disabling_norun_windows_app_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Windows_Defense_Evasion_Tactics|Windows Defense Evasion Tactics]] + + +====How To Implement==== +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. + +====Required field==== + +* _time + +* Registry.registry_key_name + +* Registry.registry_path + +* Registry.user + +* Registry.dest + +* Registry.registry_value_name + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1562.001 +| Disable or Modify Tools +| Defense Evasion +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +admin may disable this application for non technical user. + +====Reference==== + +* https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry + +* https://blog.malwarebytes.com/detections/pum-optional-norun/ + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + + +''version'': 1 +
+
+ +---- + ===Disabling remote user account control=== The search looks for modifications to registry keys that control the enforcement of Windows User Account Control (UAC). @@ -18645,6 +19753,174 @@ This registry key may be modified via administrators to implement a change in sy ---- +===Disabling systemrestore in registry=== +The following search identifies the modification of registry related in disabling the system restore of a machine. This event or behavior are seen in some RAT malware to make the restore of the infected machine difficult and keep their infection on the box. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562.001/ T1562.001] +* '''Last Updated''': 2021-03-31 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableSR" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableConfig" Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest +| `drop_dm_object_name(Registry)` +| `security_content_ctime(firstTime)` +|`security_content_ctime(lastTime)` +| `disabling_systemrestore_in_registry_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Windows_Defense_Evasion_Tactics|Windows Defense Evasion Tactics]] + + +====How To Implement==== +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. + +====Required field==== + +* _time + +* Registry.registry_key_name + +* Registry.registry_path + +* Registry.user + +* Registry.dest + +* Registry.registry_value_name + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1562.001 +| Disable or Modify Tools +| Defense Evasion +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +in some cases admin can disable systemrestore on a machine. + +====Reference==== + +* https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + + +''version'': 1 +
+
+ +---- + +===Disabling task manager=== +This search is to identifies modification of registry to disable the task manager of windows operating system. this event or technique are commonly seen in malware such as RAT, Trojan, TrojanSpy or worm to prevent the user to terminate their process. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562.001/ T1562.001] +* '''Last Updated''': 2021-03-31 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableTaskMgr" Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest +| `drop_dm_object_name(Registry)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `disabling_task_manager_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Windows_Defense_Evasion_Tactics|Windows Defense Evasion Tactics]] + + +====How To Implement==== +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. + +====Required field==== + +* _time + +* Registry.registry_key_name + +* Registry.registry_path + +* Registry.user + +* Registry.dest + +* Registry.registry_value_name + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1562.001 +| Disable or Modify Tools +| Defense Evasion +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +admin may disable this application for non technical user. + +====Reference==== + +* https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry + +* https://blog.talosintelligence.com/2020/05/threat-roundup-0424-0501.html + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log + + +''version'': 1 +
+
+ +---- + ===Dump lsass via comsvcs dll=== Detect the usage of comsvcs.dll for dumping the lsass process. @@ -21037,6 +22313,101 @@ These characters might be legitimately on the command-line, but it is not common ---- +===Malicious powershell executed as a service=== +This detection is to identify the abuse the Windows SC.exe to execute malicious commands or payloads via PowerShell. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1569.002/ T1569.002] +* '''Last Updated''': 2021-04-07 + +
+
+ +====Search==== + `wineventlog_system` EventCode=7045 +| eval l_Service_File_Name=lower(Service_File_Name) +| regex l_Service_File_Name="powershell[.\s] +|powershell_ise[.\s] +|pwsh[.\s] +|psexec[.\s]" +| regex l_Service_File_Name="-nop[rofile]* +|-w[indowstyle]*\s+hid[den]* +|-noe[xit]* +|-enc[odedcommand]*" +| stats count min(_time) as firstTime max(_time) as lastTime by EventCode Service_File_Name Service_Name Service_Start_Type Service_Type Service_Account user +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `malicious_powershell_executed_as_a_service_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#Malicious_Powershell|Malicious Powershell]] + + +====How To Implement==== +To successfully implement this search, you need to be ingesting Windows System logs with the Service name, Service File Name Service Start type, and Service Type from your endpoints. + +====Required field==== + +* EventCode + +* Service_File_Name + +* Service_Type + +* _time + +* Service_Name + +* Service_Start_Type + +* Service_Account + +* user + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1569.002 +| Service Execution +| Execution +|} + + +====Kill Chain Phase==== + +* Privilege Escalation + + +====Known False Positives==== +Creating a hidden powershell service is rare and could key off of those instances. + +====Reference==== + +* https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/dosfuscation-report.pdf + +* http://az4n6.blogspot.com/2017/ + +* https://www.danielbohannon.com/blog-1/2017/3/12/powershell-execution-argument-obfuscation-how-it-can-make-detection-easier + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1569.002/atomic_red_team/windows-system.log + + +''version'': 1 +
+
+ +---- + ===Monitor registry keys for print monitors=== This search looks for registry activity associated with modifications to the registry key `HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors`. In this scenario, an attacker can load an arbitrary .dll into the print-monitor registry by giving the full path name to the after.dll. The system will execute the .dll with elevated (SYSTEM) permissions and will persist after reboot. @@ -21220,6 +22591,8 @@ This search looks for the execution of `nltest.exe` with command-line arguments * [[Documentation:ESSOC:stories:UseCase#Ryuk_Ransomware|Ryuk Ransomware]] +* [[Documentation:ESSOC:stories:UseCase#Domain_Trust_Discovery|Domain Trust Discovery]] + ====How To Implement==== To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -21551,6 +22924,87 @@ Microsoft may provide updates to these binaries. Verify that these changes do no ---- +===Powershell start-bitstransfer=== +Start-BitsTransfer is the PowerShell "version" of BitsAdmin.exe. Similar functionality is present. This technique variation is not as commonly used by adversaries, but has been abused in the past. Lesser known uses include the ability to set the `-TransferType` to `Upload` for exfiltration of files. In an instance where `Upload` is used, it is highly possible files will be archived. During triage, review parallel processes and process lineage. Capture any files on disk and review. For the remote domain or IP, what is the reputation? + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1197/ T1197] +* '''Last Updated''': 2021-03-29 + +
+
+ +====Search==== + +| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe Processes.process=*start-bitstransfer* by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id +| `drop_dm_object_name(Processes)` +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `powershell_start_bitstransfer_filter` + +====Associated Analytic Story==== + +* [[Documentation:ESSOC:stories:UseCase#BITS_Jobs|BITS Jobs]] + + +====How To Implement==== +To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. + +====Required field==== + +* _time + +* Processes.process + +* Processes.parent_process + +* Processes.process_name + +* Processes.user + +* Processes.dest + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1197 +| BITS Jobs +| Defense Evasion, Persistence +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Known False Positives==== +Limited false positives. It is possible administrators will utilize Start-BitsTransfer for administrative tasks, otherwise filter based parent process or command-line arguments. + +====Reference==== + +* https://isc.sans.edu/diary/Investigating+Microsoft+BITS+Activity/23281 + +* https://docs.microsoft.com/en-us/windows/win32/bits/using-windows-powershell-to-create-bits-transfer-jobs + + +====Test Dataset==== + +* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log + + +''version'': 1 +
+
+ +---- + ===Probing access with stolen credentials via powersploit modules=== This detection identifies use of PowerSploit modules that facilitate access probing with admin credentials as well as probing access to system services. @@ -28671,6 +30125,8 @@ This search looks for the execution of `adfind.exe` with command-line arguments * [[Documentation:ESSOC:stories:UseCase#NOBELIUM_Group|NOBELIUM Group]] +* [[Documentation:ESSOC:stories:UseCase#Domain_Trust_Discovery|Domain Trust Discovery]] + ====How To Implement==== To successfully implement this search, you need to be ingesting logs with the process name, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. @@ -31671,7 +33127,7 @@ There might be false positives associted with this detection since items like ar ''#############'' ''# Automatically generated by doc_gen.py in https://github.com/splunk/security_content'' -''# On Date: 2021-04-02 17:10:21.330169 UTC'' +''# On Date: 2021-04-15 19:33:37.850083 UTC'' ''# Author: Splunk Security Research'' ''# Contact: research@splunk.com'' ''#############'' diff --git a/docs/mitre-map/coverage.csv b/docs/mitre-map/coverage.csv index ebbfc0318a..71510b3d79 100644 --- a/docs/mitre-map/coverage.csv +++ b/docs/mitre-map/coverage.csv @@ -138,7 +138,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -231,7 +231,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -424,8 +424,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -585,9 +586,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -678,8 +690,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -721,7 +733,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -748,8 +762,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -795,8 +809,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -811,8 +826,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -827,7 +843,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -844,7 +861,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -1050,7 +1068,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -1143,7 +1161,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -1336,8 +1354,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -1497,9 +1516,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -1590,8 +1620,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -1633,7 +1663,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -1660,8 +1692,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -1707,8 +1739,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -1723,8 +1756,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -1739,7 +1773,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -1756,7 +1791,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -1962,7 +1998,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -2055,7 +2091,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -2248,8 +2284,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -2409,9 +2446,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -2502,8 +2550,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -2545,7 +2593,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -2572,8 +2622,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -2619,8 +2669,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -2635,8 +2686,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -2651,7 +2703,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -2668,7 +2721,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -2874,7 +2928,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -2967,7 +3021,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -3160,8 +3214,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -3321,9 +3376,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -3414,8 +3480,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -3457,7 +3523,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -3484,8 +3552,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -3531,8 +3599,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -3547,8 +3616,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -3563,7 +3633,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -3580,7 +3651,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -3786,7 +3858,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -3879,7 +3951,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -4072,8 +4144,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -4233,9 +4306,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -4326,8 +4410,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -4369,7 +4453,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -4396,8 +4482,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -4443,8 +4529,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -4459,8 +4546,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -4475,7 +4563,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -4492,7 +4581,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -4698,7 +4788,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -4791,7 +4881,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -4984,8 +5074,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -5145,9 +5236,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -5238,8 +5340,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -5281,7 +5383,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -5308,8 +5412,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -5355,8 +5459,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -5371,8 +5476,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -5387,7 +5493,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -5404,7 +5511,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -5610,7 +5718,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -5703,7 +5811,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -5896,8 +6004,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -6057,9 +6166,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -6150,8 +6270,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -6193,7 +6313,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -6220,8 +6342,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -6267,8 +6389,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -6283,8 +6406,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -6299,7 +6423,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -6316,7 +6441,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -6522,7 +6648,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -6615,7 +6741,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -6808,8 +6934,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -6969,9 +7096,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -7062,8 +7200,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -7105,7 +7243,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -7132,8 +7272,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -7179,8 +7319,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -7195,8 +7336,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -7211,7 +7353,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -7228,7 +7371,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -7434,7 +7578,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -7527,7 +7671,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -7720,8 +7864,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -7881,9 +8026,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -7974,8 +8130,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -8017,7 +8173,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -8044,8 +8202,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -8091,8 +8249,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -8107,8 +8266,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -8123,7 +8283,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -8140,7 +8301,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -8346,7 +8508,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -8439,7 +8601,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -8632,8 +8794,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -8793,9 +8956,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -8886,8 +9060,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -8929,7 +9103,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -8956,8 +9132,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -9003,8 +9179,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -9019,8 +9196,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -9035,7 +9213,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -9052,7 +9231,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -9258,7 +9438,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -9351,7 +9531,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -9544,8 +9724,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -9705,9 +9886,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -9798,8 +9990,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -9841,7 +10033,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -9868,8 +10062,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -9915,8 +10109,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -9931,8 +10126,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -9947,7 +10143,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -9964,7 +10161,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -10170,7 +10368,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -10263,7 +10461,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -10456,8 +10654,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -10617,9 +10816,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -10710,8 +10920,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -10753,7 +10963,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -10780,8 +10992,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -10827,8 +11039,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -10843,8 +11056,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -10859,7 +11073,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -10876,7 +11091,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -11082,7 +11298,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -11175,7 +11391,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -11368,8 +11584,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -11529,9 +11746,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -11622,8 +11850,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -11665,7 +11893,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -11692,8 +11922,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -11739,8 +11969,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -11755,8 +11986,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -11771,7 +12003,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -11788,7 +12021,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -11994,7 +12228,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -12087,7 +12321,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -12280,8 +12514,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -12441,9 +12676,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -12534,8 +12780,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -12577,7 +12823,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -12604,8 +12852,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -12651,8 +12899,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -12667,8 +12916,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -12683,7 +12933,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -12700,7 +12951,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -12906,7 +13158,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -12999,7 +13251,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -13192,8 +13444,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -13353,9 +13606,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -13446,8 +13710,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -13489,7 +13753,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -13516,8 +13782,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -13563,8 +13829,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -13579,8 +13846,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -13595,7 +13863,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -13612,7 +13881,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -13818,7 +14088,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -13911,7 +14181,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -14104,8 +14374,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -14265,9 +14536,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -14358,8 +14640,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -14401,7 +14683,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -14428,8 +14712,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -14475,8 +14759,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -14491,8 +14776,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -14507,7 +14793,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -14524,7 +14811,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -14730,7 +15018,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -14823,7 +15111,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -15016,8 +15304,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -15177,9 +15466,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -15270,8 +15570,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -15313,7 +15613,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -15340,8 +15642,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -15387,8 +15689,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -15403,8 +15706,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -15419,7 +15723,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -15436,7 +15741,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -15642,7 +15948,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -15735,7 +16041,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -15928,8 +16234,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -16089,9 +16396,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -16182,8 +16500,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -16225,7 +16543,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -16252,8 +16572,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -16299,8 +16619,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -16315,8 +16636,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -16331,7 +16653,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -16348,7 +16671,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -16554,7 +16878,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -16647,7 +16971,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -16840,8 +17164,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -17001,9 +17326,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -17094,8 +17430,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -17137,7 +17473,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -17164,8 +17502,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -17211,8 +17549,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -17227,8 +17566,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -17243,7 +17583,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -17260,7 +17601,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -17466,7 +17808,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -17559,7 +17901,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -17752,8 +18094,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -17913,9 +18256,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -18006,8 +18360,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -18049,7 +18403,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -18076,8 +18432,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -18123,8 +18479,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -18139,8 +18496,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -18155,7 +18513,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -18172,7 +18531,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -18378,7 +18738,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -18471,7 +18831,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -18664,8 +19024,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -18825,9 +19186,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -18918,8 +19290,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -18961,7 +19333,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -18988,8 +19362,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -19035,8 +19409,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -19051,8 +19426,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -19067,7 +19443,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -19084,7 +19461,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -19290,7 +19668,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -19383,7 +19761,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -19576,8 +19954,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -19737,9 +20116,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -19830,8 +20220,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -19873,7 +20263,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -19900,8 +20292,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -19947,8 +20339,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -19963,8 +20356,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -19979,7 +20373,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -19996,7 +20391,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -20202,7 +20598,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -20295,7 +20691,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -20488,8 +20884,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -20649,9 +21046,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -20742,8 +21150,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -20785,7 +21193,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -20812,8 +21222,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -20859,8 +21269,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -20875,8 +21286,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -20891,7 +21303,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -20908,7 +21321,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -21114,7 +21528,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -21207,7 +21621,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -21400,8 +21814,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -21561,9 +21976,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -21654,8 +22080,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -21697,7 +22123,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -21724,8 +22152,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -21771,8 +22199,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -21787,8 +22216,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -21803,7 +22233,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -21820,7 +22251,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -22026,7 +22458,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -22119,7 +22551,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -22312,8 +22744,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -22473,9 +22906,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -22566,8 +23010,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -22609,7 +23053,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -22636,8 +23082,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -22683,8 +23129,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -22699,8 +23146,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -22715,7 +23163,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -22732,7 +23181,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -22938,7 +23388,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -23031,7 +23481,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -23224,8 +23674,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -23385,9 +23836,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -23478,8 +23940,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -23521,7 +23983,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -23548,8 +24012,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -23595,8 +24059,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -23611,8 +24076,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -23627,7 +24093,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -23644,7 +24111,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -23850,7 +24318,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -23943,7 +24411,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -24136,8 +24604,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -24297,9 +24766,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -24390,8 +24870,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -24433,7 +24913,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -24460,8 +24942,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -24507,8 +24989,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -24523,8 +25006,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -24539,7 +25023,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -24556,7 +25041,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -24762,7 +25248,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -24855,7 +25341,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -25048,8 +25534,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -25209,9 +25696,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -25302,8 +25800,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -25345,7 +25843,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -25372,8 +25872,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -25419,8 +25919,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -25435,8 +25936,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -25451,7 +25953,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -25468,7 +25971,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -25674,7 +26178,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -25767,7 +26271,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -25960,8 +26464,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -26121,9 +26626,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -26214,8 +26730,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -26257,7 +26773,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -26284,8 +26802,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -26331,8 +26849,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -26347,8 +26866,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -26363,7 +26883,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -26380,7 +26901,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -26586,7 +27108,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -26679,7 +27201,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -26872,8 +27394,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -27033,9 +27556,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -27126,8 +27660,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -27169,7 +27703,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -27196,8 +27732,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -27243,8 +27779,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -27259,8 +27796,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -27275,7 +27813,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -27292,7 +27831,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -27498,7 +28038,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -27591,7 +28131,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -27784,8 +28324,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -27945,9 +28486,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -28038,8 +28590,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -28081,7 +28633,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -28108,8 +28662,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -28155,8 +28709,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -28171,8 +28726,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -28187,7 +28743,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -28204,7 +28761,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -28410,7 +28968,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -28503,7 +29061,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -28696,8 +29254,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -28857,9 +29416,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -28950,8 +29520,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -28993,7 +29563,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -29020,8 +29592,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -29067,8 +29639,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -29083,8 +29656,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -29099,7 +29673,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -29116,7 +29691,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -29322,7 +29898,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -29415,7 +29991,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -29608,8 +30184,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -29769,9 +30346,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -29862,8 +30450,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -29905,7 +30493,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -29932,8 +30522,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -29979,8 +30569,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -29995,8 +30586,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -30011,7 +30603,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -30028,7 +30621,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -30234,7 +30828,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -30327,7 +30921,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -30520,8 +31114,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -30681,9 +31276,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -30774,8 +31380,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -30817,7 +31423,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -30844,8 +31452,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -30891,8 +31499,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -30907,8 +31516,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -30923,7 +31533,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -30940,7 +31551,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -31146,7 +31758,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -31239,7 +31851,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -31432,8 +32044,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -31593,9 +32206,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -31686,8 +32310,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -31729,7 +32353,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -31756,8 +32382,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -31803,8 +32429,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -31819,8 +32446,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -31835,7 +32463,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -31852,7 +32481,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -32058,7 +32688,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -32151,7 +32781,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -32344,8 +32974,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -32505,9 +33136,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -32598,8 +33240,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -32641,7 +33283,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -32668,8 +33312,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -32715,8 +33359,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -32731,8 +33376,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -32747,7 +33393,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -32764,7 +33411,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -32970,7 +33618,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -33063,7 +33711,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -33256,8 +33904,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -33417,9 +34066,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -33510,8 +34170,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -33553,7 +34213,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -33580,8 +34242,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -33627,8 +34289,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -33643,8 +34306,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -33659,7 +34323,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -33676,7 +34341,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -33882,7 +34548,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -33975,7 +34641,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -34168,8 +34834,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -34329,9 +34996,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -34422,8 +35100,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -34465,7 +35143,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -34492,8 +35172,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -34539,8 +35219,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -34555,8 +35236,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -34571,7 +35253,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -34588,7 +35271,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -34794,7 +35478,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -34887,7 +35571,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -35080,8 +35764,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -35241,9 +35926,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -35334,8 +36030,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -35377,7 +36073,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -35404,8 +36102,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -35451,8 +36149,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -35467,8 +36166,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -35483,7 +36183,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -35500,7 +36201,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -35706,7 +36408,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -35799,7 +36501,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -35992,8 +36694,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -36153,9 +36856,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -36246,8 +36960,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -36289,7 +37003,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -36316,8 +37032,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -36363,8 +37079,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -36379,8 +37096,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -36395,7 +37113,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -36412,7 +37131,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -36618,7 +37338,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -36711,7 +37431,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -36904,8 +37624,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -37065,9 +37786,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -37158,8 +37890,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -37201,7 +37933,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -37228,8 +37962,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -37275,8 +38009,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -37291,8 +38026,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -37307,7 +38043,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -37324,7 +38061,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -37530,7 +38268,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -37623,7 +38361,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -37816,8 +38554,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -37977,9 +38716,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -38070,8 +38820,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -38113,7 +38863,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -38140,8 +38892,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -38187,8 +38939,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -38203,8 +38956,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -38219,7 +38973,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -38236,7 +38991,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -38442,7 +39198,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -38535,7 +39291,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -38728,8 +39484,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -38889,9 +39646,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -38982,8 +39750,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -39025,7 +39793,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -39052,8 +39822,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -39099,8 +39869,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -39115,8 +39886,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -39131,7 +39903,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -39148,7 +39921,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -39354,7 +40128,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -39447,7 +40221,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -39640,8 +40414,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -39801,9 +40576,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -39894,8 +40680,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -39937,7 +40723,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -39964,8 +40752,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -40011,8 +40799,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -40027,8 +40816,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -40043,7 +40833,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -40060,7 +40851,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -40266,7 +41058,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -40359,7 +41151,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -40552,8 +41344,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -40713,9 +41506,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -40806,8 +41610,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -40849,7 +41653,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -40876,8 +41682,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -40923,8 +41729,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -40939,8 +41746,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -40955,7 +41763,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -40972,7 +41781,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -41178,7 +41988,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -41271,7 +42081,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -41464,8 +42274,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -41625,9 +42436,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -41718,8 +42540,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -41761,7 +42583,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -41788,8 +42612,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -41835,8 +42659,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -41851,8 +42676,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -41867,7 +42693,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -41884,7 +42711,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -42090,7 +42918,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -42183,7 +43011,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -42376,8 +43204,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -42537,9 +43366,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -42630,8 +43470,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -42673,7 +43513,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -42700,8 +43542,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -42747,8 +43589,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -42763,8 +43606,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -42779,7 +43623,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -42796,7 +43641,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -43002,7 +43848,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -43095,7 +43941,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -43288,8 +44134,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -43449,9 +44296,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -43542,8 +44400,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -43585,7 +44443,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -43612,8 +44472,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -43659,8 +44519,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -43675,8 +44536,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -43691,7 +44553,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -43708,7 +44571,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -43914,7 +44778,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -44007,7 +44871,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -44200,8 +45064,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -44361,9 +45226,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -44454,8 +45330,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -44497,7 +45373,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -44524,8 +45402,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -44571,8 +45449,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -44587,8 +45466,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -44603,7 +45483,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -44620,7 +45501,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -44826,7 +45708,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -44919,7 +45801,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -45112,8 +45994,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -45273,9 +46156,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -45366,8 +46260,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -45409,7 +46303,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -45436,8 +46332,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -45483,8 +46379,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -45499,8 +46396,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -45515,7 +46413,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -45532,7 +46431,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -45738,7 +46638,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -45831,7 +46731,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -46024,8 +46924,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -46185,9 +47086,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -46278,8 +47190,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -46321,7 +47233,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -46348,8 +47262,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -46395,8 +47309,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -46411,8 +47326,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -46427,7 +47343,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -46444,7 +47361,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -46650,7 +47568,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -46743,7 +47661,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -46936,8 +47854,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -47097,9 +48016,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -47190,8 +48120,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -47233,7 +48163,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -47260,8 +48192,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -47307,8 +48239,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -47323,8 +48256,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -47339,7 +48273,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -47356,7 +48291,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -47562,7 +48498,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -47655,7 +48591,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -47848,8 +48784,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -48009,9 +48946,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -48102,8 +49050,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -48145,7 +49093,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -48172,8 +49122,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -48219,8 +49169,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -48235,8 +49186,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -48251,7 +49203,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -48268,7 +49221,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -48474,7 +49428,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -48567,7 +49521,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -48760,8 +49714,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -48921,9 +49876,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -49014,8 +49980,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -49057,7 +50023,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -49084,8 +50052,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -49131,8 +50099,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -49147,8 +50116,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -49163,7 +50133,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -49180,7 +50151,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -49386,7 +50358,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -49479,7 +50451,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -49672,8 +50644,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -49833,9 +50806,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -49926,8 +50910,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -49969,7 +50953,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -49996,8 +50982,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -50043,8 +51029,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -50059,8 +51046,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -50075,7 +51063,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -50092,7 +51081,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -50298,7 +51288,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -50391,7 +51381,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -50584,8 +51574,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -50745,9 +51736,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -50838,8 +51840,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -50881,7 +51883,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -50908,8 +51912,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -50955,8 +51959,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -50971,8 +51976,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -50987,7 +51993,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -51004,7 +52011,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -51210,7 +52218,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -51303,7 +52311,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -51496,8 +52504,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -51657,9 +52666,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -51750,8 +52770,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -51793,7 +52813,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -51820,8 +52842,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -51867,8 +52889,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -51883,8 +52906,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -51899,7 +52923,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -51916,7 +52941,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -52122,7 +53148,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -52215,7 +53241,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -52408,8 +53434,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -52569,9 +53596,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -52662,8 +53700,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -52705,7 +53743,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -52732,8 +53772,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -52779,8 +53819,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -52795,8 +53836,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -52811,7 +53853,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -52828,7 +53871,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -53034,7 +54078,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -53127,7 +54171,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -53320,8 +54364,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -53481,9 +54526,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -53574,8 +54630,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -53617,7 +54673,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -53644,8 +54702,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -53691,8 +54749,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -53707,8 +54766,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -53723,7 +54783,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -53740,7 +54801,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -53946,7 +55008,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -54039,7 +55101,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -54232,8 +55294,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -54393,9 +55456,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -54486,8 +55560,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -54529,7 +55603,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -54556,8 +55632,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -54603,8 +55679,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -54619,8 +55696,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -54635,7 +55713,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -54652,7 +55731,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -54858,7 +55938,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -54951,7 +56031,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -55144,8 +56224,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -55305,9 +56386,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -55398,8 +56490,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -55441,7 +56533,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -55468,8 +56562,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -55515,8 +56609,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -55531,8 +56626,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -55547,7 +56643,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -55564,7 +56661,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -55770,7 +56868,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -55863,7 +56961,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -56056,8 +57154,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -56217,9 +57316,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -56310,8 +57420,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -56353,7 +57463,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -56380,8 +57492,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -56427,8 +57539,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -56443,8 +57556,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -56459,7 +57573,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -56476,7 +57591,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -56682,7 +57798,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -56775,7 +57891,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -56968,8 +58084,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -57129,9 +58246,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -57222,8 +58350,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -57265,7 +58393,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -57292,8 +58422,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -57339,8 +58469,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -57355,8 +58486,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -57371,7 +58503,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -57388,7 +58521,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -57594,7 +58728,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -57687,7 +58821,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -57880,8 +59014,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -58041,9 +59176,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -58134,8 +59280,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -58177,7 +59323,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -58204,8 +59352,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -58251,8 +59399,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -58267,8 +59416,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -58283,7 +59433,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -58300,7 +59451,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -58506,7 +59658,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -58599,7 +59751,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -58792,8 +59944,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -58953,9 +60106,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -59046,8 +60210,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -59089,7 +60253,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -59116,8 +60282,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -59163,8 +60329,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -59179,8 +60346,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -59195,7 +60363,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -59212,7 +60381,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -59418,7 +60588,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -59511,7 +60681,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -59704,8 +60874,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -59865,9 +61036,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -59958,8 +61140,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -60001,7 +61183,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -60028,8 +61212,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -60075,8 +61259,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -60091,8 +61276,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -60107,7 +61293,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -60124,7 +61311,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -60330,7 +61518,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -60423,7 +61611,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -60616,8 +61804,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -60777,9 +61966,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -60870,8 +62070,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -60913,7 +62113,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -60940,8 +62142,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -60987,8 +62189,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -61003,8 +62206,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -61019,7 +62223,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -61036,7 +62241,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -61242,7 +62448,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -61335,7 +62541,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -61528,8 +62734,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -61689,9 +62896,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -61782,8 +63000,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -61825,7 +63043,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -61852,8 +63072,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -61899,8 +63119,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -61915,8 +63136,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -61931,7 +63153,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -61948,7 +63171,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -62154,7 +63378,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -62247,7 +63471,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -62440,8 +63664,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -62601,9 +63826,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -62694,8 +63930,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -62737,7 +63973,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -62764,8 +64002,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -62811,8 +64049,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -62827,8 +64066,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -62843,7 +64083,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -62860,7 +64101,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -63066,7 +64308,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -63159,7 +64401,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -63352,8 +64594,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -63513,9 +64756,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -63606,8 +64860,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -63649,7 +64903,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -63676,8 +64932,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -63723,8 +64979,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -63739,8 +64996,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -63755,7 +65013,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -63772,7 +65031,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -63978,7 +65238,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -64071,7 +65331,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -64264,8 +65524,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -64425,9 +65686,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -64518,8 +65790,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -64561,7 +65833,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -64588,8 +65862,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -64635,8 +65909,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -64651,8 +65926,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -64667,7 +65943,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -64684,7 +65961,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -64890,7 +66168,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -64983,7 +66261,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -65176,8 +66454,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -65337,9 +66616,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -65430,8 +66720,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -65473,7 +66763,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -65500,8 +66792,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -65547,8 +66839,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -65563,8 +66856,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -65579,7 +66873,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -65596,7 +66891,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -65802,7 +67098,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -65895,7 +67191,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -66088,8 +67384,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -66249,9 +67546,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -66342,8 +67650,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -66385,7 +67693,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -66412,8 +67722,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -66459,8 +67769,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -66475,8 +67786,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -66491,7 +67803,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -66508,7 +67821,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -66714,7 +68028,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -66807,7 +68121,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -67000,8 +68314,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -67161,9 +68476,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -67254,8 +68580,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -67297,7 +68623,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -67324,8 +68652,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -67371,8 +68699,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -67387,8 +68716,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -67403,7 +68733,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -67420,7 +68751,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -67626,7 +68958,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -67719,7 +69051,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -67912,8 +69244,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -68073,9 +69406,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -68166,8 +69510,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -68209,7 +69553,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -68236,8 +69582,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -68283,8 +69629,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -68299,8 +69646,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -68315,7 +69663,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -68332,7 +69681,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -68538,7 +69888,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -68631,7 +69981,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -68824,8 +70174,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -68985,9 +70336,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -69078,8 +70440,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -69121,7 +70483,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -69148,8 +70512,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -69195,8 +70559,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -69211,8 +70576,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -69227,7 +70593,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -69244,7 +70611,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -69450,7 +70818,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -69543,7 +70911,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -69736,8 +71104,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -69897,9 +71266,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -69990,8 +71370,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -70033,7 +71413,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -70060,8 +71442,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -70107,8 +71489,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -70123,8 +71506,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -70139,7 +71523,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -70156,7 +71541,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -70362,7 +71748,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -70455,7 +71841,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -70648,8 +72034,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -70809,9 +72196,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -70902,8 +72300,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -70945,7 +72343,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -70972,8 +72372,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -71019,8 +72419,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -71035,8 +72436,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -71051,7 +72453,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -71068,7 +72471,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -71274,7 +72678,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -71367,7 +72771,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -71560,8 +72964,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -71721,9 +73126,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -71814,8 +73230,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -71857,7 +73273,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -71884,8 +73302,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -71931,8 +73349,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -71947,8 +73366,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -71963,7 +73383,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -71980,7 +73401,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -72186,7 +73608,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -72279,7 +73701,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -72472,8 +73894,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -72633,9 +74056,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -72726,8 +74160,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -72769,7 +74203,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -72796,8 +74232,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -72843,8 +74279,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -72859,8 +74296,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -72875,7 +74313,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -72892,7 +74331,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -73098,7 +74538,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -73191,7 +74631,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -73384,8 +74824,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -73545,9 +74986,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -73638,8 +75090,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -73681,7 +75133,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -73708,8 +75162,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -73755,8 +75209,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -73771,8 +75226,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -73787,7 +75243,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -73804,7 +75261,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -74010,7 +75468,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -74103,7 +75561,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -74296,8 +75754,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -74457,9 +75916,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -74550,8 +76020,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -74593,7 +76063,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -74620,8 +76092,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -74667,8 +76139,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -74683,8 +76156,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -74699,7 +76173,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -74716,7 +76191,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -74922,7 +76398,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -75015,7 +76491,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -75208,8 +76684,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -75369,9 +76846,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -75462,8 +76950,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -75505,7 +76993,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -75532,8 +77022,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -75579,8 +77069,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -75595,8 +77086,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -75611,7 +77103,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -75628,7 +77121,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -75834,7 +77328,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -75927,7 +77421,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -76120,8 +77614,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -76281,9 +77776,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -76374,8 +77880,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -76417,7 +77923,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -76444,8 +77952,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -76491,8 +77999,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -76507,8 +78016,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -76523,7 +78033,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -76540,7 +78051,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -76746,7 +78258,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -76839,7 +78351,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -77032,8 +78544,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -77193,9 +78706,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -77286,8 +78810,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -77329,7 +78853,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -77356,8 +78882,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -77403,8 +78929,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -77419,8 +78946,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -77435,7 +78963,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -77452,7 +78981,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -77658,7 +79188,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -77751,7 +79281,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -77944,8 +79474,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -78105,9 +79636,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -78198,8 +79740,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -78241,7 +79783,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -78268,8 +79812,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -78315,8 +79859,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -78331,8 +79876,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -78347,7 +79893,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -78364,7 +79911,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -78570,7 +80118,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -78663,7 +80211,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -78856,8 +80404,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -79017,9 +80566,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -79110,8 +80670,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -79153,7 +80713,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -79180,8 +80742,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -79227,8 +80789,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -79243,8 +80806,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -79259,7 +80823,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -79276,7 +80841,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -79482,7 +81048,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -79575,7 +81141,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -79768,8 +81334,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -79929,9 +81496,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -80022,8 +81600,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -80065,7 +81643,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -80092,8 +81672,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -80139,8 +81719,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -80155,8 +81736,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -80171,7 +81753,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -80188,7 +81771,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -80394,7 +81978,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -80487,7 +82071,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -80680,8 +82264,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -80841,9 +82426,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -80934,8 +82530,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -80977,7 +82573,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -81004,8 +82602,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -81051,8 +82649,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -81067,8 +82666,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -81083,7 +82683,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -81100,7 +82701,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -81306,7 +82908,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -81399,7 +83001,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -81592,8 +83194,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -81753,9 +83356,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -81846,8 +83460,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -81889,7 +83503,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -81916,8 +83532,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -81963,8 +83579,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -81979,8 +83596,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -81995,7 +83613,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -82012,7 +83631,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -82218,7 +83838,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -82311,7 +83931,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -82504,8 +84124,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -82665,9 +84286,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -82758,8 +84390,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -82801,7 +84433,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -82828,8 +84462,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -82875,8 +84509,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -82891,8 +84526,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -82907,7 +84543,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -82924,7 +84561,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -83130,7 +84768,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -83223,7 +84861,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -83416,8 +85054,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -83577,9 +85216,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -83670,8 +85320,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -83713,7 +85363,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -83740,8 +85392,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -83787,8 +85439,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -83803,8 +85456,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -83819,7 +85473,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -83836,7 +85491,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -84042,7 +85698,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -84135,7 +85791,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -84328,8 +85984,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -84489,9 +86146,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -84582,8 +86250,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -84625,7 +86293,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -84652,8 +86322,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -84699,8 +86369,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -84715,8 +86386,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -84731,7 +86403,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -84748,7 +86421,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -84954,7 +86628,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -85047,7 +86721,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -85240,8 +86914,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -85401,9 +87076,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -85494,8 +87180,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -85537,7 +87223,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -85564,8 +87252,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -85611,8 +87299,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -85627,8 +87316,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -85643,7 +87333,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -85660,7 +87351,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -85866,7 +87558,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -85959,7 +87651,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -86152,8 +87844,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -86313,9 +88006,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -86406,8 +88110,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -86449,7 +88153,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -86476,8 +88182,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -86523,8 +88229,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -86539,8 +88246,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -86555,7 +88263,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -86572,7 +88281,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -86778,7 +88488,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -86871,7 +88581,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -87064,8 +88774,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -87225,9 +88936,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -87318,8 +89040,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -87361,7 +89083,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -87388,8 +89112,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -87435,8 +89159,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -87451,8 +89176,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -87467,7 +89193,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -87484,7 +89211,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -87690,7 +89418,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -87783,7 +89511,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -87976,8 +89704,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -88137,9 +89866,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -88230,8 +89970,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -88273,7 +90013,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -88300,8 +90042,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -88347,8 +90089,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -88363,8 +90106,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -88379,7 +90123,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -88396,7 +90141,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -88602,7 +90348,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -88695,7 +90441,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -88888,8 +90634,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -89049,9 +90796,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -89142,8 +90900,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -89185,7 +90943,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -89212,8 +90972,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -89259,8 +91019,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -89275,8 +91036,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -89291,7 +91053,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -89308,7 +91071,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -89514,7 +91278,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -89607,7 +91371,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -89800,8 +91564,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -89961,9 +91726,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -90054,8 +91830,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -90097,7 +91873,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -90124,8 +91902,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -90171,8 +91949,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -90187,8 +91966,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -90203,7 +91983,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -90220,7 +92001,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -90426,7 +92208,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -90519,7 +92301,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -90712,8 +92494,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -90873,9 +92656,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -90966,8 +92760,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -91009,7 +92803,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -91036,8 +92832,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -91083,8 +92879,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -91099,8 +92896,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -91115,7 +92913,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -91132,7 +92931,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -91338,7 +93138,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -91431,7 +93231,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -91624,8 +93424,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -91785,9 +93586,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -91878,8 +93690,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -91921,7 +93733,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -91948,8 +93762,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -91995,8 +93809,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -92011,8 +93826,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -92027,7 +93843,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -92044,7 +93861,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -92250,7 +94068,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -92343,7 +94161,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -92536,8 +94354,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -92697,9 +94516,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -92790,8 +94620,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -92833,7 +94663,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -92860,8 +94692,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -92907,8 +94739,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -92923,8 +94756,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -92939,7 +94773,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -92956,7 +94791,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -93162,7 +94998,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -93255,7 +95091,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -93448,8 +95284,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -93609,9 +95446,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -93702,8 +95550,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -93745,7 +95593,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -93772,8 +95622,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -93819,8 +95669,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -93835,8 +95686,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -93851,7 +95703,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -93868,7 +95721,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -94074,7 +95928,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -94167,7 +96021,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -94360,8 +96214,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -94521,9 +96376,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -94614,8 +96480,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -94657,7 +96523,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -94684,8 +96552,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -94731,8 +96599,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -94747,8 +96616,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -94763,7 +96633,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -94780,7 +96651,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -94986,7 +96858,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -95079,7 +96951,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -95272,8 +97144,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -95433,9 +97306,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -95526,8 +97410,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -95569,7 +97453,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -95596,8 +97482,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -95643,8 +97529,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -95659,8 +97546,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -95675,7 +97563,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -95692,7 +97581,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -95898,7 +97788,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -95991,7 +97881,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -96184,8 +98074,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -96345,9 +98236,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -96438,8 +98340,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -96481,7 +98383,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -96508,8 +98412,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -96555,8 +98459,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -96571,8 +98476,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -96587,7 +98493,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -96604,7 +98511,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -96810,7 +98718,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -96903,7 +98811,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -97096,8 +99004,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -97257,9 +99166,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -97350,8 +99270,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -97393,7 +99313,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -97420,8 +99342,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -97467,8 +99389,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -97483,8 +99406,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -97499,7 +99423,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -97516,7 +99441,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -97722,7 +99648,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -97815,7 +99741,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -98008,8 +99934,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -98169,9 +100096,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -98262,8 +100200,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -98305,7 +100243,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -98332,8 +100272,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -98379,8 +100319,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -98395,8 +100336,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -98411,7 +100353,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -98428,7 +100371,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -98634,7 +100578,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -98727,7 +100671,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -98920,8 +100864,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -99081,9 +101026,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -99174,8 +101130,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -99217,7 +101173,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -99244,8 +101202,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -99291,8 +101249,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -99307,8 +101266,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -99323,7 +101283,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -99340,7 +101301,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -99546,7 +101508,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -99639,7 +101601,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -99832,8 +101794,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -99993,9 +101956,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -100086,8 +102060,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -100129,7 +102103,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -100156,8 +102132,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -100203,8 +102179,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -100219,8 +102196,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -100235,7 +102213,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -100252,7 +102231,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -100458,7 +102438,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -100551,7 +102531,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -100744,8 +102724,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -100905,9 +102886,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -100998,8 +102990,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -101041,7 +103033,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -101068,8 +103062,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -101115,8 +103109,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -101131,8 +103126,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -101147,7 +103143,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -101164,7 +103161,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -101370,7 +103368,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -101463,7 +103461,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -101656,8 +103654,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -101817,9 +103816,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -101910,8 +103920,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -101953,7 +103963,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -101980,8 +103992,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -102027,8 +104039,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -102043,8 +104056,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -102059,7 +104073,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -102076,7 +104091,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -102282,7 +104298,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -102375,7 +104391,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -102568,8 +104584,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -102729,9 +104746,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -102822,8 +104850,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -102865,7 +104893,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -102892,8 +104922,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -102939,8 +104969,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -102955,8 +104986,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -102971,7 +105003,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -102988,7 +105021,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -103194,7 +105228,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -103287,7 +105321,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -103480,8 +105514,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -103641,9 +105676,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -103734,8 +105780,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -103777,7 +105823,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -103804,8 +105852,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -103851,8 +105899,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -103867,8 +105916,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -103883,7 +105933,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -103900,7 +105951,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -104106,7 +106158,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -104199,7 +106251,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -104392,8 +106444,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -104553,9 +106606,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -104646,8 +106710,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -104689,7 +106753,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -104716,8 +106782,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -104763,8 +106829,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -104779,8 +106846,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -104795,7 +106863,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -104812,7 +106881,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -105018,7 +107088,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -105111,7 +107181,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -105304,8 +107374,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -105465,9 +107536,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -105558,8 +107640,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -105601,7 +107683,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -105628,8 +107712,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -105675,8 +107759,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -105691,8 +107776,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -105707,7 +107793,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -105724,7 +107811,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -105930,7 +108018,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -106023,7 +108111,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -106216,8 +108304,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -106377,9 +108466,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -106470,8 +108570,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -106513,7 +108613,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -106540,8 +108642,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -106587,8 +108689,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -106603,8 +108706,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -106619,7 +108723,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -106636,7 +108741,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -106842,7 +108948,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -106935,7 +109041,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -107128,8 +109234,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -107289,9 +109396,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -107382,8 +109500,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -107425,7 +109543,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -107452,8 +109572,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -107499,8 +109619,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -107515,8 +109636,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -107531,7 +109653,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -107548,7 +109671,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -107754,7 +109878,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -107847,7 +109971,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -108040,8 +110164,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -108201,9 +110326,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -108294,8 +110430,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -108337,7 +110473,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -108364,8 +110502,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -108411,8 +110549,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -108427,8 +110566,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -108443,7 +110583,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -108460,7 +110601,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -108666,7 +110808,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -108759,7 +110901,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -108952,8 +111094,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -109113,9 +111256,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -109206,8 +111360,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -109249,7 +111403,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -109276,8 +111432,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -109323,8 +111479,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -109339,8 +111496,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -109355,7 +111513,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -109372,7 +111531,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -109578,7 +111738,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -109671,7 +111831,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -109864,8 +112024,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -110025,9 +112186,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -110118,8 +112290,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -110161,7 +112333,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -110188,8 +112362,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -110235,8 +112409,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -110251,8 +112426,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -110267,7 +112443,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -110284,7 +112461,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -110490,7 +112668,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -110583,7 +112761,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -110776,8 +112954,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -110937,9 +113116,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -111030,8 +113220,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -111073,7 +113263,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -111100,8 +113292,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -111147,8 +113339,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -111163,8 +113356,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -111179,7 +113373,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -111196,7 +113391,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -111402,7 +113598,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -111495,7 +113691,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -111688,8 +113884,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -111849,9 +114046,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -111942,8 +114150,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -111985,7 +114193,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -112012,8 +114222,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -112059,8 +114269,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -112075,8 +114286,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -112091,7 +114303,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -112108,7 +114321,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -112314,7 +114528,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -112407,7 +114621,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -112600,8 +114814,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -112761,9 +114976,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -112854,8 +115080,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -112897,7 +115123,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -112924,8 +115152,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -112971,8 +115199,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -112987,8 +115216,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -113003,7 +115233,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -113020,7 +115251,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -113226,7 +115458,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -113319,7 +115551,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -113512,8 +115744,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -113673,9 +115906,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -113766,8 +116010,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -113809,7 +116053,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -113836,8 +116082,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -113883,8 +116129,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -113899,8 +116146,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -113915,7 +116163,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -113932,7 +116181,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -114138,7 +116388,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -114231,7 +116481,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -114424,8 +116674,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -114585,9 +116836,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -114678,8 +116940,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -114721,7 +116983,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -114748,8 +117012,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -114795,8 +117059,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -114811,8 +117076,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -114827,7 +117093,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -114844,7 +117111,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -115050,7 +117318,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -115143,7 +117411,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -115336,8 +117604,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -115497,9 +117766,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -115590,8 +117870,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -115633,7 +117913,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -115660,8 +117942,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -115707,8 +117989,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -115723,8 +118006,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -115739,7 +118023,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -115756,7 +118041,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -115962,7 +118248,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -116055,7 +118341,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -116248,8 +118534,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -116409,9 +118696,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -116502,8 +118800,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -116545,7 +118843,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -116572,8 +118872,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -116619,8 +118919,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -116635,8 +118936,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -116651,7 +118953,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -116668,7 +118971,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -116874,7 +119178,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -116967,7 +119271,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -117160,8 +119464,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -117321,9 +119626,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -117414,8 +119730,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -117457,7 +119773,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -117484,8 +119802,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -117531,8 +119849,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -117547,8 +119866,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -117563,7 +119883,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -117580,7 +119901,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -117786,7 +120108,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -117879,7 +120201,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -118072,8 +120394,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -118233,9 +120556,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -118326,8 +120660,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -118369,7 +120703,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -118396,8 +120732,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -118443,8 +120779,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -118459,8 +120796,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -118475,7 +120813,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -118492,7 +120831,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -118698,7 +121038,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -118791,7 +121131,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -118984,8 +121324,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -119145,9 +121486,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -119238,8 +121590,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -119281,7 +121633,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -119308,8 +121662,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -119355,8 +121709,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -119371,8 +121726,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -119387,7 +121743,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -119404,7 +121761,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -119610,7 +121968,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -119703,7 +122061,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -119896,8 +122254,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -120057,9 +122416,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -120150,8 +122520,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -120193,7 +122563,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -120220,8 +122592,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -120267,8 +122639,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -120283,8 +122656,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -120299,7 +122673,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -120316,7 +122691,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -120522,7 +122898,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -120615,7 +122991,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -120808,8 +123184,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -120969,9 +123346,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -121062,8 +123450,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -121105,7 +123493,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -121132,8 +123522,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -121179,8 +123569,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -121195,8 +123586,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -121211,7 +123603,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -121228,7 +123621,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -121434,7 +123828,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -121527,7 +123921,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -121720,8 +124114,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -121881,9 +124276,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -121974,8 +124380,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -122017,7 +124423,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -122044,8 +124452,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -122091,8 +124499,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -122107,8 +124516,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -122123,7 +124533,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -122140,7 +124551,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -122346,7 +124758,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -122439,7 +124851,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -122632,8 +125044,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -122793,9 +125206,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -122886,8 +125310,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -122929,7 +125353,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -122956,8 +125382,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -123003,8 +125429,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -123019,8 +125446,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -123035,7 +125463,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -123052,7 +125481,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -123258,7 +125688,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -123351,7 +125781,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -123544,8 +125974,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -123705,9 +126136,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -123798,8 +126240,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -123841,7 +126283,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -123868,8 +126312,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -123915,8 +126359,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -123931,8 +126376,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -123947,7 +126393,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -123964,7 +126411,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -124170,7 +126618,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -124263,7 +126711,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -124456,8 +126904,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -124617,9 +127066,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -124710,8 +127170,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -124753,7 +127213,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -124780,8 +127242,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -124827,8 +127289,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -124843,8 +127306,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -124859,7 +127323,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -124876,7 +127341,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -125082,7 +127548,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -125175,7 +127641,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -125368,8 +127834,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -125529,9 +127996,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -125622,8 +128100,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -125665,7 +128143,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -125692,8 +128172,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -125739,8 +128219,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -125755,8 +128236,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -125771,7 +128253,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -125788,7 +128271,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -125994,7 +128478,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -126087,7 +128571,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -126280,8 +128764,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -126441,9 +128926,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -126534,8 +129030,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -126577,7 +129073,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -126604,8 +129102,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -126651,8 +129149,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -126667,8 +129166,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -126683,7 +129183,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -126700,7 +129201,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -126906,7 +129408,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -126999,7 +129501,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -127192,8 +129694,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -127353,9 +129856,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -127446,8 +129960,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -127489,7 +130003,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -127516,8 +130032,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -127563,8 +130079,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -127579,8 +130096,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -127595,7 +130113,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -127612,7 +130131,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -127818,7 +130338,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -127911,7 +130431,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -128104,8 +130624,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -128265,9 +130786,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -128358,8 +130890,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -128401,7 +130933,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -128428,8 +130962,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -128475,8 +131009,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -128491,8 +131026,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -128507,7 +131043,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -128524,7 +131061,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -128730,7 +131268,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -128823,7 +131361,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -129016,8 +131554,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -129177,9 +131716,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -129270,8 +131820,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -129313,7 +131863,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -129340,8 +131892,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -129387,8 +131939,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -129403,8 +131956,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -129419,7 +131973,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -129436,7 +131991,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -129642,7 +132198,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -129735,7 +132291,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -129928,8 +132484,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -130089,9 +132646,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -130182,8 +132750,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -130225,7 +132793,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -130252,8 +132822,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -130299,8 +132869,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -130315,8 +132886,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -130331,7 +132903,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -130348,7 +132921,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -130554,7 +133128,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -130647,7 +133221,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -130840,8 +133414,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -131001,9 +133576,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -131094,8 +133680,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -131137,7 +133723,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -131164,8 +133752,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -131211,8 +133799,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -131227,8 +133816,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -131243,7 +133833,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -131260,7 +133851,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -131466,7 +134058,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -131559,7 +134151,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -131752,8 +134344,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -131913,9 +134506,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -132006,8 +134610,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -132049,7 +134653,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -132076,8 +134682,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -132123,8 +134729,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -132139,8 +134746,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -132155,7 +134763,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -132172,7 +134781,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -132378,7 +134988,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -132471,7 +135081,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -132664,8 +135274,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -132825,9 +135436,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -132918,8 +135540,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -132961,7 +135583,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -132988,8 +135612,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -133035,8 +135659,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -133051,8 +135676,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -133067,7 +135693,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -133084,7 +135711,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -133290,7 +135918,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -133383,7 +136011,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -133576,8 +136204,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -133737,9 +136366,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -133830,8 +136470,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -133873,7 +136513,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -133900,8 +136542,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -133947,8 +136589,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -133963,8 +136606,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -133979,7 +136623,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -133996,7 +136641,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -134202,7 +136848,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -134295,7 +136941,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -134488,8 +137134,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -134649,9 +137296,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -134742,8 +137400,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -134785,7 +137443,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -134812,8 +137472,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -134859,8 +137519,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -134875,8 +137536,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -134891,7 +137553,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -134908,7 +137571,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -135114,7 +137778,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -135207,7 +137871,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -135400,8 +138064,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -135561,9 +138226,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -135654,8 +138330,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -135697,7 +138373,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -135724,8 +138402,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -135771,8 +138449,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -135787,8 +138466,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -135803,7 +138483,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -135820,7 +138501,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -136026,7 +138708,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -136119,7 +138801,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -136312,8 +138994,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -136473,9 +139156,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -136566,8 +139260,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -136609,7 +139303,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -136636,8 +139332,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -136683,8 +139379,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -136699,8 +139396,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -136715,7 +139413,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -136732,7 +139431,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -136938,7 +139638,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -137031,7 +139731,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -137224,8 +139924,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -137385,9 +140086,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -137478,8 +140190,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -137521,7 +140233,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -137548,8 +140262,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -137595,8 +140309,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -137611,8 +140326,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -137627,7 +140343,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -137644,7 +140361,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -137850,7 +140568,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -137943,7 +140661,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -138136,8 +140854,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -138297,9 +141016,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -138390,8 +141120,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -138433,7 +141163,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -138460,8 +141192,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -138507,8 +141239,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -138523,8 +141256,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -138539,7 +141273,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -138556,7 +141291,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -138762,7 +141498,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -138855,7 +141591,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -139048,8 +141784,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -139209,9 +141946,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -139302,8 +142050,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -139345,7 +142093,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -139372,8 +142122,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -139419,8 +142169,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -139435,8 +142186,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -139451,7 +142203,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -139468,7 +142221,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -139674,7 +142428,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -139767,7 +142521,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -139960,8 +142714,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -140121,9 +142876,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -140214,8 +142980,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -140257,7 +143023,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -140284,8 +143052,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -140331,8 +143099,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -140347,8 +143116,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -140363,7 +143133,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -140380,7 +143151,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -140586,7 +143358,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -140679,7 +143451,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -140872,8 +143644,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -141033,9 +143806,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -141126,8 +143910,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -141169,7 +143953,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -141196,8 +143982,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -141243,8 +144029,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -141259,8 +144046,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -141275,7 +144063,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -141292,7 +144081,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -141498,7 +144288,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -141591,7 +144381,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -141784,8 +144574,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -141945,9 +144736,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -142038,8 +144840,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -142081,7 +144883,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -142108,8 +144912,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -142155,8 +144959,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -142171,8 +144976,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -142187,7 +144993,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -142204,7 +145011,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -142410,7 +145218,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -142503,7 +145311,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -142696,8 +145504,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -142857,9 +145666,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -142950,8 +145770,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -142993,7 +145813,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -143020,8 +145842,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -143067,8 +145889,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -143083,8 +145906,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -143099,7 +145923,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -143116,7 +145941,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -143322,7 +146148,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -143415,7 +146241,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -143608,8 +146434,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -143769,9 +146596,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -143862,8 +146700,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -143905,7 +146743,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -143932,8 +146772,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -143979,8 +146819,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -143995,8 +146836,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -144011,7 +146853,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -144028,7 +146871,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -144234,7 +147078,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -144327,7 +147171,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -144520,8 +147364,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -144681,9 +147526,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -144774,8 +147630,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -144817,7 +147673,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -144844,8 +147702,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -144891,8 +147749,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -144907,8 +147766,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -144923,7 +147783,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -144940,7 +147801,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -145146,7 +148008,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -145239,7 +148101,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -145432,8 +148294,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -145593,9 +148456,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -145686,8 +148560,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -145729,7 +148603,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -145756,8 +148632,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -145803,8 +148679,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -145819,8 +148696,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -145835,7 +148713,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -145852,7 +148731,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -146058,7 +148938,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -146151,7 +149031,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -146344,8 +149224,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -146505,9 +149386,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -146598,8 +149490,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -146641,7 +149533,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -146668,8 +149562,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -146715,8 +149609,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -146731,8 +149626,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -146747,7 +149643,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -146764,7 +149661,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -146970,7 +149868,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -147063,7 +149961,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -147256,8 +150154,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -147417,9 +150316,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -147510,8 +150420,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -147553,7 +150463,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -147580,8 +150492,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -147627,8 +150539,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -147643,8 +150556,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -147659,7 +150573,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -147676,7 +150591,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -147882,7 +150798,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -147975,7 +150891,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -148168,8 +151084,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -148329,9 +151246,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -148422,8 +151350,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -148465,7 +151393,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -148492,8 +151422,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -148539,8 +151469,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -148555,8 +151486,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -148571,7 +151503,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -148588,7 +151521,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -148794,7 +151728,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -148887,7 +151821,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -149080,8 +152014,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -149241,9 +152176,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -149334,8 +152280,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -149377,7 +152323,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -149404,8 +152352,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -149451,8 +152399,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -149467,8 +152416,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -149483,7 +152433,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -149500,7 +152451,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -149706,7 +152658,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -149799,7 +152751,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -149992,8 +152944,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -150153,9 +153106,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -150246,8 +153210,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -150289,7 +153253,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -150316,8 +153282,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -150363,8 +153329,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -150379,8 +153346,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -150395,7 +153363,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -150412,7 +153381,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -150618,7 +153588,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -150711,7 +153681,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -150904,8 +153874,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -151065,9 +154036,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -151158,8 +154140,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -151201,7 +154183,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -151228,8 +154212,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -151275,8 +154259,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -151291,8 +154276,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -151307,7 +154293,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -151324,7 +154311,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -151530,7 +154518,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -151623,7 +154611,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -151816,8 +154804,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -151977,9 +154966,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -152070,8 +155070,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -152113,7 +155113,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -152140,8 +155142,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -152187,8 +155189,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -152203,8 +155206,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -152219,7 +155223,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -152236,7 +155241,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -152442,7 +155448,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -152535,7 +155541,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -152728,8 +155734,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -152889,9 +155896,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -152982,8 +156000,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -153025,7 +156043,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -153052,8 +156072,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -153099,8 +156119,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -153115,8 +156136,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -153131,7 +156153,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -153148,7 +156171,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -153354,7 +156378,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -153447,7 +156471,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -153640,8 +156664,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -153801,9 +156826,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -153894,8 +156930,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -153937,7 +156973,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -153964,8 +157002,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -154011,8 +157049,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -154027,8 +157066,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -154043,7 +157083,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -154060,7 +157101,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -154266,7 +157308,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -154359,7 +157401,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -154552,8 +157594,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -154713,9 +157756,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -154806,8 +157860,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -154849,7 +157903,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -154876,8 +157932,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -154923,8 +157979,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -154939,8 +157996,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -154955,7 +158013,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -154972,7 +158031,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -155178,7 +158238,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -155271,7 +158331,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -155464,8 +158524,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -155625,9 +158686,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -155718,8 +158790,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -155761,7 +158833,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -155788,8 +158862,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -155835,8 +158909,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -155851,8 +158926,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -155867,7 +158943,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -155884,7 +158961,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -156090,7 +159168,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -156183,7 +159261,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -156376,8 +159454,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -156537,9 +159616,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -156630,8 +159720,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -156673,7 +159763,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -156700,8 +159792,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -156747,8 +159839,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -156763,8 +159856,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -156779,7 +159873,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -156796,7 +159891,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -157002,7 +160098,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -157095,7 +160191,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -157288,8 +160384,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -157449,9 +160546,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -157542,8 +160650,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -157585,7 +160693,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -157612,8 +160722,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -157659,8 +160769,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -157675,8 +160786,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -157691,7 +160803,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -157708,7 +160821,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -157914,7 +161028,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -158007,7 +161121,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -158200,8 +161314,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -158361,9 +161476,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -158454,8 +161580,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -158497,7 +161623,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -158524,8 +161652,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -158571,8 +161699,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -158587,8 +161716,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -158603,7 +161733,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -158620,7 +161751,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -158826,7 +161958,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -158919,7 +162051,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -159112,8 +162244,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -159273,9 +162406,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -159366,8 +162510,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -159409,7 +162553,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -159436,8 +162582,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -159483,8 +162629,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -159499,8 +162646,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -159515,7 +162663,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -159532,7 +162681,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -159738,7 +162888,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -159831,7 +162981,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -160024,8 +163174,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -160185,9 +163336,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -160278,8 +163440,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -160321,7 +163483,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -160348,8 +163512,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -160395,8 +163559,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -160411,8 +163576,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -160427,7 +163593,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -160444,7 +163611,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -160650,7 +163818,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -160743,7 +163911,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -160936,8 +164104,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -161097,9 +164266,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -161190,8 +164370,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -161233,7 +164413,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -161260,8 +164442,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -161307,8 +164489,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -161323,8 +164506,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -161339,7 +164523,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -161356,7 +164541,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -161562,7 +164748,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -161655,7 +164841,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -161848,8 +165034,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -162009,9 +165196,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -162102,8 +165300,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -162145,7 +165343,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -162172,8 +165372,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -162219,8 +165419,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -162235,8 +165436,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -162251,7 +165453,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -162268,7 +165471,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -162474,7 +165678,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -162567,7 +165771,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -162760,8 +165964,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -162921,9 +166126,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -163014,8 +166230,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -163057,7 +166273,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -163084,8 +166302,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -163131,8 +166349,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -163147,8 +166366,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -163163,7 +166383,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -163180,7 +166401,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -163386,7 +166608,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -163479,7 +166701,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -163672,8 +166894,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -163833,9 +167056,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -163926,8 +167160,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -163969,7 +167203,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -163996,8 +167232,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -164043,8 +167279,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -164059,8 +167296,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -164075,7 +167313,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -164092,7 +167331,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -164298,7 +167538,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -164391,7 +167631,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -164584,8 +167824,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -164745,9 +167986,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -164838,8 +168090,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -164881,7 +168133,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -164908,8 +168162,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -164955,8 +168209,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -164971,8 +168226,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -164987,7 +168243,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -165004,7 +168261,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -165210,7 +168468,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -165303,7 +168561,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -165496,8 +168754,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -165657,9 +168916,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -165750,8 +169020,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -165793,7 +169063,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -165820,8 +169092,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -165867,8 +169139,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -165883,8 +169156,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -165899,7 +169173,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -165916,7 +169191,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -166122,7 +169398,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -166215,7 +169491,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -166408,8 +169684,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -166569,9 +169846,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -166662,8 +169950,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -166705,7 +169993,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -166732,8 +170022,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -166779,8 +170069,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -166795,8 +170086,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -166811,7 +170103,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -166828,7 +170121,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -167034,7 +170328,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -167127,7 +170421,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -167320,8 +170614,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -167481,9 +170776,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -167574,8 +170880,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -167617,7 +170923,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -167644,8 +170952,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -167691,8 +170999,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -167707,8 +171016,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -167723,7 +171033,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -167740,7 +171051,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -167946,7 +171258,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -168039,7 +171351,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -168232,8 +171544,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -168393,9 +171706,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -168486,8 +171810,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -168529,7 +171853,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -168556,8 +171882,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -168603,8 +171929,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -168619,8 +171946,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -168635,7 +171963,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -168652,7 +171981,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -168858,7 +172188,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -168951,7 +172281,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -169144,8 +172474,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -169305,9 +172636,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -169398,8 +172740,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -169441,7 +172783,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -169468,8 +172812,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -169515,8 +172859,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -169531,8 +172876,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -169547,7 +172893,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -169564,7 +172911,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -169770,7 +173118,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -169863,7 +173211,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -170056,8 +173404,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -170217,9 +173566,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -170310,8 +173670,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -170353,7 +173713,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -170380,8 +173742,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -170427,8 +173789,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -170443,8 +173806,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -170459,7 +173823,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -170476,7 +173841,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -170682,7 +174048,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -170775,7 +174141,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -170968,8 +174334,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -171129,9 +174496,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -171222,8 +174600,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -171265,7 +174643,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -171292,8 +174672,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -171339,8 +174719,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -171355,8 +174736,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -171371,7 +174753,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -171388,7 +174771,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -171594,7 +174978,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -171687,7 +175071,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -171880,8 +175264,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -172041,9 +175426,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -172134,8 +175530,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -172177,7 +175573,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -172204,8 +175602,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -172251,8 +175649,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -172267,8 +175666,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -172283,7 +175683,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -172300,7 +175701,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -172506,7 +175908,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -172599,7 +176001,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -172792,8 +176194,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -172953,9 +176356,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -173046,8 +176460,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -173089,7 +176503,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -173116,8 +176532,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -173163,8 +176579,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -173179,8 +176596,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -173195,7 +176613,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -173212,7 +176631,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -173418,7 +176838,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -173511,7 +176931,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -173704,8 +177124,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -173865,9 +177286,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -173958,8 +177390,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -174001,7 +177433,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -174028,8 +177462,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -174075,8 +177509,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -174091,8 +177526,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -174107,7 +177543,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -174124,7 +177561,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -174330,7 +177768,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -174423,7 +177861,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -174616,8 +178054,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -174777,9 +178216,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -174870,8 +178320,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -174913,7 +178363,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -174940,8 +178392,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -174987,8 +178439,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -175003,8 +178456,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -175019,7 +178473,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -175036,7 +178491,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -175242,7 +178698,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -175335,7 +178791,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -175528,8 +178984,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -175689,9 +179146,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -175782,8 +179250,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -175825,7 +179293,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -175852,8 +179322,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -175899,8 +179369,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -175915,8 +179386,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -175931,7 +179403,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -175948,7 +179421,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -176154,7 +179628,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -176247,7 +179721,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -176440,8 +179914,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -176601,9 +180076,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -176694,8 +180180,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -176737,7 +180223,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -176764,8 +180252,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -176811,8 +180299,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -176827,8 +180316,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -176843,7 +180333,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -176860,7 +180351,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -177066,7 +180558,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -177159,7 +180651,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -177352,8 +180844,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -177513,9 +181006,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -177606,8 +181110,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -177649,7 +181153,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -177676,8 +181182,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -177723,8 +181229,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -177739,8 +181246,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -177755,7 +181263,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -177772,7 +181281,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -177978,7 +181488,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -178071,7 +181581,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -178264,8 +181774,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -178425,9 +181936,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -178518,8 +182040,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -178561,7 +182083,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -178588,8 +182112,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -178635,8 +182159,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -178651,8 +182176,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -178667,7 +182193,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -178684,7 +182211,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -178890,7 +182418,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -178983,7 +182511,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -179176,8 +182704,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -179337,9 +182866,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -179430,8 +182970,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -179473,7 +183013,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -179500,8 +183042,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -179547,8 +183089,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -179563,8 +183106,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -179579,7 +183123,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -179596,7 +183141,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -179802,7 +183348,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -179895,7 +183441,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -180088,8 +183634,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -180249,9 +183796,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -180342,8 +183900,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -180385,7 +183943,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -180412,8 +183972,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -180459,8 +184019,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -180475,8 +184036,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -180491,7 +184053,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -180508,7 +184071,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -180714,7 +184278,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -180807,7 +184371,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -181000,8 +184564,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -181161,9 +184726,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -181254,8 +184830,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -181297,7 +184873,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -181324,8 +184902,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -181371,8 +184949,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -181387,8 +184966,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -181403,7 +184983,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -181420,7 +185001,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -181626,7 +185208,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -181719,7 +185301,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -181912,8 +185494,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -182073,9 +185656,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -182166,8 +185760,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -182209,7 +185803,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -182236,8 +185832,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -182283,8 +185879,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -182299,8 +185896,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -182315,7 +185913,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -182332,7 +185931,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -182538,7 +186138,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -182631,7 +186231,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -182824,8 +186424,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -182985,9 +186586,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -183078,8 +186690,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -183121,7 +186733,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -183148,8 +186762,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -183195,8 +186809,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -183211,8 +186826,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -183227,7 +186843,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -183244,7 +186861,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -183450,7 +187068,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -183543,7 +187161,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -183736,8 +187354,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -183897,9 +187516,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -183990,8 +187620,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -184033,7 +187663,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -184060,8 +187692,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -184107,8 +187739,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -184123,8 +187756,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -184139,7 +187773,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -184156,7 +187791,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -184362,7 +187998,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -184455,7 +188091,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -184648,8 +188284,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -184809,9 +188446,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -184902,8 +188550,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -184945,7 +188593,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -184972,8 +188622,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -185019,8 +188669,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -185035,8 +188686,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -185051,7 +188703,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -185068,7 +188721,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -185274,7 +188928,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -185367,7 +189021,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -185560,8 +189214,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -185721,9 +189376,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -185814,8 +189480,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -185857,7 +189523,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -185884,8 +189552,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -185931,8 +189599,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -185947,8 +189616,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -185963,7 +189633,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -185980,7 +189651,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -186186,7 +189858,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -186279,7 +189951,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -186472,8 +190144,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -186633,9 +190306,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -186726,8 +190410,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -186769,7 +190453,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -186796,8 +190482,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -186843,8 +190529,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -186859,8 +190546,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -186875,7 +190563,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -186892,7 +190581,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -187098,7 +190788,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -187191,7 +190881,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -187384,8 +191074,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -187545,9 +191236,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -187638,8 +191340,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -187681,7 +191383,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -187708,8 +191412,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -187755,8 +191459,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -187771,8 +191476,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -187787,7 +191493,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -187804,7 +191511,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -188010,7 +191718,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -188103,7 +191811,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -188296,8 +192004,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -188457,9 +192166,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -188550,8 +192270,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -188593,7 +192313,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -188620,8 +192342,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -188667,8 +192389,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -188683,8 +192406,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -188699,7 +192423,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -188716,7 +192441,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -188922,7 +192648,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -189015,7 +192741,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -189208,8 +192934,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -189369,9 +193096,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -189462,8 +193200,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -189505,7 +193243,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -189532,8 +193272,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -189579,8 +193319,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -189595,8 +193336,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -189611,7 +193353,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -189628,7 +193371,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -189834,7 +193578,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -189927,7 +193671,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -190120,8 +193864,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -190281,9 +194026,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -190374,8 +194130,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -190417,7 +194173,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -190444,8 +194202,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -190491,8 +194249,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -190507,8 +194266,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -190523,7 +194283,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -190540,7 +194301,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -190746,7 +194508,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -190839,7 +194601,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -191032,8 +194794,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -191193,9 +194956,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -191286,8 +195060,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -191329,7 +195103,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -191356,8 +195132,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -191403,8 +195179,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -191419,8 +195196,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -191435,7 +195213,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -191452,7 +195231,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -191658,7 +195438,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -191751,7 +195531,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -191944,8 +195724,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -192105,9 +195886,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -192198,8 +195990,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -192241,7 +196033,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -192268,8 +196062,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -192315,8 +196109,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -192331,8 +196126,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -192347,7 +196143,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -192364,7 +196161,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -192570,7 +196368,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -192663,7 +196461,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -192856,8 +196654,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -193017,9 +196816,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -193110,8 +196920,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -193153,7 +196963,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -193180,8 +196992,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -193227,8 +197039,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -193243,8 +197056,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -193259,7 +197073,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -193276,7 +197091,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -193482,7 +197298,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -193575,7 +197391,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -193768,8 +197584,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -193929,9 +197746,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -194022,8 +197850,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -194065,7 +197893,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -194092,8 +197922,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -194139,8 +197969,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -194155,8 +197986,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -194171,7 +198003,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -194188,7 +198021,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -194394,7 +198228,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -194487,7 +198321,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -194680,8 +198514,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -194841,9 +198676,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -194934,8 +198780,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -194977,7 +198823,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -195004,8 +198852,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -195051,8 +198899,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -195067,8 +198916,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -195083,7 +198933,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -195100,7 +198951,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -195306,7 +199158,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -195399,7 +199251,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -195592,8 +199444,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -195753,9 +199606,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -195846,8 +199710,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -195889,7 +199753,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -195916,8 +199782,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -195963,8 +199829,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -195979,8 +199846,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -195995,7 +199863,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -196012,7 +199881,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -196218,7 +200088,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -196311,7 +200181,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -196504,8 +200374,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -196665,9 +200536,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -196758,8 +200640,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -196801,7 +200683,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -196828,8 +200712,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -196875,8 +200759,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -196891,8 +200776,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -196907,7 +200793,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -196924,7 +200811,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -197130,7 +201018,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -197223,7 +201111,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -197416,8 +201304,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -197577,9 +201466,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -197670,8 +201570,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -197713,7 +201613,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -197740,8 +201642,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -197787,8 +201689,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -197803,8 +201706,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -197819,7 +201723,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -197836,7 +201741,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -198042,7 +201948,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -198135,7 +202041,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -198328,8 +202234,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -198489,9 +202396,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -198582,8 +202500,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -198625,7 +202543,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -198652,8 +202572,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -198699,8 +202619,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -198715,8 +202636,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -198731,7 +202653,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -198748,7 +202671,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -198954,7 +202878,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -199047,7 +202971,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -199240,8 +203164,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -199401,9 +203326,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -199494,8 +203430,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -199537,7 +203473,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -199564,8 +203502,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -199611,8 +203549,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -199627,8 +203566,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -199643,7 +203583,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -199660,7 +203601,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -199866,7 +203808,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -199959,7 +203901,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -200152,8 +204094,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -200313,9 +204256,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -200406,8 +204360,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -200449,7 +204403,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -200476,8 +204432,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -200523,8 +204479,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -200539,8 +204496,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -200555,7 +204513,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -200572,7 +204531,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -200778,7 +204738,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -200871,7 +204831,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -201064,8 +205024,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -201225,9 +205186,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -201318,8 +205290,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -201361,7 +205333,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -201388,8 +205362,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -201435,8 +205409,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -201451,8 +205426,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -201467,7 +205443,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -201484,7 +205461,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -201690,7 +205668,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -201783,7 +205761,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -201976,8 +205954,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -202137,9 +206116,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -202230,8 +206220,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -202273,7 +206263,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -202300,8 +206292,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -202347,8 +206339,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -202363,8 +206356,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -202379,7 +206373,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -202396,7 +206391,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -202602,7 +206598,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -202695,7 +206691,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -202888,8 +206884,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -203049,9 +207046,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -203142,8 +207150,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -203185,7 +207193,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -203212,8 +207222,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -203259,8 +207269,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -203275,8 +207286,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -203291,7 +207303,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -203308,7 +207321,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -203514,7 +207528,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -203607,7 +207621,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -203800,8 +207814,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -203961,9 +207976,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -204054,8 +208080,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -204097,7 +208123,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -204124,8 +208152,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -204171,8 +208199,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -204187,8 +208216,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -204203,7 +208233,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -204220,7 +208251,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -204426,7 +208458,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -204519,7 +208551,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -204712,8 +208744,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -204873,9 +208906,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -204966,8 +209010,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -205009,7 +209053,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -205036,8 +209082,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -205083,8 +209129,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -205099,8 +209146,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -205115,7 +209163,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -205132,7 +209181,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -205338,7 +209388,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -205431,7 +209481,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -205624,8 +209674,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -205785,9 +209836,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -205878,8 +209940,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -205921,7 +209983,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -205948,8 +210012,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -205995,8 +210059,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -206011,8 +210076,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -206027,7 +210093,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -206044,7 +210111,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -206250,7 +210318,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -206343,7 +210411,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -206536,8 +210604,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -206697,9 +210766,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -206790,8 +210870,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -206833,7 +210913,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -206860,8 +210942,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -206907,8 +210989,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -206923,8 +211006,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -206939,7 +211023,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -206956,7 +211041,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -207162,7 +211248,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -207255,7 +211341,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -207448,8 +211534,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -207609,9 +211696,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -207702,8 +211800,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -207745,7 +211843,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -207772,8 +211872,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -207819,8 +211919,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -207835,8 +211936,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -207851,7 +211953,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -207868,7 +211971,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -208074,7 +212178,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -208167,7 +212271,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -208360,8 +212464,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -208521,9 +212626,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -208614,8 +212730,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -208657,7 +212773,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -208684,8 +212802,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -208731,8 +212849,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -208747,8 +212866,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -208763,7 +212883,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -208780,7 +212901,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -208986,7 +213108,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -209079,7 +213201,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -209272,8 +213394,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -209433,9 +213556,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -209526,8 +213660,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -209569,7 +213703,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -209596,8 +213732,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -209643,8 +213779,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -209659,8 +213796,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -209675,7 +213813,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -209692,7 +213831,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -209898,7 +214038,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -209991,7 +214131,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -210184,8 +214324,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -210345,9 +214486,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -210438,8 +214590,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -210481,7 +214633,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -210508,8 +214662,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -210555,8 +214709,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -210571,8 +214726,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -210587,7 +214743,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -210604,7 +214761,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -210810,7 +214968,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -210903,7 +215061,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -211096,8 +215254,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -211257,9 +215416,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -211350,8 +215520,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -211393,7 +215563,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -211420,8 +215592,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -211467,8 +215639,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -211483,8 +215656,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -211499,7 +215673,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -211516,7 +215691,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -211722,7 +215898,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -211815,7 +215991,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -212008,8 +216184,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -212169,9 +216346,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -212262,8 +216450,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -212305,7 +216493,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -212332,8 +216522,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -212379,8 +216569,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -212395,8 +216586,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -212411,7 +216603,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -212428,7 +216621,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -212634,7 +216828,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -212727,7 +216921,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -212920,8 +217114,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -213081,9 +217276,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -213174,8 +217380,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -213217,7 +217423,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -213244,8 +217452,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -213291,8 +217499,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -213307,8 +217516,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -213323,7 +217533,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -213340,7 +217551,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -213546,7 +217758,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -213639,7 +217851,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -213832,8 +218044,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -213993,9 +218206,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -214086,8 +218310,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -214129,7 +218353,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -214156,8 +218382,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -214203,8 +218429,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -214219,8 +218446,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -214235,7 +218463,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -214252,7 +218481,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -214458,7 +218688,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -214551,7 +218781,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -214744,8 +218974,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -214905,9 +219136,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -214998,8 +219240,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -215041,7 +219283,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -215068,8 +219312,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -215115,8 +219359,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -215131,8 +219376,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -215147,7 +219393,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -215164,7 +219411,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -215370,7 +219618,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -215463,7 +219711,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -215656,8 +219904,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -215817,9 +220066,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -215910,8 +220170,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -215953,7 +220213,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -215980,8 +220242,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -216027,8 +220289,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -216043,8 +220306,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -216059,7 +220323,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -216076,7 +220341,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -216282,7 +220548,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -216375,7 +220641,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -216568,8 +220834,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -216729,9 +220996,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -216822,8 +221100,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -216865,7 +221143,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -216892,8 +221172,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -216939,8 +221219,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -216955,8 +221236,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -216971,7 +221253,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -216988,7 +221271,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -217194,7 +221478,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -217287,7 +221571,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -217480,8 +221764,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -217641,9 +221926,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -217734,8 +222030,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -217777,7 +222073,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -217804,8 +222102,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -217851,8 +222149,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -217867,8 +222166,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -217883,7 +222183,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -217900,7 +222201,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -218106,7 +222408,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -218199,7 +222501,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -218392,8 +222694,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -218553,9 +222856,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -218646,8 +222960,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -218689,7 +223003,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -218716,8 +223032,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -218763,8 +223079,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -218779,8 +223096,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -218795,7 +223113,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -218812,7 +223131,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -219018,7 +223338,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -219111,7 +223431,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -219304,8 +223624,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -219465,9 +223786,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -219558,8 +223890,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -219601,7 +223933,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -219628,8 +223962,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -219675,8 +224009,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -219691,8 +224026,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -219707,7 +224043,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -219724,7 +224061,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -219930,7 +224268,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -220023,7 +224361,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -220216,8 +224554,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -220377,9 +224716,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -220470,8 +224820,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -220513,7 +224863,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -220540,8 +224892,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -220587,8 +224939,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -220603,8 +224956,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -220619,7 +224973,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -220636,7 +224991,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -220842,7 +225198,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -220935,7 +225291,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -221128,8 +225484,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -221289,9 +225646,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -221382,8 +225750,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -221425,7 +225793,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -221452,8 +225822,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -221499,8 +225869,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -221515,8 +225886,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -221531,7 +225903,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -221548,7 +225921,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -221754,7 +226128,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -221847,7 +226221,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -222040,8 +226414,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -222201,9 +226576,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -222294,8 +226680,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -222337,7 +226723,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -222364,8 +226752,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -222411,8 +226799,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -222427,8 +226816,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -222443,7 +226833,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -222460,7 +226851,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -222666,7 +227058,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -222759,7 +227151,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -222952,8 +227344,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -223113,9 +227506,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -223206,8 +227610,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -223249,7 +227653,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -223276,8 +227682,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -223323,8 +227729,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -223339,8 +227746,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -223355,7 +227763,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -223372,7 +227781,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -223578,7 +227988,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -223671,7 +228081,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -223864,8 +228274,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -224025,9 +228436,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -224118,8 +228540,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -224161,7 +228583,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -224188,8 +228612,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -224235,8 +228659,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -224251,8 +228676,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -224267,7 +228693,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -224284,7 +228711,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -224490,7 +228918,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -224583,7 +229011,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -224776,8 +229204,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -224937,9 +229366,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -225030,8 +229470,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -225073,7 +229513,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -225100,8 +229542,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -225147,8 +229589,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -225163,8 +229606,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -225179,7 +229623,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -225196,7 +229641,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -225402,7 +229848,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -225495,7 +229941,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -225688,8 +230134,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -225849,9 +230296,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -225942,8 +230400,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -225985,7 +230443,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -226012,8 +230472,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -226059,8 +230519,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -226075,8 +230536,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -226091,7 +230553,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -226108,7 +230571,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -226314,7 +230778,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -226407,7 +230871,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -226600,8 +231064,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -226761,9 +231226,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -226854,8 +231330,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -226897,7 +231373,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -226924,8 +231402,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -226971,8 +231449,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -226987,8 +231466,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -227003,7 +231483,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -227020,7 +231501,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -227226,7 +231708,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -227319,7 +231801,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -227512,8 +231994,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -227673,9 +232156,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -227766,8 +232260,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -227809,7 +232303,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -227836,8 +232332,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -227883,8 +232379,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -227899,8 +232396,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -227915,7 +232413,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -227932,7 +232431,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -228138,7 +232638,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -228231,7 +232731,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -228424,8 +232924,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -228585,9 +233086,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -228678,8 +233190,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -228721,7 +233233,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -228748,8 +233262,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -228795,8 +233309,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -228811,8 +233326,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -228827,7 +233343,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -228844,7 +233361,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -229050,7 +233568,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -229143,7 +233661,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -229336,8 +233854,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -229497,9 +234016,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -229590,8 +234120,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -229633,7 +234163,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -229660,8 +234192,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -229707,8 +234239,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -229723,8 +234256,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -229739,7 +234273,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -229756,7 +234291,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -229962,7 +234498,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -230055,7 +234591,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -230248,8 +234784,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -230409,9 +234946,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -230502,8 +235050,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -230545,7 +235093,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -230572,8 +235122,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -230619,8 +235169,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -230635,8 +235186,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -230651,7 +235203,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -230668,7 +235221,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -230874,7 +235428,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -230967,7 +235521,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -231160,8 +235714,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -231321,9 +235876,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -231414,8 +235980,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -231457,7 +236023,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -231484,8 +236052,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -231531,8 +236099,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -231547,8 +236116,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -231563,7 +236133,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -231580,7 +236151,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -231786,7 +236358,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -231879,7 +236451,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -232072,8 +236644,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -232233,9 +236806,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -232326,8 +236910,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -232369,7 +236953,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -232396,8 +236982,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -232443,8 +237029,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -232459,8 +237046,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -232475,7 +237063,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -232492,7 +237081,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -232698,7 +237288,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -232791,7 +237381,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -232984,8 +237574,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -233145,9 +237736,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -233238,8 +237840,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -233281,7 +237883,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -233308,8 +237912,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -233355,8 +237959,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -233371,8 +237976,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -233387,7 +237993,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -233404,7 +238011,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -233610,7 +238218,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -233703,7 +238311,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -233896,8 +238504,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -234057,9 +238666,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -234150,8 +238770,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -234193,7 +238813,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -234220,8 +238842,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -234267,8 +238889,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -234283,8 +238906,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -234299,7 +238923,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -234316,7 +238941,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -234522,7 +239148,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -234615,7 +239241,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -234808,8 +239434,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -234969,9 +239596,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -235062,8 +239700,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -235105,7 +239743,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -235132,8 +239772,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -235179,8 +239819,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -235195,8 +239836,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -235211,7 +239853,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -235228,7 +239871,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -235434,7 +240078,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -235527,7 +240171,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -235720,8 +240364,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -235881,9 +240526,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -235974,8 +240630,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -236017,7 +240673,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -236044,8 +240702,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -236091,8 +240749,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -236107,8 +240766,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -236123,7 +240783,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -236140,7 +240801,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -236346,7 +241008,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -236439,7 +241101,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -236632,8 +241294,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -236793,9 +241456,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -236886,8 +241560,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -236929,7 +241603,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -236956,8 +241632,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -237003,8 +241679,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -237019,8 +241696,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -237035,7 +241713,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -237052,7 +241731,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -237258,7 +241938,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -237351,7 +242031,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -237544,8 +242224,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -237705,9 +242386,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -237798,8 +242490,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -237841,7 +242533,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -237868,8 +242562,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -237915,8 +242609,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -237931,8 +242626,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -237947,7 +242643,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -237964,7 +242661,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -238170,7 +242868,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -238263,7 +242961,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -238456,8 +243154,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -238617,9 +243316,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -238710,8 +243420,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -238753,7 +243463,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -238780,8 +243492,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -238827,8 +243539,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -238843,8 +243556,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -238859,7 +243573,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -238876,7 +243591,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -239082,7 +243798,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -239175,7 +243891,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -239368,8 +244084,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -239529,9 +244246,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -239622,8 +244350,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -239665,7 +244393,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -239692,8 +244422,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -239739,8 +244469,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -239755,8 +244486,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -239771,7 +244503,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -239788,7 +244521,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -239994,7 +244728,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -240087,7 +244821,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -240280,8 +245014,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -240441,9 +245176,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -240534,8 +245280,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -240577,7 +245323,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -240604,8 +245352,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -240651,8 +245399,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -240667,8 +245416,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -240683,7 +245433,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -240700,7 +245451,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -240906,7 +245658,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -240999,7 +245751,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -241192,8 +245944,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -241353,9 +246106,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -241446,8 +246210,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -241489,7 +246253,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -241516,8 +246282,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -241563,8 +246329,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -241579,8 +246346,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -241595,7 +246363,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -241612,7 +246381,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -241818,7 +246588,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -241911,7 +246681,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -242104,8 +246874,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -242265,9 +247036,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -242358,8 +247140,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -242401,7 +247183,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -242428,8 +247212,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -242475,8 +247259,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -242491,8 +247276,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -242507,7 +247293,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -242524,7 +247311,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -242730,7 +247518,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -242823,7 +247611,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -243016,8 +247804,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -243177,9 +247966,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -243270,8 +248070,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -243313,7 +248113,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -243340,8 +248142,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -243387,8 +248189,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -243403,8 +248206,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -243419,7 +248223,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -243436,7 +248241,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -243642,7 +248448,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -243735,7 +248541,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -243928,8 +248734,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -244089,9 +248896,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -244182,8 +249000,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -244225,7 +249043,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -244252,8 +249072,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -244299,8 +249119,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -244315,8 +249136,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -244331,7 +249153,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -244348,7 +249171,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -244554,7 +249378,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -244647,7 +249471,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -244840,8 +249664,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -245001,9 +249826,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -245094,8 +249930,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -245137,7 +249973,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -245164,8 +250002,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -245211,8 +250049,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -245227,8 +250066,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -245243,7 +250083,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -245260,7 +250101,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -245466,7 +250308,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -245559,7 +250401,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -245752,8 +250594,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -245913,9 +250756,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -246006,8 +250860,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -246049,7 +250903,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -246076,8 +250932,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -246123,8 +250979,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -246139,8 +250996,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -246155,7 +251013,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -246172,7 +251031,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -246378,7 +251238,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -246471,7 +251331,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -246664,8 +251524,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -246825,9 +251686,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -246918,8 +251790,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -246961,7 +251833,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -246988,8 +251862,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -247035,8 +251909,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -247051,8 +251926,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -247067,7 +251943,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -247084,7 +251961,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -247290,7 +252168,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -247383,7 +252261,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -247576,8 +252454,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -247737,9 +252616,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -247830,8 +252720,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -247873,7 +252763,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -247900,8 +252792,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -247947,8 +252839,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -247963,8 +252856,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -247979,7 +252873,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -247996,7 +252891,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -248202,7 +253098,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -248295,7 +253191,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -248488,8 +253384,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -248649,9 +253546,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -248742,8 +253650,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -248785,7 +253693,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -248812,8 +253722,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -248859,8 +253769,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -248875,8 +253786,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -248891,7 +253803,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -248908,7 +253821,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -249114,7 +254028,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -249207,7 +254121,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -249400,8 +254314,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -249561,9 +254476,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -249654,8 +254580,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -249697,7 +254623,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -249724,8 +254652,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -249771,8 +254699,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -249787,8 +254716,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -249803,7 +254733,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -249820,7 +254751,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -250026,7 +254958,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -250119,7 +255051,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -250312,8 +255244,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -250473,9 +255406,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -250566,8 +255510,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -250609,7 +255553,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -250636,8 +255582,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -250683,8 +255629,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -250699,8 +255646,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -250715,7 +255663,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -250732,7 +255681,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -250938,7 +255888,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -251031,7 +255981,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -251224,8 +256174,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -251385,9 +256336,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -251478,8 +256440,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -251521,7 +256483,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -251548,8 +256512,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -251595,8 +256559,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -251611,8 +256576,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -251627,7 +256593,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -251644,7 +256611,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -251850,7 +256818,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -251943,7 +256911,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -252136,8 +257104,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -252297,9 +257266,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -252390,8 +257370,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -252433,7 +257413,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -252460,8 +257442,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -252507,8 +257489,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -252523,8 +257506,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -252539,7 +257523,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -252556,7 +257541,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -252762,7 +257748,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -252855,7 +257841,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -253048,8 +258034,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -253209,9 +258196,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -253302,8 +258300,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -253345,7 +258343,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -253372,8 +258372,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -253419,8 +258419,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -253435,8 +258436,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -253451,7 +258453,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -253468,7 +258471,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -253674,7 +258678,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -253767,7 +258771,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -253960,8 +258964,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -254121,9 +259126,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -254214,8 +259230,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -254257,7 +259273,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -254284,8 +259302,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -254331,8 +259349,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -254347,8 +259366,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -254363,7 +259383,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -254380,7 +259401,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -254586,7 +259608,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -254679,7 +259701,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -254872,8 +259894,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -255033,9 +260056,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -255126,8 +260160,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -255169,7 +260203,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -255196,8 +260232,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -255243,8 +260279,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -255259,8 +260296,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -255275,7 +260313,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -255292,7 +260331,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -255498,7 +260538,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -255591,7 +260631,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -255784,8 +260824,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -255945,9 +260986,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -256038,8 +261090,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -256081,7 +261133,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -256108,8 +261162,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -256155,8 +261209,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -256171,8 +261226,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -256187,7 +261243,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -256204,7 +261261,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -256410,7 +261468,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -256503,7 +261561,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -256696,8 +261754,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -256857,9 +261916,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -256950,8 +262020,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -256993,7 +262063,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -257020,8 +262092,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -257067,8 +262139,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -257083,8 +262156,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -257099,7 +262173,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -257116,7 +262191,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -257322,7 +262398,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -257415,7 +262491,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -257608,8 +262684,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -257769,9 +262846,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -257862,8 +262950,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -257905,7 +262993,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -257932,8 +263022,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -257979,8 +263069,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -257995,8 +263086,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -258011,7 +263103,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -258028,7 +263121,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -258234,7 +263328,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -258327,7 +263421,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -258520,8 +263614,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -258681,9 +263776,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -258774,8 +263880,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -258817,7 +263923,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -258844,8 +263952,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -258891,8 +263999,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -258907,8 +264016,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -258923,7 +264033,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -258940,7 +264051,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -259146,7 +264258,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -259239,7 +264351,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -259432,8 +264544,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -259593,9 +264706,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -259686,8 +264810,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -259729,7 +264853,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -259756,8 +264882,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -259803,8 +264929,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -259819,8 +264946,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -259835,7 +264963,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -259852,7 +264981,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -260058,7 +265188,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -260151,7 +265281,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -260344,8 +265474,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -260505,9 +265636,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -260598,8 +265740,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -260641,7 +265783,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -260668,8 +265812,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -260715,8 +265859,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -260731,8 +265876,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -260747,7 +265893,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -260764,7 +265911,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -260970,7 +266118,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -261063,7 +266211,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -261256,8 +266404,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -261417,9 +266566,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -261510,8 +266670,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -261553,7 +266713,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -261580,8 +266742,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -261627,8 +266789,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -261643,8 +266806,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -261659,7 +266823,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -261676,7 +266841,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -261882,7 +267048,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -261975,7 +267141,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -262168,8 +267334,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -262329,9 +267496,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -262422,8 +267600,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -262465,7 +267643,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -262492,8 +267672,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -262539,8 +267719,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -262555,8 +267736,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -262571,7 +267753,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -262588,7 +267771,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -262794,7 +267978,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -262887,7 +268071,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -263080,8 +268264,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -263241,9 +268426,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -263334,8 +268530,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -263377,7 +268573,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -263404,8 +268602,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -263451,8 +268649,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -263467,8 +268666,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -263483,7 +268683,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -263500,7 +268701,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -263706,7 +268908,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -263799,7 +269001,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -263992,8 +269194,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -264153,9 +269356,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -264246,8 +269460,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -264289,7 +269503,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -264316,8 +269532,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -264363,8 +269579,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -264379,8 +269596,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -264395,7 +269613,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -264412,7 +269631,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -264618,7 +269838,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -264711,7 +269931,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -264904,8 +270124,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -265065,9 +270286,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -265158,8 +270390,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -265201,7 +270433,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -265228,8 +270462,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -265275,8 +270509,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -265291,8 +270526,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -265307,7 +270543,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -265324,7 +270561,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -265530,7 +270768,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -265623,7 +270861,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -265816,8 +271054,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -265977,9 +271216,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -266070,8 +271320,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -266113,7 +271363,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -266140,8 +271392,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -266187,8 +271439,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -266203,8 +271456,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -266219,7 +271473,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -266236,7 +271491,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -266442,7 +271698,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -266535,7 +271791,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -266728,8 +271984,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -266889,9 +272146,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -266982,8 +272250,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -267025,7 +272293,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -267052,8 +272322,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -267099,8 +272369,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -267115,8 +272386,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -267131,7 +272403,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -267148,7 +272421,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -267354,7 +272628,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -267447,7 +272721,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -267640,8 +272914,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -267801,9 +273076,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -267894,8 +273180,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -267937,7 +273223,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -267964,8 +273252,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -268011,8 +273299,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -268027,8 +273316,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -268043,7 +273333,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -268060,7 +273351,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -268266,7 +273558,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -268359,7 +273651,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -268552,8 +273844,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -268713,9 +274006,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -268806,8 +274110,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -268849,7 +274153,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -268876,8 +274182,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -268923,8 +274229,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -268939,8 +274246,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -268955,7 +274263,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -268972,7 +274281,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -269178,7 +274488,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -269271,7 +274581,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -269464,8 +274774,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -269625,9 +274936,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -269718,8 +275040,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -269761,7 +275083,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -269788,8 +275112,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -269835,8 +275159,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -269851,8 +275176,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -269867,7 +275193,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -269884,7 +275211,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -270090,7 +275418,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -270183,7 +275511,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -270376,8 +275704,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -270537,9 +275866,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -270630,8 +275970,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -270673,7 +276013,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -270700,8 +276042,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -270747,8 +276089,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -270763,8 +276106,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -270779,7 +276123,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -270796,7 +276141,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -271002,7 +276348,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -271095,7 +276441,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -271288,8 +276634,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -271449,9 +276796,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -271542,8 +276900,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -271585,7 +276943,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -271612,8 +276972,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -271659,8 +277019,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -271675,8 +277036,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -271691,7 +277053,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -271708,7 +277071,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -271914,7 +277278,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -272007,7 +277371,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -272200,8 +277564,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -272361,9 +277726,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -272454,8 +277830,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -272497,7 +277873,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -272524,8 +277902,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -272571,8 +277949,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -272587,8 +277966,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -272603,7 +277983,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -272620,7 +278001,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -272826,7 +278208,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -272919,7 +278301,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -273112,8 +278494,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -273273,9 +278656,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -273366,8 +278760,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -273409,7 +278803,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -273436,8 +278832,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -273483,8 +278879,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -273499,8 +278896,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -273515,7 +278913,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -273532,7 +278931,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -273738,7 +279138,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -273831,7 +279231,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -274024,8 +279424,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -274185,9 +279586,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -274278,8 +279690,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -274321,7 +279733,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -274348,8 +279762,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -274395,8 +279809,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -274411,8 +279826,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -274427,7 +279843,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -274444,7 +279861,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -274650,7 +280068,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -274743,7 +280161,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -274936,8 +280354,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -275097,9 +280516,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -275190,8 +280620,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -275233,7 +280663,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -275260,8 +280692,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -275307,8 +280739,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -275323,8 +280756,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -275339,7 +280773,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -275356,7 +280791,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -275562,7 +280998,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -275655,7 +281091,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -275848,8 +281284,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -276009,9 +281446,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -276102,8 +281550,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -276145,7 +281593,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -276172,8 +281622,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -276219,8 +281669,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -276235,8 +281686,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -276251,7 +281703,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -276268,7 +281721,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -276474,7 +281928,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -276567,7 +282021,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -276760,8 +282214,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -276921,9 +282376,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -277014,8 +282480,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -277057,7 +282523,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -277084,8 +282552,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -277131,8 +282599,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -277147,8 +282616,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -277163,7 +282633,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -277180,7 +282651,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -277386,7 +282858,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -277479,7 +282951,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -277672,8 +283144,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -277833,9 +283306,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -277926,8 +283410,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -277969,7 +283453,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -277996,8 +283482,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -278043,8 +283529,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -278059,8 +283546,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -278075,7 +283563,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -278092,7 +283581,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -278298,7 +283788,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -278391,7 +283881,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -278584,8 +284074,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -278745,9 +284236,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -278838,8 +284340,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -278881,7 +284383,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -278908,8 +284412,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -278955,8 +284459,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -278971,8 +284476,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -278987,7 +284493,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -279004,7 +284511,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -279210,7 +284718,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -279303,7 +284811,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -279496,8 +285004,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -279657,9 +285166,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -279750,8 +285270,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -279793,7 +285313,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -279820,8 +285342,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -279867,8 +285389,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -279883,8 +285406,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -279899,7 +285423,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -279916,7 +285441,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -280122,7 +285648,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -280215,7 +285741,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -280408,8 +285934,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -280569,9 +286096,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -280662,8 +286200,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -280705,7 +286243,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -280732,8 +286272,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -280779,8 +286319,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -280795,8 +286336,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -280811,7 +286353,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -280828,7 +286371,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -281034,7 +286578,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -281127,7 +286671,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -281320,8 +286864,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -281481,9 +287026,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -281574,8 +287130,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -281617,7 +287173,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -281644,8 +287202,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -281691,8 +287249,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -281707,8 +287266,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -281723,7 +287283,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -281740,7 +287301,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -281946,7 +287508,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -282039,7 +287601,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -282232,8 +287794,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -282393,9 +287956,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -282486,8 +288060,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -282529,7 +288103,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -282556,8 +288132,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -282603,8 +288179,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -282619,8 +288196,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -282635,7 +288213,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -282652,7 +288231,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -282858,7 +288438,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -282951,7 +288531,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -283144,8 +288724,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -283305,9 +288886,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -283398,8 +288990,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -283441,7 +289033,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -283468,8 +289062,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -283515,8 +289109,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -283531,8 +289126,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -283547,7 +289143,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -283564,7 +289161,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -283770,7 +289368,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -283863,7 +289461,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -284056,8 +289654,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -284217,9 +289816,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -284310,8 +289920,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -284353,7 +289963,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -284380,8 +289992,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -284427,8 +290039,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -284443,8 +290056,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -284459,7 +290073,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -284476,7 +290091,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -284682,7 +290298,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -284775,7 +290391,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -284968,8 +290584,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -285129,9 +290746,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -285222,8 +290850,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -285265,7 +290893,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -285292,8 +290922,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -285339,8 +290969,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -285355,8 +290986,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -285371,7 +291003,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -285388,7 +291021,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -285594,7 +291228,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -285687,7 +291321,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -285880,8 +291514,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -286041,9 +291676,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -286134,8 +291780,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -286177,7 +291823,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -286204,8 +291852,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -286251,8 +291899,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -286267,8 +291916,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -286283,7 +291933,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -286300,7 +291951,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -286506,7 +292158,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -286599,7 +292251,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -286792,8 +292444,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -286953,9 +292606,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -287046,8 +292710,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -287089,7 +292753,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -287116,8 +292782,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -287163,8 +292829,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -287179,8 +292846,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -287195,7 +292863,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -287212,7 +292881,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -287418,7 +293088,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -287511,7 +293181,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -287704,8 +293374,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -287865,9 +293536,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -287958,8 +293640,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -288001,7 +293683,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -288028,8 +293712,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -288075,8 +293759,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -288091,8 +293776,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -288107,7 +293793,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -288124,7 +293811,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -288330,7 +294018,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -288423,7 +294111,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -288616,8 +294304,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -288777,9 +294466,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -288870,8 +294570,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -288913,7 +294613,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -288940,8 +294642,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -288987,8 +294689,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -289003,8 +294706,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -289019,7 +294723,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -289036,7 +294741,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -289242,7 +294948,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -289335,7 +295041,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -289528,8 +295234,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -289689,9 +295396,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -289782,8 +295500,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -289825,7 +295543,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -289852,8 +295572,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -289899,8 +295619,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -289915,8 +295636,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -289931,7 +295653,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -289948,7 +295671,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -290154,7 +295878,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -290247,7 +295971,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -290440,8 +296164,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -290601,9 +296326,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -290694,8 +296430,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -290737,7 +296473,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -290764,8 +296502,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -290811,8 +296549,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -290827,8 +296566,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -290843,7 +296583,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -290860,7 +296601,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -291066,7 +296808,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -291159,7 +296901,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -291352,8 +297094,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -291513,9 +297256,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -291606,8 +297360,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -291649,7 +297403,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -291676,8 +297432,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -291723,8 +297479,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -291739,8 +297496,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -291755,7 +297513,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -291772,7 +297531,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -291978,7 +297738,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -292071,7 +297831,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -292264,8 +298024,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -292425,9 +298186,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -292518,8 +298290,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -292561,7 +298333,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -292588,8 +298362,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -292635,8 +298409,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -292651,8 +298426,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -292667,7 +298443,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -292684,7 +298461,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -292890,7 +298668,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -292983,7 +298761,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -293176,8 +298954,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -293337,9 +299116,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -293430,8 +299220,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -293473,7 +299263,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -293500,8 +299292,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -293547,8 +299339,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -293563,8 +299356,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -293579,7 +299373,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -293596,7 +299391,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -293802,7 +299598,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -293895,7 +299691,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -294088,8 +299884,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -294249,9 +300046,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -294342,8 +300150,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -294385,7 +300193,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -294412,8 +300222,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -294459,8 +300269,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -294475,8 +300286,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -294491,7 +300303,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -294508,7 +300321,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -294714,7 +300528,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -294807,7 +300621,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -295000,8 +300814,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -295161,9 +300976,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -295254,8 +301080,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -295297,7 +301123,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -295324,8 +301152,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -295371,8 +301199,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -295387,8 +301216,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -295403,7 +301233,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -295420,7 +301251,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -295626,7 +301458,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -295719,7 +301551,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -295912,8 +301744,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -296073,9 +301906,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -296166,8 +302010,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -296209,7 +302053,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -296236,8 +302082,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -296283,8 +302129,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -296299,8 +302146,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -296315,7 +302163,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -296332,7 +302181,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -296538,7 +302388,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -296631,7 +302481,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -296824,8 +302674,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -296985,9 +302836,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -297078,8 +302940,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -297121,7 +302983,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -297148,8 +303012,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -297195,8 +303059,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -297211,8 +303076,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -297227,7 +303093,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -297244,7 +303111,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -297450,7 +303318,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -297543,7 +303411,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -297736,8 +303604,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -297897,9 +303766,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -297990,8 +303870,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -298033,7 +303913,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -298060,8 +303942,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -298107,8 +303989,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -298123,8 +304006,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -298139,7 +304023,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -298156,7 +304041,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -298362,7 +304248,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -298455,7 +304341,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -298648,8 +304534,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -298809,9 +304696,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -298902,8 +304800,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -298945,7 +304843,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -298972,8 +304872,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -299019,8 +304919,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -299035,8 +304936,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -299051,7 +304953,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -299068,7 +304971,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -299274,7 +305178,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -299367,7 +305271,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -299560,8 +305464,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -299721,9 +305626,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -299814,8 +305730,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -299857,7 +305773,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -299884,8 +305802,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -299931,8 +305849,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -299947,8 +305866,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -299963,7 +305883,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -299980,7 +305901,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -300186,7 +306108,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -300279,7 +306201,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -300472,8 +306394,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -300633,9 +306556,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -300726,8 +306660,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -300769,7 +306703,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -300796,8 +306732,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -300843,8 +306779,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -300859,8 +306796,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -300875,7 +306813,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -300892,7 +306831,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -301098,7 +307038,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -301191,7 +307131,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -301384,8 +307324,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -301545,9 +307486,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -301638,8 +307590,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -301681,7 +307633,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -301708,8 +307662,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -301755,8 +307709,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -301771,8 +307726,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -301787,7 +307743,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -301804,7 +307761,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -302010,7 +307968,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -302103,7 +308061,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -302296,8 +308254,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -302457,9 +308416,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -302550,8 +308520,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -302593,7 +308563,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -302620,8 +308592,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -302667,8 +308639,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -302683,8 +308656,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -302699,7 +308673,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -302716,7 +308691,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -302922,7 +308898,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -303015,7 +308991,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -303208,8 +309184,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -303369,9 +309346,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -303462,8 +309450,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -303505,7 +309493,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -303532,8 +309522,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -303579,8 +309569,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -303595,8 +309586,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -303611,7 +309603,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -303628,7 +309621,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -303834,7 +309828,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -303927,7 +309921,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -304120,8 +310114,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -304281,9 +310276,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -304374,8 +310380,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -304417,7 +310423,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -304444,8 +310452,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -304491,8 +310499,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -304507,8 +310516,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -304523,7 +310533,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -304540,7 +310551,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -304746,7 +310758,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -304839,7 +310851,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -305032,8 +311044,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -305193,9 +311206,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -305286,8 +311310,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -305329,7 +311353,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -305356,8 +311382,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -305403,8 +311429,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -305419,8 +311446,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -305435,7 +311463,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -305452,7 +311481,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -305658,7 +311688,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -305751,7 +311781,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -305944,8 +311974,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -306105,9 +312136,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -306198,8 +312240,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -306241,7 +312283,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -306268,8 +312312,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -306315,8 +312359,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -306331,8 +312376,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -306347,7 +312393,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -306364,7 +312411,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -306570,7 +312618,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -306663,7 +312711,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -306856,8 +312904,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -307017,9 +313066,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -307110,8 +313170,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -307153,7 +313213,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -307180,8 +313242,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -307227,8 +313289,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -307243,8 +313306,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -307259,7 +313323,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -307276,7 +313341,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -307482,7 +313548,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -307575,7 +313641,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -307768,8 +313834,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -307929,9 +313996,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -308022,8 +314100,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -308065,7 +314143,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -308092,8 +314172,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -308139,8 +314219,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -308155,8 +314236,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -308171,7 +314253,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -308188,7 +314271,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -308394,7 +314478,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -308487,7 +314571,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -308680,8 +314764,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -308841,9 +314926,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -308934,8 +315030,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -308977,7 +315073,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -309004,8 +315102,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -309051,8 +315149,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -309067,8 +315166,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -309083,7 +315183,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -309100,7 +315201,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -309306,7 +315408,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -309399,7 +315501,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -309592,8 +315694,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -309753,9 +315856,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -309846,8 +315960,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -309889,7 +316003,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -309916,8 +316032,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -309963,8 +316079,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -309979,8 +316096,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -309995,7 +316113,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -310012,7 +316131,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -310218,7 +316338,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -310311,7 +316431,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -310504,8 +316624,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -310665,9 +316786,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -310758,8 +316890,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -310801,7 +316933,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -310828,8 +316962,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -310875,8 +317009,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -310891,8 +317026,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -310907,7 +317043,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -310924,7 +317061,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -311130,7 +317268,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -311223,7 +317361,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -311416,8 +317554,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -311577,9 +317716,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -311670,8 +317820,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -311713,7 +317863,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -311740,8 +317892,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -311787,8 +317939,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -311803,8 +317956,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -311819,7 +317973,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -311836,7 +317991,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -312042,7 +318198,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -312135,7 +318291,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -312328,8 +318484,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -312489,9 +318646,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -312582,8 +318750,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -312625,7 +318793,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -312652,8 +318822,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -312699,8 +318869,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -312715,8 +318886,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -312731,7 +318903,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -312748,7 +318921,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -312954,7 +319128,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -313047,7 +319221,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -313240,8 +319414,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -313401,9 +319576,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -313494,8 +319680,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -313537,7 +319723,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -313564,8 +319752,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -313611,8 +319799,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -313627,8 +319816,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -313643,7 +319833,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -313660,7 +319851,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -313866,7 +320058,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -313959,7 +320151,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -314152,8 +320344,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -314313,9 +320506,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -314406,8 +320610,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -314449,7 +320653,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -314476,8 +320682,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -314523,8 +320729,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -314539,8 +320746,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -314555,7 +320763,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -314572,7 +320781,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -314778,7 +320988,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -314871,7 +321081,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -315064,8 +321274,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -315225,9 +321436,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -315318,8 +321540,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -315361,7 +321583,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -315388,8 +321612,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -315435,8 +321659,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -315451,8 +321676,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -315467,7 +321693,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -315484,7 +321711,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -315690,7 +321918,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -315783,7 +322011,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -315976,8 +322204,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -316137,9 +322366,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -316230,8 +322470,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -316273,7 +322513,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -316300,8 +322542,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -316347,8 +322589,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -316363,8 +322606,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -316379,7 +322623,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -316396,7 +322641,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -316602,7 +322848,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -316695,7 +322941,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -316888,8 +323134,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -317049,9 +323296,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -317142,8 +323400,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -317185,7 +323443,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -317212,8 +323472,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -317259,8 +323519,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -317275,8 +323536,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -317291,7 +323553,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -317308,7 +323571,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -317514,7 +323778,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -317607,7 +323871,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -317800,8 +324064,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -317961,9 +324226,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -318054,8 +324330,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -318097,7 +324373,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -318124,8 +324402,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -318171,8 +324449,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -318187,8 +324466,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -318203,7 +324483,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -318220,7 +324501,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -318426,7 +324708,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -318519,7 +324801,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -318712,8 +324994,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -318873,9 +325156,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -318966,8 +325260,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -319009,7 +325303,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -319036,8 +325332,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -319083,8 +325379,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -319099,8 +325396,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -319115,7 +325413,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -319132,7 +325431,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -319338,7 +325638,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -319431,7 +325731,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -319624,8 +325924,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -319785,9 +326086,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -319878,8 +326190,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -319921,7 +326233,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -319948,8 +326262,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -319995,8 +326309,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -320011,8 +326326,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -320027,7 +326343,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -320044,7 +326361,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 @@ -320250,7 +326568,7 @@ T1587.001,No,-,0 T1121,No,-,0 T1206,No,-,0 T1087.002,No,-,0 -T1564,No,-,1 +T1564,No,-,2 T1559.002,No,-,0 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/uncommon_processes_on_endpoint.yml,3 T1204.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/batch_file_write_to_system32.yml,3 @@ -320343,7 +326661,7 @@ T1091,No,-,0 T1005,No,-,0 T1140,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml,1 T1137.005,No,-,0 -T1562,No,-,9 +T1562,No,-,20 T1586.002,No,-,0 T1195,No,-,0 T1190,Yes,https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml,1 @@ -320536,8 +326854,9 @@ T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1562.006,No,-,0 T1136.002,No,-,0 T1589.003,No,-,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,3 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3 T1558.001,No,-,0 T1175,No,-,0 T1020,No,-,0 @@ -320697,9 +327016,20 @@ T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36 T1059.004,No,-,0 T1137.003,No,-,0 T1157,No,-,0 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,3 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,3 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14 T1565,No,-,0 T1559,No,-,0 T1001,No,-,0 @@ -320790,8 +327120,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections T1195.002,No,-,0 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7 @@ -320833,7 +327163,9 @@ T1499,No,-,0 T1027.004,No,-,0 T1065,No,-,0 T1564.007,No,-,0 -T1197,No,-,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,3 T1127.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_spawn.yml,3 @@ -320860,8 +327192,8 @@ T1500,No,-,0 T1565.002,No,-,0 T1003.008,No,-,0 T1543.001,No,-,0 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,4 -T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,4 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,5 +T1569,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_command_line_argument.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_connhost_exe_force_flag.yml,5 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,5 @@ -320907,8 +327239,9 @@ T1543.002,No,-,0 T1563.002,No,-,0 T1136,Yes,https://github.com/splunk/security_content/blob/develop/detections/web_fraud___account_harvesting.yml,10 T1584.004,No,-,0 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,2 -T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,2 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml,3 +T1526,Yes,https://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml,3 T1151,No,-,0 T1018,No,-,0 T1046,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml,2 @@ -320923,8 +327256,9 @@ T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,2 T1052,No,-,0 T1574.002,No,-,0 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,2 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,2 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,3 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,3 T1098.002,No,-,0 T1588.003,No,-,0 T1126,No,-,0 @@ -320939,7 +327273,8 @@ T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1484,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4 T1220,No,-,0 T1596.005,No,-,0 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,1 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,2 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,2 T1578.001,No,-,0 T1591.001,No,-,0 T1137.002,No,-,0 @@ -320956,7 +327291,8 @@ T1001.002,No,-,0 T1204.001,No,-,0 T1550.001,No,-,0 T1547.008,No,-,0 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,1 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,2 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,2 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_infrastructure_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/abnormally_high_number_of_cloud_security_group_api_calls.yml,17 T1078.004,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_create_policy_version_to_allow_all_resources.yml,17 diff --git a/docs/mitre-map/coverage.json b/docs/mitre-map/coverage.json index 8690e27733..a154cc4c8e 100644 --- a/docs/mitre-map/coverage.json +++ b/docs/mitre-map/coverage.json @@ -563,8 +563,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -783,8 +783,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -880,7 +880,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -938,7 +938,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -973,7 +977,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -1038,8 +1042,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -1071,8 +1075,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -1091,8 +1095,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -1111,8 +1115,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -1745,8 +1749,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -1965,8 +1969,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -2062,7 +2066,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -2120,7 +2124,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -2155,7 +2163,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -2220,8 +2228,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -2253,8 +2261,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -2273,8 +2281,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -2293,8 +2301,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -2927,8 +2935,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -3147,8 +3155,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -3244,7 +3252,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -3302,7 +3310,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -3337,7 +3349,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -3402,8 +3414,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -3435,8 +3447,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -3455,8 +3467,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -3475,8 +3487,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -4109,8 +4121,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -4329,8 +4341,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -4426,7 +4438,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -4484,7 +4496,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -4519,7 +4535,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -4584,8 +4600,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -4617,8 +4633,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -4637,8 +4653,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -4657,8 +4673,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -5291,8 +5307,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -5511,8 +5527,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -5608,7 +5624,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -5666,7 +5682,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -5701,7 +5721,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -5766,8 +5786,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -5799,8 +5819,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -5819,8 +5839,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -5839,8 +5859,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -6473,8 +6493,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -6693,8 +6713,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -6790,7 +6810,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -6848,7 +6868,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -6883,7 +6907,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -6948,8 +6972,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -6981,8 +7005,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -7001,8 +7025,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -7021,8 +7045,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -7655,8 +7679,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -7875,8 +7899,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -7972,7 +7996,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -8030,7 +8054,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -8065,7 +8093,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -8130,8 +8158,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -8163,8 +8191,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -8183,8 +8211,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -8203,8 +8231,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -8837,8 +8865,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -9057,8 +9085,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -9154,7 +9182,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -9212,7 +9240,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -9247,7 +9279,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -9312,8 +9344,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -9345,8 +9377,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -9365,8 +9397,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -9385,8 +9417,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -10019,8 +10051,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -10239,8 +10271,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -10336,7 +10368,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -10394,7 +10426,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -10429,7 +10465,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -10494,8 +10530,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -10527,8 +10563,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -10547,8 +10583,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -10567,8 +10603,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -11201,8 +11237,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -11421,8 +11457,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -11518,7 +11554,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -11576,7 +11612,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -11611,7 +11651,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -11676,8 +11716,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -11709,8 +11749,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -11729,8 +11769,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -11749,8 +11789,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -12383,8 +12423,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -12603,8 +12643,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -12700,7 +12740,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -12758,7 +12798,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -12793,7 +12837,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -12858,8 +12902,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -12891,8 +12935,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -12911,8 +12955,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -12931,8 +12975,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -13565,8 +13609,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -13785,8 +13829,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -13882,7 +13926,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -13940,7 +13984,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -13975,7 +14023,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -14040,8 +14088,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -14073,8 +14121,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -14093,8 +14141,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -14113,8 +14161,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -14747,8 +14795,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -14967,8 +15015,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -15064,7 +15112,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -15122,7 +15170,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -15157,7 +15209,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -15222,8 +15274,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -15255,8 +15307,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -15275,8 +15327,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -15295,8 +15347,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -15929,8 +15981,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -16149,8 +16201,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -16246,7 +16298,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -16304,7 +16356,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -16339,7 +16395,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -16404,8 +16460,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -16437,8 +16493,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -16457,8 +16513,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -16477,8 +16533,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -17111,8 +17167,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -17331,8 +17387,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -17428,7 +17484,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -17486,7 +17542,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -17521,7 +17581,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -17586,8 +17646,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -17619,8 +17679,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -17639,8 +17699,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -17659,8 +17719,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -18293,8 +18353,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -18513,8 +18573,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -18610,7 +18670,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -18668,7 +18728,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -18703,7 +18767,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -18768,8 +18832,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -18801,8 +18865,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -18821,8 +18885,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -18841,8 +18905,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -19475,8 +19539,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -19695,8 +19759,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -19792,7 +19856,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -19850,7 +19914,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -19885,7 +19953,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -19950,8 +20018,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -19983,8 +20051,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -20003,8 +20071,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -20023,8 +20091,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -20657,8 +20725,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -20877,8 +20945,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -20974,7 +21042,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -21032,7 +21100,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -21067,7 +21139,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -21132,8 +21204,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -21165,8 +21237,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -21185,8 +21257,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -21205,8 +21277,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -21839,8 +21911,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -22059,8 +22131,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -22156,7 +22228,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -22214,7 +22286,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -22249,7 +22325,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -22314,8 +22390,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -22347,8 +22423,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -22367,8 +22443,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -22387,8 +22463,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -23021,8 +23097,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -23241,8 +23317,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -23338,7 +23414,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -23396,7 +23472,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -23431,7 +23511,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -23496,8 +23576,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -23529,8 +23609,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -23549,8 +23629,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -23569,8 +23649,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -24203,8 +24283,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -24423,8 +24503,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -24520,7 +24600,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -24578,7 +24658,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -24613,7 +24697,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -24678,8 +24762,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -24711,8 +24795,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -24731,8 +24815,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -24751,8 +24835,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -25385,8 +25469,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -25605,8 +25689,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -25702,7 +25786,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -25760,7 +25844,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -25795,7 +25883,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -25860,8 +25948,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -25893,8 +25981,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -25913,8 +26001,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -25933,8 +26021,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -26567,8 +26655,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -26787,8 +26875,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -26884,7 +26972,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -26942,7 +27030,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -26977,7 +27069,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -27042,8 +27134,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -27075,8 +27167,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -27095,8 +27187,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -27115,8 +27207,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -27749,8 +27841,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -27969,8 +28061,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -28066,7 +28158,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -28124,7 +28216,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -28159,7 +28255,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -28224,8 +28320,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -28257,8 +28353,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -28277,8 +28373,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -28297,8 +28393,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -28931,8 +29027,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -29151,8 +29247,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -29248,7 +29344,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -29306,7 +29402,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -29341,7 +29441,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -29406,8 +29506,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -29439,8 +29539,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -29459,8 +29559,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -29479,8 +29579,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -30113,8 +30213,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -30333,8 +30433,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -30430,7 +30530,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -30488,7 +30588,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -30523,7 +30627,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -30588,8 +30692,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -30621,8 +30725,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -30641,8 +30745,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -30661,8 +30765,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -31295,8 +31399,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -31515,8 +31619,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -31612,7 +31716,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -31670,7 +31774,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -31705,7 +31813,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -31770,8 +31878,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -31803,8 +31911,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -31823,8 +31931,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -31843,8 +31951,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -32477,8 +32585,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -32697,8 +32805,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -32794,7 +32902,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -32852,7 +32960,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -32887,7 +32999,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -32952,8 +33064,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -32985,8 +33097,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -33005,8 +33117,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -33025,8 +33137,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -33659,8 +33771,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -33879,8 +33991,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -33976,7 +34088,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -34034,7 +34146,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -34069,7 +34185,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -34134,8 +34250,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -34167,8 +34283,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -34187,8 +34303,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -34207,8 +34323,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -34841,8 +34957,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -35061,8 +35177,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -35158,7 +35274,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -35216,7 +35332,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -35251,7 +35371,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -35316,8 +35436,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -35349,8 +35469,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -35369,8 +35489,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -35389,8 +35509,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -36023,8 +36143,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -36243,8 +36363,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -36340,7 +36460,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -36398,7 +36518,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -36433,7 +36557,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -36498,8 +36622,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -36531,8 +36655,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -36551,8 +36675,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -36571,8 +36695,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -37205,8 +37329,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -37425,8 +37549,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -37522,7 +37646,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -37580,7 +37704,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -37615,7 +37743,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -37680,8 +37808,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -37713,8 +37841,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -37733,8 +37861,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -37753,8 +37881,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -38387,8 +38515,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -38607,8 +38735,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -38704,7 +38832,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -38762,7 +38890,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -38797,7 +38929,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -38862,8 +38994,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -38895,8 +39027,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -38915,8 +39047,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -38935,8 +39067,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -39569,8 +39701,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -39789,8 +39921,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -39886,7 +40018,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -39944,7 +40076,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -39979,7 +40115,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -40044,8 +40180,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -40077,8 +40213,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -40097,8 +40233,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -40117,8 +40253,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -40751,8 +40887,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -40971,8 +41107,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -41068,7 +41204,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -41126,7 +41262,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -41161,7 +41301,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -41226,8 +41366,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -41259,8 +41399,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -41279,8 +41419,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -41299,8 +41439,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -41933,8 +42073,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -42153,8 +42293,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -42250,7 +42390,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -42308,7 +42448,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -42343,7 +42487,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -42408,8 +42552,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -42441,8 +42585,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -42461,8 +42605,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -42481,8 +42625,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -43115,8 +43259,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -43335,8 +43479,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -43432,7 +43576,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -43490,7 +43634,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -43525,7 +43673,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -43590,8 +43738,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -43623,8 +43771,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -43643,8 +43791,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -43663,8 +43811,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -44297,8 +44445,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -44517,8 +44665,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -44614,7 +44762,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -44672,7 +44820,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -44707,7 +44859,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -44772,8 +44924,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -44805,8 +44957,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -44825,8 +44977,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -44845,8 +44997,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -45479,8 +45631,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -45699,8 +45851,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -45796,7 +45948,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -45854,7 +46006,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -45889,7 +46045,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -45954,8 +46110,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -45987,8 +46143,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -46007,8 +46163,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -46027,8 +46183,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -46661,8 +46817,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -46881,8 +47037,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -46978,7 +47134,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -47036,7 +47192,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -47071,7 +47231,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -47136,8 +47296,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -47169,8 +47329,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -47189,8 +47349,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -47209,8 +47369,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -47843,8 +48003,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -48063,8 +48223,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -48160,7 +48320,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -48218,7 +48378,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -48253,7 +48417,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -48318,8 +48482,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -48351,8 +48515,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -48371,8 +48535,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -48391,8 +48555,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -49025,8 +49189,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -49245,8 +49409,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -49342,7 +49506,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -49400,7 +49564,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -49435,7 +49603,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -49500,8 +49668,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -49533,8 +49701,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -49553,8 +49721,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -49573,8 +49741,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -50207,8 +50375,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -50427,8 +50595,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -50524,7 +50692,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -50582,7 +50750,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -50617,7 +50789,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -50682,8 +50854,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -50715,8 +50887,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -50735,8 +50907,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -50755,8 +50927,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -51389,8 +51561,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -51609,8 +51781,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -51706,7 +51878,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -51764,7 +51936,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -51799,7 +51975,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -51864,8 +52040,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -51897,8 +52073,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -51917,8 +52093,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -51937,8 +52113,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -52571,8 +52747,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -52791,8 +52967,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -52888,7 +53064,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -52946,7 +53122,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -52981,7 +53161,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -53046,8 +53226,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -53079,8 +53259,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -53099,8 +53279,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -53119,8 +53299,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -53753,8 +53933,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -53973,8 +54153,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -54070,7 +54250,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -54128,7 +54308,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -54163,7 +54347,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -54228,8 +54412,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -54261,8 +54445,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -54281,8 +54465,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -54301,8 +54485,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -54935,8 +55119,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -55155,8 +55339,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -55252,7 +55436,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -55310,7 +55494,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -55345,7 +55533,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -55410,8 +55598,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -55443,8 +55631,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -55463,8 +55651,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -55483,8 +55671,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -56117,8 +56305,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -56337,8 +56525,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -56434,7 +56622,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -56492,7 +56680,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -56527,7 +56719,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -56592,8 +56784,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -56625,8 +56817,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -56645,8 +56837,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -56665,8 +56857,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -57299,8 +57491,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -57519,8 +57711,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -57616,7 +57808,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -57674,7 +57866,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -57709,7 +57905,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -57774,8 +57970,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -57807,8 +58003,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -57827,8 +58023,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -57847,8 +58043,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -58481,8 +58677,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -58701,8 +58897,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -58798,7 +58994,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -58856,7 +59052,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -58891,7 +59091,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -58956,8 +59156,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -58989,8 +59189,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -59009,8 +59209,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -59029,8 +59229,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -59663,8 +59863,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -59883,8 +60083,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -59980,7 +60180,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -60038,7 +60238,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -60073,7 +60277,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -60138,8 +60342,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -60171,8 +60375,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -60191,8 +60395,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -60211,8 +60415,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -60845,8 +61049,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -61065,8 +61269,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -61162,7 +61366,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -61220,7 +61424,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -61255,7 +61463,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -61320,8 +61528,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -61353,8 +61561,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -61373,8 +61581,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -61393,8 +61601,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -62027,8 +62235,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -62247,8 +62455,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -62344,7 +62552,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -62402,7 +62610,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -62437,7 +62649,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -62502,8 +62714,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -62535,8 +62747,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -62555,8 +62767,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -62575,8 +62787,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -63209,8 +63421,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -63429,8 +63641,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -63526,7 +63738,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -63584,7 +63796,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -63619,7 +63835,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -63684,8 +63900,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -63717,8 +63933,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -63737,8 +63953,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -63757,8 +63973,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -64391,8 +64607,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -64611,8 +64827,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -64708,7 +64924,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -64766,7 +64982,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -64801,7 +65021,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -64866,8 +65086,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -64899,8 +65119,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -64919,8 +65139,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -64939,8 +65159,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -65573,8 +65793,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -65793,8 +66013,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -65890,7 +66110,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -65948,7 +66168,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -65983,7 +66207,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -66048,8 +66272,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -66081,8 +66305,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -66101,8 +66325,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -66121,8 +66345,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -66755,8 +66979,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -66975,8 +67199,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -67072,7 +67296,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -67130,7 +67354,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -67165,7 +67393,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -67230,8 +67458,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -67263,8 +67491,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -67283,8 +67511,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -67303,8 +67531,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -67937,8 +68165,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -68157,8 +68385,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -68254,7 +68482,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -68312,7 +68540,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -68347,7 +68579,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -68412,8 +68644,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -68445,8 +68677,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -68465,8 +68697,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -68485,8 +68717,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -69119,8 +69351,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -69339,8 +69571,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -69436,7 +69668,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -69494,7 +69726,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -69529,7 +69765,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -69594,8 +69830,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -69627,8 +69863,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -69647,8 +69883,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -69667,8 +69903,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -70301,8 +70537,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -70521,8 +70757,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -70618,7 +70854,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -70676,7 +70912,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -70711,7 +70951,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -70776,8 +71016,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -70809,8 +71049,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -70829,8 +71069,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -70849,8 +71089,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -71483,8 +71723,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -71703,8 +71943,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -71800,7 +72040,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -71858,7 +72098,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -71893,7 +72137,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -71958,8 +72202,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -71991,8 +72235,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -72011,8 +72255,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -72031,8 +72275,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -72665,8 +72909,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -72885,8 +73129,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -72982,7 +73226,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -73040,7 +73284,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -73075,7 +73323,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -73140,8 +73388,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -73173,8 +73421,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -73193,8 +73441,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -73213,8 +73461,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -73847,8 +74095,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -74067,8 +74315,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -74164,7 +74412,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -74222,7 +74470,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -74257,7 +74509,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -74322,8 +74574,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -74355,8 +74607,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -74375,8 +74627,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -74395,8 +74647,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -75029,8 +75281,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -75249,8 +75501,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -75346,7 +75598,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -75404,7 +75656,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -75439,7 +75695,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -75504,8 +75760,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -75537,8 +75793,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -75557,8 +75813,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -75577,8 +75833,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -76211,8 +76467,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -76431,8 +76687,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -76528,7 +76784,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -76586,7 +76842,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -76621,7 +76881,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -76686,8 +76946,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -76719,8 +76979,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -76739,8 +76999,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -76759,8 +77019,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -77393,8 +77653,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -77613,8 +77873,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -77710,7 +77970,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -77768,7 +78028,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -77803,7 +78067,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -77868,8 +78132,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -77901,8 +78165,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -77921,8 +78185,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -77941,8 +78205,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -78575,8 +78839,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -78795,8 +79059,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -78892,7 +79156,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -78950,7 +79214,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -78985,7 +79253,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -79050,8 +79318,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -79083,8 +79351,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -79103,8 +79371,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -79123,8 +79391,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -79757,8 +80025,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -79977,8 +80245,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -80074,7 +80342,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -80132,7 +80400,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -80167,7 +80439,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -80232,8 +80504,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -80265,8 +80537,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -80285,8 +80557,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -80305,8 +80577,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -80939,8 +81211,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -81159,8 +81431,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -81256,7 +81528,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -81314,7 +81586,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -81349,7 +81625,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -81414,8 +81690,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -81447,8 +81723,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -81467,8 +81743,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -81487,8 +81763,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -82121,8 +82397,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -82341,8 +82617,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -82438,7 +82714,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -82496,7 +82772,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -82531,7 +82811,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -82596,8 +82876,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -82629,8 +82909,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -82649,8 +82929,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -82669,8 +82949,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -83303,8 +83583,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -83523,8 +83803,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -83620,7 +83900,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -83678,7 +83958,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -83713,7 +83997,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -83778,8 +84062,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -83811,8 +84095,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -83831,8 +84115,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -83851,8 +84135,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -84485,8 +84769,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -84705,8 +84989,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -84802,7 +85086,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -84860,7 +85144,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -84895,7 +85183,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -84960,8 +85248,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -84993,8 +85281,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -85013,8 +85301,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -85033,8 +85321,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -85667,8 +85955,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -85887,8 +86175,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -85984,7 +86272,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -86042,7 +86330,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -86077,7 +86369,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -86142,8 +86434,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -86175,8 +86467,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -86195,8 +86487,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -86215,8 +86507,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -86849,8 +87141,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -87069,8 +87361,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -87166,7 +87458,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -87224,7 +87516,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -87259,7 +87555,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -87324,8 +87620,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -87357,8 +87653,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -87377,8 +87673,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -87397,8 +87693,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -88031,8 +88327,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -88251,8 +88547,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -88348,7 +88644,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -88406,7 +88702,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -88441,7 +88741,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -88506,8 +88806,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -88539,8 +88839,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -88559,8 +88859,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -88579,8 +88879,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -89213,8 +89513,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -89433,8 +89733,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -89530,7 +89830,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -89588,7 +89888,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -89623,7 +89927,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -89688,8 +89992,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -89721,8 +90025,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -89741,8 +90045,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -89761,8 +90065,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -90395,8 +90699,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -90615,8 +90919,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -90712,7 +91016,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -90770,7 +91074,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -90805,7 +91113,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -90870,8 +91178,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -90903,8 +91211,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -90923,8 +91231,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -90943,8 +91251,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -91577,8 +91885,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -91797,8 +92105,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -91894,7 +92202,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -91952,7 +92260,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -91987,7 +92299,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -92052,8 +92364,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -92085,8 +92397,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -92105,8 +92417,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -92125,8 +92437,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -92759,8 +93071,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -92979,8 +93291,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -93076,7 +93388,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -93134,7 +93446,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -93169,7 +93485,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -93234,8 +93550,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -93267,8 +93583,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -93287,8 +93603,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -93307,8 +93623,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -93941,8 +94257,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -94161,8 +94477,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -94258,7 +94574,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -94316,7 +94632,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -94351,7 +94671,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -94416,8 +94736,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -94449,8 +94769,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -94469,8 +94789,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -94489,8 +94809,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -95123,8 +95443,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -95343,8 +95663,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -95440,7 +95760,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -95498,7 +95818,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -95533,7 +95857,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -95598,8 +95922,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -95631,8 +95955,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -95651,8 +95975,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -95671,8 +95995,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -96305,8 +96629,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -96525,8 +96849,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -96622,7 +96946,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -96680,7 +97004,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -96715,7 +97043,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -96780,8 +97108,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -96813,8 +97141,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -96833,8 +97161,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -96853,8 +97181,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -97487,8 +97815,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -97707,8 +98035,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -97804,7 +98132,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -97862,7 +98190,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -97897,7 +98229,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -97962,8 +98294,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -97995,8 +98327,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -98015,8 +98347,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -98035,8 +98367,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -98669,8 +99001,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -98889,8 +99221,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -98986,7 +99318,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -99044,7 +99376,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -99079,7 +99415,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -99144,8 +99480,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -99177,8 +99513,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -99197,8 +99533,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -99217,8 +99553,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -99851,8 +100187,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -100071,8 +100407,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -100168,7 +100504,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -100226,7 +100562,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -100261,7 +100601,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -100326,8 +100666,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -100359,8 +100699,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -100379,8 +100719,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -100399,8 +100739,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -101033,8 +101373,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -101253,8 +101593,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -101350,7 +101690,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -101408,7 +101748,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -101443,7 +101787,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -101508,8 +101852,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -101541,8 +101885,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -101561,8 +101905,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -101581,8 +101925,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -102215,8 +102559,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -102435,8 +102779,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -102532,7 +102876,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -102590,7 +102934,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -102625,7 +102973,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -102690,8 +103038,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -102723,8 +103071,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -102743,8 +103091,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -102763,8 +103111,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -103397,8 +103745,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -103617,8 +103965,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -103714,7 +104062,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -103772,7 +104120,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -103807,7 +104159,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -103872,8 +104224,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -103905,8 +104257,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -103925,8 +104277,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -103945,8 +104297,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -104579,8 +104931,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -104799,8 +105151,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -104896,7 +105248,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -104954,7 +105306,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -104989,7 +105345,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -105054,8 +105410,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -105087,8 +105443,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -105107,8 +105463,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -105127,8 +105483,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -105761,8 +106117,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -105981,8 +106337,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -106078,7 +106434,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -106136,7 +106492,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -106171,7 +106531,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -106236,8 +106596,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -106269,8 +106629,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -106289,8 +106649,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -106309,8 +106669,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -106943,8 +107303,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -107163,8 +107523,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -107260,7 +107620,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -107318,7 +107678,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -107353,7 +107717,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -107418,8 +107782,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -107451,8 +107815,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -107471,8 +107835,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -107491,8 +107855,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -108125,8 +108489,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -108345,8 +108709,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -108442,7 +108806,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -108500,7 +108864,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -108535,7 +108903,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -108600,8 +108968,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -108633,8 +109001,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -108653,8 +109021,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -108673,8 +109041,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -109307,8 +109675,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -109527,8 +109895,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -109624,7 +109992,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -109682,7 +110050,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -109717,7 +110089,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -109782,8 +110154,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -109815,8 +110187,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -109835,8 +110207,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -109855,8 +110227,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -110489,8 +110861,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -110709,8 +111081,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -110806,7 +111178,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -110864,7 +111236,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -110899,7 +111275,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -110964,8 +111340,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -110997,8 +111373,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -111017,8 +111393,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -111037,8 +111413,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -111671,8 +112047,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -111891,8 +112267,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -111988,7 +112364,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -112046,7 +112422,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -112081,7 +112461,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -112146,8 +112526,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -112179,8 +112559,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -112199,8 +112579,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -112219,8 +112599,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -112853,8 +113233,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -113073,8 +113453,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -113170,7 +113550,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -113228,7 +113608,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -113263,7 +113647,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -113328,8 +113712,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -113361,8 +113745,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -113381,8 +113765,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -113401,8 +113785,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -114035,8 +114419,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -114255,8 +114639,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -114352,7 +114736,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -114410,7 +114794,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -114445,7 +114833,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -114510,8 +114898,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -114543,8 +114931,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -114563,8 +114951,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -114583,8 +114971,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -115217,8 +115605,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -115437,8 +115825,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -115534,7 +115922,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -115592,7 +115980,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -115627,7 +116019,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -115692,8 +116084,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -115725,8 +116117,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -115745,8 +116137,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -115765,8 +116157,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -116399,8 +116791,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -116619,8 +117011,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -116716,7 +117108,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -116774,7 +117166,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -116809,7 +117205,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -116874,8 +117270,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -116907,8 +117303,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -116927,8 +117323,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -116947,8 +117343,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -117581,8 +117977,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -117801,8 +118197,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -117898,7 +118294,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -117956,7 +118352,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -117991,7 +118391,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -118056,8 +118456,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -118089,8 +118489,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -118109,8 +118509,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -118129,8 +118529,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -118763,8 +119163,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -118983,8 +119383,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -119080,7 +119480,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -119138,7 +119538,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -119173,7 +119577,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -119238,8 +119642,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -119271,8 +119675,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -119291,8 +119695,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -119311,8 +119715,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -119945,8 +120349,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -120165,8 +120569,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -120262,7 +120666,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -120320,7 +120724,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -120355,7 +120763,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -120420,8 +120828,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -120453,8 +120861,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -120473,8 +120881,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -120493,8 +120901,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -121127,8 +121535,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -121347,8 +121755,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -121444,7 +121852,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -121502,7 +121910,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -121537,7 +121949,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -121602,8 +122014,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -121635,8 +122047,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -121655,8 +122067,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -121675,8 +122087,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -122309,8 +122721,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -122529,8 +122941,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -122626,7 +123038,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -122684,7 +123096,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -122719,7 +123135,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -122784,8 +123200,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -122817,8 +123233,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -122837,8 +123253,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -122857,8 +123273,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -123491,8 +123907,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -123711,8 +124127,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -123808,7 +124224,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -123866,7 +124282,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -123901,7 +124321,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -123966,8 +124386,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -123999,8 +124419,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -124019,8 +124439,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -124039,8 +124459,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -124673,8 +125093,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -124893,8 +125313,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -124990,7 +125410,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -125048,7 +125468,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -125083,7 +125507,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -125148,8 +125572,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -125181,8 +125605,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -125201,8 +125625,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -125221,8 +125645,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -125855,8 +126279,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -126075,8 +126499,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -126172,7 +126596,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -126230,7 +126654,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -126265,7 +126693,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -126330,8 +126758,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -126363,8 +126791,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -126383,8 +126811,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -126403,8 +126831,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -127037,8 +127465,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -127257,8 +127685,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -127354,7 +127782,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -127412,7 +127840,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -127447,7 +127879,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -127512,8 +127944,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -127545,8 +127977,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -127565,8 +127997,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -127585,8 +128017,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -128219,8 +128651,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -128439,8 +128871,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -128536,7 +128968,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -128594,7 +129026,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -128629,7 +129065,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -128694,8 +129130,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -128727,8 +129163,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -128747,8 +129183,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -128767,8 +129203,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -129401,8 +129837,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -129621,8 +130057,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -129718,7 +130154,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -129776,7 +130212,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -129811,7 +130251,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -129876,8 +130316,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -129909,8 +130349,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -129929,8 +130369,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -129949,8 +130389,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -130583,8 +131023,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -130803,8 +131243,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -130900,7 +131340,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -130958,7 +131398,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -130993,7 +131437,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -131058,8 +131502,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -131091,8 +131535,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -131111,8 +131555,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -131131,8 +131575,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -131765,8 +132209,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -131985,8 +132429,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -132082,7 +132526,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -132140,7 +132584,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -132175,7 +132623,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -132240,8 +132688,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -132273,8 +132721,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -132293,8 +132741,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -132313,8 +132761,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -132947,8 +133395,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -133167,8 +133615,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -133264,7 +133712,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -133322,7 +133770,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -133357,7 +133809,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -133422,8 +133874,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -133455,8 +133907,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -133475,8 +133927,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -133495,8 +133947,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -134129,8 +134581,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -134349,8 +134801,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -134446,7 +134898,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -134504,7 +134956,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -134539,7 +134995,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -134604,8 +135060,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -134637,8 +135093,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -134657,8 +135113,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -134677,8 +135133,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -135311,8 +135767,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -135531,8 +135987,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -135628,7 +136084,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -135686,7 +136142,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -135721,7 +136181,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -135786,8 +136246,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -135819,8 +136279,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -135839,8 +136299,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -135859,8 +136319,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -136493,8 +136953,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -136713,8 +137173,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -136810,7 +137270,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -136868,7 +137328,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -136903,7 +137367,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -136968,8 +137432,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -137001,8 +137465,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -137021,8 +137485,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -137041,8 +137505,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -137675,8 +138139,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -137895,8 +138359,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -137992,7 +138456,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -138050,7 +138514,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -138085,7 +138553,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -138150,8 +138618,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -138183,8 +138651,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -138203,8 +138671,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -138223,8 +138691,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -138857,8 +139325,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -139077,8 +139545,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -139174,7 +139642,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -139232,7 +139700,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -139267,7 +139739,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -139332,8 +139804,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -139365,8 +139837,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -139385,8 +139857,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -139405,8 +139877,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -140039,8 +140511,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -140259,8 +140731,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -140356,7 +140828,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -140414,7 +140886,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -140449,7 +140925,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -140514,8 +140990,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -140547,8 +141023,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -140567,8 +141043,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -140587,8 +141063,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -141221,8 +141697,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -141441,8 +141917,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -141538,7 +142014,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -141596,7 +142072,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -141631,7 +142111,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -141696,8 +142176,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -141729,8 +142209,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -141749,8 +142229,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -141769,8 +142249,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -142403,8 +142883,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -142623,8 +143103,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -142720,7 +143200,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -142778,7 +143258,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -142813,7 +143297,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -142878,8 +143362,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -142911,8 +143395,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -142931,8 +143415,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -142951,8 +143435,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -143585,8 +144069,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -143805,8 +144289,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -143902,7 +144386,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -143960,7 +144444,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -143995,7 +144483,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -144060,8 +144548,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -144093,8 +144581,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -144113,8 +144601,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -144133,8 +144621,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -144767,8 +145255,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -144987,8 +145475,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -145084,7 +145572,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -145142,7 +145630,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -145177,7 +145669,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -145242,8 +145734,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -145275,8 +145767,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -145295,8 +145787,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -145315,8 +145807,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -145949,8 +146441,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -146169,8 +146661,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -146266,7 +146758,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -146324,7 +146816,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -146359,7 +146855,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -146424,8 +146920,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -146457,8 +146953,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -146477,8 +146973,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -146497,8 +146993,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -147131,8 +147627,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -147351,8 +147847,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -147448,7 +147944,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -147506,7 +148002,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -147541,7 +148041,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -147606,8 +148106,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -147639,8 +148139,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -147659,8 +148159,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -147679,8 +148179,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -148313,8 +148813,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -148533,8 +149033,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -148630,7 +149130,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -148688,7 +149188,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -148723,7 +149227,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -148788,8 +149292,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -148821,8 +149325,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -148841,8 +149345,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -148861,8 +149365,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -149495,8 +149999,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -149715,8 +150219,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -149812,7 +150316,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -149870,7 +150374,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -149905,7 +150413,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -149970,8 +150478,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -150003,8 +150511,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -150023,8 +150531,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -150043,8 +150551,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -150677,8 +151185,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -150897,8 +151405,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -150994,7 +151502,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -151052,7 +151560,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -151087,7 +151599,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -151152,8 +151664,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -151185,8 +151697,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -151205,8 +151717,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -151225,8 +151737,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -151859,8 +152371,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -152079,8 +152591,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -152176,7 +152688,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -152234,7 +152746,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -152269,7 +152785,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -152334,8 +152850,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -152367,8 +152883,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -152387,8 +152903,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -152407,8 +152923,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -153041,8 +153557,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -153261,8 +153777,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -153358,7 +153874,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -153416,7 +153932,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -153451,7 +153971,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -153516,8 +154036,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -153549,8 +154069,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -153569,8 +154089,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -153589,8 +154109,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -154223,8 +154743,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -154443,8 +154963,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -154540,7 +155060,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -154598,7 +155118,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -154633,7 +155157,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -154698,8 +155222,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -154731,8 +155255,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -154751,8 +155275,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -154771,8 +155295,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -155405,8 +155929,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -155625,8 +156149,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -155722,7 +156246,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -155780,7 +156304,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -155815,7 +156343,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -155880,8 +156408,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -155913,8 +156441,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -155933,8 +156461,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -155953,8 +156481,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -156587,8 +157115,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -156807,8 +157335,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -156904,7 +157432,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -156962,7 +157490,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -156997,7 +157529,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -157062,8 +157594,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -157095,8 +157627,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -157115,8 +157647,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -157135,8 +157667,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -157769,8 +158301,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -157989,8 +158521,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -158086,7 +158618,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -158144,7 +158676,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -158179,7 +158715,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -158244,8 +158780,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -158277,8 +158813,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -158297,8 +158833,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -158317,8 +158853,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -158951,8 +159487,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -159171,8 +159707,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -159268,7 +159804,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -159326,7 +159862,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -159361,7 +159901,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -159426,8 +159966,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -159459,8 +159999,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -159479,8 +160019,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -159499,8 +160039,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -160133,8 +160673,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -160353,8 +160893,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -160450,7 +160990,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -160508,7 +161048,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -160543,7 +161087,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -160608,8 +161152,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -160641,8 +161185,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -160661,8 +161205,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -160681,8 +161225,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -161315,8 +161859,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -161535,8 +162079,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -161632,7 +162176,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -161690,7 +162234,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -161725,7 +162273,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -161790,8 +162338,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -161823,8 +162371,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -161843,8 +162391,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -161863,8 +162411,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -162497,8 +163045,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -162717,8 +163265,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -162814,7 +163362,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -162872,7 +163420,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -162907,7 +163459,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -162972,8 +163524,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -163005,8 +163557,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -163025,8 +163577,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -163045,8 +163597,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -163679,8 +164231,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -163899,8 +164451,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -163996,7 +164548,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -164054,7 +164606,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -164089,7 +164645,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -164154,8 +164710,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -164187,8 +164743,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -164207,8 +164763,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -164227,8 +164783,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -164861,8 +165417,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -165081,8 +165637,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -165178,7 +165734,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -165236,7 +165792,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -165271,7 +165831,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -165336,8 +165896,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -165369,8 +165929,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -165389,8 +165949,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -165409,8 +165969,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -166043,8 +166603,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -166263,8 +166823,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -166360,7 +166920,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -166418,7 +166978,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -166453,7 +167017,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -166518,8 +167082,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -166551,8 +167115,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -166571,8 +167135,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -166591,8 +167155,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -167225,8 +167789,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -167445,8 +168009,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -167542,7 +168106,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -167600,7 +168164,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -167635,7 +168203,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -167700,8 +168268,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -167733,8 +168301,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -167753,8 +168321,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -167773,8 +168341,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -168407,8 +168975,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -168627,8 +169195,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -168724,7 +169292,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -168782,7 +169350,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -168817,7 +169389,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -168882,8 +169454,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -168915,8 +169487,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -168935,8 +169507,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -168955,8 +169527,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -169589,8 +170161,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -169809,8 +170381,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -169906,7 +170478,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -169964,7 +170536,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -169999,7 +170575,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -170064,8 +170640,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -170097,8 +170673,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -170117,8 +170693,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -170137,8 +170713,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -170771,8 +171347,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -170991,8 +171567,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -171088,7 +171664,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -171146,7 +171722,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -171181,7 +171761,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -171246,8 +171826,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -171279,8 +171859,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -171299,8 +171879,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -171319,8 +171899,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -171953,8 +172533,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -172173,8 +172753,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -172270,7 +172850,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -172328,7 +172908,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -172363,7 +172947,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -172428,8 +173012,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -172461,8 +173045,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -172481,8 +173065,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -172501,8 +173085,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -173135,8 +173719,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -173355,8 +173939,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -173452,7 +174036,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -173510,7 +174094,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -173545,7 +174133,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -173610,8 +174198,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -173643,8 +174231,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -173663,8 +174251,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -173683,8 +174271,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -174317,8 +174905,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -174537,8 +175125,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -174634,7 +175222,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -174692,7 +175280,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -174727,7 +175319,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -174792,8 +175384,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -174825,8 +175417,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -174845,8 +175437,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -174865,8 +175457,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -175499,8 +176091,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -175719,8 +176311,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -175816,7 +176408,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -175874,7 +176466,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -175909,7 +176505,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -175974,8 +176570,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -176007,8 +176603,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -176027,8 +176623,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -176047,8 +176643,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -176681,8 +177277,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -176901,8 +177497,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -176998,7 +177594,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -177056,7 +177652,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -177091,7 +177691,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -177156,8 +177756,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -177189,8 +177789,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -177209,8 +177809,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -177229,8 +177829,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -177863,8 +178463,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -178083,8 +178683,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -178180,7 +178780,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -178238,7 +178838,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -178273,7 +178877,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -178338,8 +178942,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -178371,8 +178975,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -178391,8 +178995,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -178411,8 +179015,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -179045,8 +179649,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -179265,8 +179869,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -179362,7 +179966,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -179420,7 +180024,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -179455,7 +180063,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -179520,8 +180128,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -179553,8 +180161,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -179573,8 +180181,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -179593,8 +180201,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -180227,8 +180835,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -180447,8 +181055,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -180544,7 +181152,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -180602,7 +181210,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -180637,7 +181249,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -180702,8 +181314,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -180735,8 +181347,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -180755,8 +181367,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -180775,8 +181387,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -181409,8 +182021,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -181629,8 +182241,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -181726,7 +182338,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -181784,7 +182396,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -181819,7 +182435,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -181884,8 +182500,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -181917,8 +182533,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -181937,8 +182553,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -181957,8 +182573,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -182591,8 +183207,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -182811,8 +183427,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -182908,7 +183524,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -182966,7 +183582,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -183001,7 +183621,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -183066,8 +183686,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -183099,8 +183719,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -183119,8 +183739,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -183139,8 +183759,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -183773,8 +184393,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -183993,8 +184613,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -184090,7 +184710,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -184148,7 +184768,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -184183,7 +184807,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -184248,8 +184872,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -184281,8 +184905,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -184301,8 +184925,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -184321,8 +184945,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -184955,8 +185579,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -185175,8 +185799,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -185272,7 +185896,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -185330,7 +185954,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -185365,7 +185993,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -185430,8 +186058,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -185463,8 +186091,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -185483,8 +186111,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -185503,8 +186131,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -186137,8 +186765,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -186357,8 +186985,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -186454,7 +187082,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -186512,7 +187140,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -186547,7 +187179,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -186612,8 +187244,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -186645,8 +187277,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -186665,8 +187297,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -186685,8 +187317,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -187319,8 +187951,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -187539,8 +188171,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -187636,7 +188268,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -187694,7 +188326,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -187729,7 +188365,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -187794,8 +188430,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -187827,8 +188463,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -187847,8 +188483,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -187867,8 +188503,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -188501,8 +189137,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -188721,8 +189357,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -188818,7 +189454,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -188876,7 +189512,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -188911,7 +189551,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -188976,8 +189616,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -189009,8 +189649,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -189029,8 +189669,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -189049,8 +189689,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -189683,8 +190323,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -189903,8 +190543,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -190000,7 +190640,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -190058,7 +190698,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -190093,7 +190737,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -190158,8 +190802,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -190191,8 +190835,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -190211,8 +190855,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -190231,8 +190875,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -190865,8 +191509,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -191085,8 +191729,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -191182,7 +191826,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -191240,7 +191884,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -191275,7 +191923,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -191340,8 +191988,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -191373,8 +192021,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -191393,8 +192041,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -191413,8 +192061,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -192047,8 +192695,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -192267,8 +192915,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -192364,7 +193012,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -192422,7 +193070,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -192457,7 +193109,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -192522,8 +193174,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -192555,8 +193207,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -192575,8 +193227,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -192595,8 +193247,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -193229,8 +193881,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -193449,8 +194101,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -193546,7 +194198,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -193604,7 +194256,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -193639,7 +194295,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -193704,8 +194360,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -193737,8 +194393,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -193757,8 +194413,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -193777,8 +194433,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -194411,8 +195067,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -194631,8 +195287,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -194728,7 +195384,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -194786,7 +195442,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -194821,7 +195481,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -194886,8 +195546,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -194919,8 +195579,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -194939,8 +195599,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -194959,8 +195619,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -195593,8 +196253,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -195813,8 +196473,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -195910,7 +196570,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -195968,7 +196628,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -196003,7 +196667,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -196068,8 +196732,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -196101,8 +196765,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -196121,8 +196785,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -196141,8 +196805,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -196775,8 +197439,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -196995,8 +197659,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -197092,7 +197756,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -197150,7 +197814,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -197185,7 +197853,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -197250,8 +197918,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -197283,8 +197951,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -197303,8 +197971,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -197323,8 +197991,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -197957,8 +198625,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -198177,8 +198845,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -198274,7 +198942,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -198332,7 +199000,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -198367,7 +199039,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -198432,8 +199104,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -198465,8 +199137,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -198485,8 +199157,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -198505,8 +199177,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -199139,8 +199811,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -199359,8 +200031,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -199456,7 +200128,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -199514,7 +200186,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -199549,7 +200225,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -199614,8 +200290,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -199647,8 +200323,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -199667,8 +200343,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -199687,8 +200363,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -200321,8 +200997,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -200541,8 +201217,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -200638,7 +201314,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -200696,7 +201372,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -200731,7 +201411,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -200796,8 +201476,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -200829,8 +201509,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -200849,8 +201529,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -200869,8 +201549,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -201503,8 +202183,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -201723,8 +202403,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -201820,7 +202500,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -201878,7 +202558,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -201913,7 +202597,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -201978,8 +202662,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -202011,8 +202695,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -202031,8 +202715,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -202051,8 +202735,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -202685,8 +203369,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -202905,8 +203589,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -203002,7 +203686,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -203060,7 +203744,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -203095,7 +203783,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -203160,8 +203848,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -203193,8 +203881,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -203213,8 +203901,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -203233,8 +203921,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -203867,8 +204555,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -204087,8 +204775,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -204184,7 +204872,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -204242,7 +204930,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -204277,7 +204969,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -204342,8 +205034,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -204375,8 +205067,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -204395,8 +205087,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -204415,8 +205107,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -205049,8 +205741,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -205269,8 +205961,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -205366,7 +206058,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -205424,7 +206116,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -205459,7 +206155,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -205524,8 +206220,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -205557,8 +206253,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -205577,8 +206273,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -205597,8 +206293,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -206231,8 +206927,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -206451,8 +207147,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -206548,7 +207244,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -206606,7 +207302,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -206641,7 +207341,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -206706,8 +207406,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -206739,8 +207439,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -206759,8 +207459,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -206779,8 +207479,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -207413,8 +208113,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -207633,8 +208333,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -207730,7 +208430,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -207788,7 +208488,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -207823,7 +208527,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -207888,8 +208592,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -207921,8 +208625,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -207941,8 +208645,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -207961,8 +208665,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -208595,8 +209299,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -208815,8 +209519,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -208912,7 +209616,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -208970,7 +209674,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -209005,7 +209713,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -209070,8 +209778,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -209103,8 +209811,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -209123,8 +209831,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -209143,8 +209851,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -209777,8 +210485,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -209997,8 +210705,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -210094,7 +210802,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -210152,7 +210860,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -210187,7 +210899,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -210252,8 +210964,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -210285,8 +210997,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -210305,8 +211017,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -210325,8 +211037,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -210959,8 +211671,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -211179,8 +211891,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -211276,7 +211988,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -211334,7 +212046,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -211369,7 +212085,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -211434,8 +212150,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -211467,8 +212183,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -211487,8 +212203,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -211507,8 +212223,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -212141,8 +212857,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -212361,8 +213077,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -212458,7 +213174,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -212516,7 +213232,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -212551,7 +213271,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -212616,8 +213336,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -212649,8 +213369,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -212669,8 +213389,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -212689,8 +213409,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -213323,8 +214043,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -213543,8 +214263,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -213640,7 +214360,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -213698,7 +214418,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -213733,7 +214457,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -213798,8 +214522,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -213831,8 +214555,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -213851,8 +214575,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -213871,8 +214595,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -214505,8 +215229,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -214725,8 +215449,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -214822,7 +215546,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -214880,7 +215604,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -214915,7 +215643,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -214980,8 +215708,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -215013,8 +215741,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -215033,8 +215761,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -215053,8 +215781,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -215687,8 +216415,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -215907,8 +216635,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -216004,7 +216732,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -216062,7 +216790,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -216097,7 +216829,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -216162,8 +216894,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -216195,8 +216927,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -216215,8 +216947,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -216235,8 +216967,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -216869,8 +217601,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -217089,8 +217821,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -217186,7 +217918,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -217244,7 +217976,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -217279,7 +218015,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -217344,8 +218080,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -217377,8 +218113,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -217397,8 +218133,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -217417,8 +218153,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -218051,8 +218787,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -218271,8 +219007,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -218368,7 +219104,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -218426,7 +219162,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -218461,7 +219201,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -218526,8 +219266,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -218559,8 +219299,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -218579,8 +219319,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -218599,8 +219339,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -219233,8 +219973,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -219453,8 +220193,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -219550,7 +220290,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -219608,7 +220348,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -219643,7 +220387,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -219708,8 +220452,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -219741,8 +220485,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -219761,8 +220505,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -219781,8 +220525,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -220415,8 +221159,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -220635,8 +221379,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -220732,7 +221476,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -220790,7 +221534,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -220825,7 +221573,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -220890,8 +221638,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -220923,8 +221671,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -220943,8 +221691,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -220963,8 +221711,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -221597,8 +222345,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -221817,8 +222565,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -221914,7 +222662,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -221972,7 +222720,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -222007,7 +222759,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -222072,8 +222824,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -222105,8 +222857,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -222125,8 +222877,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -222145,8 +222897,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -222779,8 +223531,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -222999,8 +223751,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -223096,7 +223848,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -223154,7 +223906,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -223189,7 +223945,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -223254,8 +224010,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -223287,8 +224043,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -223307,8 +224063,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -223327,8 +224083,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -223961,8 +224717,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -224181,8 +224937,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -224278,7 +225034,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -224336,7 +225092,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -224371,7 +225131,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -224436,8 +225196,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -224469,8 +225229,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -224489,8 +225249,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -224509,8 +225269,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -225143,8 +225903,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -225363,8 +226123,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -225460,7 +226220,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -225518,7 +226278,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -225553,7 +226317,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -225618,8 +226382,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -225651,8 +226415,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -225671,8 +226435,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -225691,8 +226455,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -226325,8 +227089,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -226545,8 +227309,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -226642,7 +227406,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -226700,7 +227464,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -226735,7 +227503,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -226800,8 +227568,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -226833,8 +227601,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -226853,8 +227621,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -226873,8 +227641,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -227507,8 +228275,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -227727,8 +228495,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -227824,7 +228592,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -227882,7 +228650,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -227917,7 +228689,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -227982,8 +228754,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -228015,8 +228787,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -228035,8 +228807,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -228055,8 +228827,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -228689,8 +229461,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -228909,8 +229681,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -229006,7 +229778,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -229064,7 +229836,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -229099,7 +229875,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -229164,8 +229940,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -229197,8 +229973,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -229217,8 +229993,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -229237,8 +230013,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -229871,8 +230647,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -230091,8 +230867,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -230188,7 +230964,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -230246,7 +231022,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -230281,7 +231061,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -230346,8 +231126,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -230379,8 +231159,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -230399,8 +231179,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -230419,8 +231199,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -231053,8 +231833,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -231273,8 +232053,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -231370,7 +232150,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -231428,7 +232208,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -231463,7 +232247,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -231528,8 +232312,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -231561,8 +232345,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -231581,8 +232365,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -231601,8 +232385,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -232235,8 +233019,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -232455,8 +233239,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -232552,7 +233336,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -232610,7 +233394,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -232645,7 +233433,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -232710,8 +233498,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -232743,8 +233531,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -232763,8 +233551,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -232783,8 +233571,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -233417,8 +234205,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -233637,8 +234425,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -233734,7 +234522,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -233792,7 +234580,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -233827,7 +234619,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -233892,8 +234684,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -233925,8 +234717,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -233945,8 +234737,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -233965,8 +234757,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -234599,8 +235391,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -234819,8 +235611,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -234916,7 +235708,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -234974,7 +235766,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -235009,7 +235805,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -235074,8 +235870,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -235107,8 +235903,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -235127,8 +235923,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -235147,8 +235943,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -235781,8 +236577,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -236001,8 +236797,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -236098,7 +236894,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -236156,7 +236952,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -236191,7 +236991,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -236256,8 +237056,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -236289,8 +237089,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -236309,8 +237109,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -236329,8 +237129,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -236963,8 +237763,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -237183,8 +237983,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -237280,7 +238080,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -237338,7 +238138,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -237373,7 +238177,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -237438,8 +238242,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -237471,8 +238275,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -237491,8 +238295,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -237511,8 +238315,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -238145,8 +238949,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -238365,8 +239169,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -238462,7 +239266,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -238520,7 +239324,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -238555,7 +239363,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -238620,8 +239428,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -238653,8 +239461,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -238673,8 +239481,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -238693,8 +239501,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -239327,8 +240135,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -239547,8 +240355,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -239644,7 +240452,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -239702,7 +240510,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -239737,7 +240549,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -239802,8 +240614,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -239835,8 +240647,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -239855,8 +240667,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -239875,8 +240687,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -240509,8 +241321,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -240729,8 +241541,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -240826,7 +241638,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -240884,7 +241696,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -240919,7 +241735,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -240984,8 +241800,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -241017,8 +241833,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -241037,8 +241853,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -241057,8 +241873,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -241691,8 +242507,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -241911,8 +242727,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -242008,7 +242824,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -242066,7 +242882,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -242101,7 +242921,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -242166,8 +242986,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -242199,8 +243019,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -242219,8 +243039,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -242239,8 +243059,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -242873,8 +243693,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -243093,8 +243913,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -243190,7 +244010,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -243248,7 +244068,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -243283,7 +244107,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -243348,8 +244172,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -243381,8 +244205,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -243401,8 +244225,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -243421,8 +244245,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -244055,8 +244879,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -244275,8 +245099,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -244372,7 +245196,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -244430,7 +245254,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -244465,7 +245293,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -244530,8 +245358,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -244563,8 +245391,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -244583,8 +245411,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -244603,8 +245431,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -245237,8 +246065,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -245457,8 +246285,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -245554,7 +246382,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -245612,7 +246440,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -245647,7 +246479,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -245712,8 +246544,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -245745,8 +246577,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -245765,8 +246597,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -245785,8 +246617,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -246419,8 +247251,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -246639,8 +247471,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -246736,7 +247568,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -246794,7 +247626,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -246829,7 +247665,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -246894,8 +247730,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -246927,8 +247763,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -246947,8 +247783,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -246967,8 +247803,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -247601,8 +248437,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -247821,8 +248657,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -247918,7 +248754,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -247976,7 +248812,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -248011,7 +248851,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -248076,8 +248916,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -248109,8 +248949,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -248129,8 +248969,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -248149,8 +248989,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -248783,8 +249623,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -249003,8 +249843,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -249100,7 +249940,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -249158,7 +249998,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -249193,7 +250037,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -249258,8 +250102,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -249291,8 +250135,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -249311,8 +250155,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -249331,8 +250175,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -249965,8 +250809,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -250185,8 +251029,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -250282,7 +251126,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -250340,7 +251184,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -250375,7 +251223,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -250440,8 +251288,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -250473,8 +251321,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -250493,8 +251341,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -250513,8 +251361,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -251147,8 +251995,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -251367,8 +252215,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -251464,7 +252312,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -251522,7 +252370,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -251557,7 +252409,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -251622,8 +252474,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -251655,8 +252507,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -251675,8 +252527,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -251695,8 +252547,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -252329,8 +253181,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -252549,8 +253401,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -252646,7 +253498,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -252704,7 +253556,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -252739,7 +253595,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -252804,8 +253660,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -252837,8 +253693,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -252857,8 +253713,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -252877,8 +253733,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -253511,8 +254367,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -253731,8 +254587,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -253828,7 +254684,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -253886,7 +254742,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -253921,7 +254781,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -253986,8 +254846,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -254019,8 +254879,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -254039,8 +254899,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -254059,8 +254919,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -254693,8 +255553,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -254913,8 +255773,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -255010,7 +255870,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -255068,7 +255928,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -255103,7 +255967,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -255168,8 +256032,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -255201,8 +256065,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -255221,8 +256085,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -255241,8 +256105,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -255875,8 +256739,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -256095,8 +256959,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -256192,7 +257056,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -256250,7 +257114,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -256285,7 +257153,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -256350,8 +257218,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -256383,8 +257251,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -256403,8 +257271,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -256423,8 +257291,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -257057,8 +257925,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -257277,8 +258145,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -257374,7 +258242,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -257432,7 +258300,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -257467,7 +258339,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -257532,8 +258404,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -257565,8 +258437,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -257585,8 +258457,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -257605,8 +258477,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -258239,8 +259111,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -258459,8 +259331,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -258556,7 +259428,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -258614,7 +259486,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -258649,7 +259525,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -258714,8 +259590,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -258747,8 +259623,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -258767,8 +259643,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -258787,8 +259663,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -259421,8 +260297,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -259641,8 +260517,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -259738,7 +260614,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -259796,7 +260672,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -259831,7 +260711,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -259896,8 +260776,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -259929,8 +260809,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -259949,8 +260829,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -259969,8 +260849,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -260603,8 +261483,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -260823,8 +261703,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -260920,7 +261800,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -260978,7 +261858,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -261013,7 +261897,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -261078,8 +261962,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -261111,8 +261995,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -261131,8 +262015,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -261151,8 +262035,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -261785,8 +262669,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -262005,8 +262889,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -262102,7 +262986,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -262160,7 +263044,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -262195,7 +263083,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -262260,8 +263148,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -262293,8 +263181,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -262313,8 +263201,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -262333,8 +263221,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -262967,8 +263855,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -263187,8 +264075,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -263284,7 +264172,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -263342,7 +264230,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -263377,7 +264269,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -263442,8 +264334,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -263475,8 +264367,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -263495,8 +264387,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -263515,8 +264407,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -264149,8 +265041,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -264369,8 +265261,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -264466,7 +265358,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -264524,7 +265416,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -264559,7 +265455,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -264624,8 +265520,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -264657,8 +265553,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -264677,8 +265573,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -264697,8 +265593,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -265331,8 +266227,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -265551,8 +266447,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -265648,7 +266544,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -265706,7 +266602,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -265741,7 +266641,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -265806,8 +266706,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -265839,8 +266739,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -265859,8 +266759,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -265879,8 +266779,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -266513,8 +267413,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -266733,8 +267633,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -266830,7 +267730,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -266888,7 +267788,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -266923,7 +267827,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -266988,8 +267892,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -267021,8 +267925,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -267041,8 +267945,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -267061,8 +267965,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -267695,8 +268599,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -267915,8 +268819,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -268012,7 +268916,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -268070,7 +268974,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -268105,7 +269013,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -268170,8 +269078,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -268203,8 +269111,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -268223,8 +269131,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -268243,8 +269151,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -268877,8 +269785,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -269097,8 +270005,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -269194,7 +270102,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -269252,7 +270160,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -269287,7 +270199,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -269352,8 +270264,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -269385,8 +270297,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -269405,8 +270317,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -269425,8 +270337,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -270059,8 +270971,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -270279,8 +271191,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -270376,7 +271288,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -270434,7 +271346,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -270469,7 +271385,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -270534,8 +271450,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -270567,8 +271483,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -270587,8 +271503,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -270607,8 +271523,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -271241,8 +272157,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -271461,8 +272377,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -271558,7 +272474,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -271616,7 +272532,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -271651,7 +272571,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -271716,8 +272636,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -271749,8 +272669,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -271769,8 +272689,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -271789,8 +272709,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -272423,8 +273343,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -272643,8 +273563,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -272740,7 +273660,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -272798,7 +273718,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -272833,7 +273757,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -272898,8 +273822,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -272931,8 +273855,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -272951,8 +273875,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -272971,8 +273895,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -273605,8 +274529,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -273825,8 +274749,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -273922,7 +274846,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -273980,7 +274904,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -274015,7 +274943,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -274080,8 +275008,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -274113,8 +275041,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -274133,8 +275061,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -274153,8 +275081,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -274787,8 +275715,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -275007,8 +275935,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -275104,7 +276032,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -275162,7 +276090,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -275197,7 +276129,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -275262,8 +276194,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -275295,8 +276227,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -275315,8 +276247,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -275335,8 +276267,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -275969,8 +276901,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -276189,8 +277121,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -276286,7 +277218,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -276344,7 +277276,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -276379,7 +277315,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -276444,8 +277380,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -276477,8 +277413,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -276497,8 +277433,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -276517,8 +277453,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -277151,8 +278087,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -277371,8 +278307,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -277468,7 +278404,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -277526,7 +278462,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -277561,7 +278501,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -277626,8 +278566,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -277659,8 +278599,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -277679,8 +278619,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -277699,8 +278639,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -278333,8 +279273,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -278553,8 +279493,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -278650,7 +279590,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -278708,7 +279648,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -278743,7 +279687,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -278808,8 +279752,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -278841,8 +279785,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -278861,8 +279805,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -278881,8 +279825,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -279515,8 +280459,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -279735,8 +280679,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -279832,7 +280776,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -279890,7 +280834,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -279925,7 +280873,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -279990,8 +280938,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -280023,8 +280971,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -280043,8 +280991,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -280063,8 +281011,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -280697,8 +281645,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -280917,8 +281865,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -281014,7 +281962,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -281072,7 +282020,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -281107,7 +282059,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -281172,8 +282124,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -281205,8 +282157,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -281225,8 +282177,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -281245,8 +282197,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -281879,8 +282831,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -282099,8 +283051,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -282196,7 +283148,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -282254,7 +283206,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -282289,7 +283245,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -282354,8 +283310,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -282387,8 +283343,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -282407,8 +283363,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -282427,8 +283383,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -283061,8 +284017,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -283281,8 +284237,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -283378,7 +284334,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -283436,7 +284392,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -283471,7 +284431,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -283536,8 +284496,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -283569,8 +284529,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -283589,8 +284549,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -283609,8 +284569,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -284243,8 +285203,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -284463,8 +285423,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -284560,7 +285520,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -284618,7 +285578,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -284653,7 +285617,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -284718,8 +285682,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -284751,8 +285715,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -284771,8 +285735,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -284791,8 +285755,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -285425,8 +286389,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -285645,8 +286609,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -285742,7 +286706,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -285800,7 +286764,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -285835,7 +286803,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -285900,8 +286868,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -285933,8 +286901,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -285953,8 +286921,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -285973,8 +286941,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -286607,8 +287575,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -286827,8 +287795,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -286924,7 +287892,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -286982,7 +287950,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -287017,7 +287989,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -287082,8 +288054,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -287115,8 +288087,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -287135,8 +288107,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -287155,8 +288127,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -287789,8 +288761,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -288009,8 +288981,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -288106,7 +289078,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -288164,7 +289136,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -288199,7 +289175,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -288264,8 +289240,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -288297,8 +289273,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -288317,8 +289293,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -288337,8 +289313,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -288971,8 +289947,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -289191,8 +290167,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -289288,7 +290264,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -289346,7 +290322,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -289381,7 +290361,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -289446,8 +290426,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -289479,8 +290459,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -289499,8 +290479,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -289519,8 +290499,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -290153,8 +291133,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -290373,8 +291353,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -290470,7 +291450,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -290528,7 +291508,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -290563,7 +291547,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -290628,8 +291612,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -290661,8 +291645,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -290681,8 +291665,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -290701,8 +291685,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -291335,8 +292319,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -291555,8 +292539,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -291652,7 +292636,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -291710,7 +292694,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -291745,7 +292733,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -291810,8 +292798,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -291843,8 +292831,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -291863,8 +292851,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -291883,8 +292871,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -292517,8 +293505,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -292737,8 +293725,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -292834,7 +293822,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -292892,7 +293880,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -292927,7 +293919,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -292992,8 +293984,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -293025,8 +294017,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -293045,8 +294037,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -293065,8 +294057,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -293699,8 +294691,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -293919,8 +294911,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -294016,7 +295008,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -294074,7 +295066,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -294109,7 +295105,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -294174,8 +295170,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -294207,8 +295203,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -294227,8 +295223,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -294247,8 +295243,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -294881,8 +295877,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -295101,8 +296097,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -295198,7 +296194,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -295256,7 +296252,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -295291,7 +296291,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -295356,8 +296356,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -295389,8 +296389,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -295409,8 +296409,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -295429,8 +296429,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -296063,8 +297063,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -296283,8 +297283,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -296380,7 +297380,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -296438,7 +297438,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -296473,7 +297477,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -296538,8 +297542,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -296571,8 +297575,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -296591,8 +297595,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -296611,8 +297615,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -297245,8 +298249,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -297465,8 +298469,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -297562,7 +298566,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -297620,7 +298624,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -297655,7 +298663,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -297720,8 +298728,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -297753,8 +298761,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -297773,8 +298781,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -297793,8 +298801,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -298427,8 +299435,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -298647,8 +299655,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -298744,7 +299752,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -298802,7 +299810,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -298837,7 +299849,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -298902,8 +299914,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -298935,8 +299947,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -298955,8 +299967,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -298975,8 +299987,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -299609,8 +300621,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -299829,8 +300841,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -299926,7 +300938,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -299984,7 +300996,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -300019,7 +301035,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -300084,8 +301100,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -300117,8 +301133,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -300137,8 +301153,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -300157,8 +301173,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -300791,8 +301807,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -301011,8 +302027,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -301108,7 +302124,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -301166,7 +302182,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -301201,7 +302221,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -301266,8 +302286,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -301299,8 +302319,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -301319,8 +302339,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -301339,8 +302359,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -301973,8 +302993,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -302193,8 +303213,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -302290,7 +303310,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -302348,7 +303368,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -302383,7 +303407,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -302448,8 +303472,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -302481,8 +303505,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -302501,8 +303525,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -302521,8 +303545,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -303155,8 +304179,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -303375,8 +304399,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -303472,7 +304496,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -303530,7 +304554,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -303565,7 +304593,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -303630,8 +304658,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -303663,8 +304691,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -303683,8 +304711,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -303703,8 +304731,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -304337,8 +305365,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -304557,8 +305585,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -304654,7 +305682,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -304712,7 +305740,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -304747,7 +305779,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -304812,8 +305844,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -304845,8 +305877,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -304865,8 +305897,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -304885,8 +305917,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -305519,8 +306551,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -305739,8 +306771,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -305836,7 +306868,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -305894,7 +306926,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -305929,7 +306965,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -305994,8 +307030,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -306027,8 +307063,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -306047,8 +307083,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -306067,8 +307103,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -306701,8 +307737,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -306921,8 +307957,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -307018,7 +308054,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -307076,7 +308112,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -307111,7 +308151,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -307176,8 +308216,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -307209,8 +308249,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -307229,8 +308269,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -307249,8 +308289,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -307883,8 +308923,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -308103,8 +309143,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -308200,7 +309240,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -308258,7 +309298,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -308293,7 +309337,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -308358,8 +309402,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -308391,8 +309435,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -308411,8 +309455,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -308431,8 +309475,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -309065,8 +310109,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -309285,8 +310329,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -309382,7 +310426,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -309440,7 +310484,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -309475,7 +310523,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -309540,8 +310588,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -309573,8 +310621,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -309593,8 +310641,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -309613,8 +310661,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -310247,8 +311295,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -310467,8 +311515,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -310564,7 +311612,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -310622,7 +311670,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -310657,7 +311709,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -310722,8 +311774,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -310755,8 +311807,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -310775,8 +311827,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -310795,8 +311847,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -311429,8 +312481,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -311649,8 +312701,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -311746,7 +312798,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -311804,7 +312856,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -311839,7 +312895,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -311904,8 +312960,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -311937,8 +312993,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -311957,8 +313013,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -311977,8 +313033,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -312611,8 +313667,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -312831,8 +313887,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -312928,7 +313984,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -312986,7 +314042,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -313021,7 +314081,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -313086,8 +314146,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -313119,8 +314179,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -313139,8 +314199,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -313159,8 +314219,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -313793,8 +314853,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -314013,8 +315073,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -314110,7 +315170,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -314168,7 +315228,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -314203,7 +315267,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -314268,8 +315332,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -314301,8 +315365,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -314321,8 +315385,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -314341,8 +315405,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -314975,8 +316039,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -315195,8 +316259,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -315292,7 +316356,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -315350,7 +316414,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -315385,7 +316453,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -315450,8 +316518,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -315483,8 +316551,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -315503,8 +316571,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -315523,8 +316591,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -316157,8 +317225,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -316377,8 +317445,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -316474,7 +317542,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -316532,7 +317600,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -316567,7 +317639,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -316632,8 +317704,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -316665,8 +317737,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -316685,8 +317757,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -316705,8 +317777,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -317339,8 +318411,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -317559,8 +318631,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -317656,7 +318728,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -317714,7 +318786,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -317749,7 +318825,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -317814,8 +318890,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -317847,8 +318923,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -317867,8 +318943,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -317887,8 +318963,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -318521,8 +319597,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -318741,8 +319817,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -318838,7 +319914,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -318896,7 +319972,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -318931,7 +320011,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -318996,8 +320076,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -319029,8 +320109,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -319049,8 +320129,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -319069,8 +320149,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -319703,8 +320783,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -319923,8 +321003,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -320020,7 +321100,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -320078,7 +321158,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -320113,7 +321197,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -320178,8 +321262,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -320211,8 +321295,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -320231,8 +321315,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -320251,8 +321335,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -320885,8 +321969,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -321105,8 +322189,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -321202,7 +322286,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -321260,7 +322344,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -321295,7 +322383,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -321360,8 +322448,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -321393,8 +322481,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -321413,8 +322501,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -321433,8 +322521,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -322067,8 +323155,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -322287,8 +323375,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -322384,7 +323472,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -322442,7 +323530,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -322477,7 +323569,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -322542,8 +323634,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -322575,8 +323667,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -322595,8 +323687,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -322615,8 +323707,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -323249,8 +324341,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -323469,8 +324561,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -323566,7 +324658,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -323624,7 +324716,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -323659,7 +324755,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -323724,8 +324820,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -323757,8 +324853,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -323777,8 +324873,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -323797,8 +324893,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -324431,8 +325527,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -324651,8 +325747,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -324748,7 +325844,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -324806,7 +325902,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -324841,7 +325941,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -324906,8 +326006,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -324939,8 +326039,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -324959,8 +326059,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -324979,8 +326079,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -325613,8 +326713,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -325833,8 +326933,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -325930,7 +327030,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -325988,7 +327088,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -326023,7 +327127,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -326088,8 +327192,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -326121,8 +327225,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -326141,8 +327245,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -326161,8 +327265,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -326795,8 +327899,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -327015,8 +328119,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -327112,7 +328216,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -327170,7 +328274,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -327205,7 +328313,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -327270,8 +328378,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -327303,8 +328411,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -327323,8 +328431,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -327343,8 +328451,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -327977,8 +329085,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -328197,8 +329305,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -328294,7 +329402,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -328352,7 +329460,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -328387,7 +329499,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -328452,8 +329564,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -328485,8 +329597,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -328505,8 +329617,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -328525,8 +329637,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -329159,8 +330271,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -329379,8 +330491,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -329476,7 +330588,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -329534,7 +330646,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -329569,7 +330685,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -329634,8 +330750,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -329667,8 +330783,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -329687,8 +330803,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -329707,8 +330823,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -330341,8 +331457,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -330561,8 +331677,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -330658,7 +331774,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -330716,7 +331832,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -330751,7 +331871,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -330816,8 +331936,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -330849,8 +331969,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -330869,8 +331989,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -330889,8 +332009,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -331523,8 +332643,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -331743,8 +332863,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -331840,7 +332960,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -331898,7 +333018,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -331933,7 +333057,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -331998,8 +333122,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -332031,8 +333155,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -332051,8 +333175,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -332071,8 +333195,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -332705,8 +333829,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -332925,8 +334049,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -333022,7 +334146,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -333080,7 +334204,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -333115,7 +334243,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -333180,8 +334308,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -333213,8 +334341,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -333233,8 +334361,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -333253,8 +334381,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -333887,8 +335015,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -334107,8 +335235,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -334204,7 +335332,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -334262,7 +335390,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -334297,7 +335429,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -334362,8 +335494,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -334395,8 +335527,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -334415,8 +335547,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -334435,8 +335567,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -335069,8 +336201,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -335289,8 +336421,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -335386,7 +336518,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -335444,7 +336576,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -335479,7 +336615,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -335544,8 +336680,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -335577,8 +336713,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -335597,8 +336733,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -335617,8 +336753,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -336251,8 +337387,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -336471,8 +337607,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -336568,7 +337704,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -336626,7 +337762,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -336661,7 +337801,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -336726,8 +337866,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -336759,8 +337899,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -336779,8 +337919,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -336799,8 +337939,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -337433,8 +338573,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -337653,8 +338793,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -337750,7 +338890,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -337808,7 +338948,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -337843,7 +338987,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -337908,8 +339052,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -337941,8 +339085,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -337961,8 +339105,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -337981,8 +339125,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -338615,8 +339759,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -338835,8 +339979,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -338932,7 +340076,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -338990,7 +340134,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -339025,7 +340173,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -339090,8 +340238,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -339123,8 +340271,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -339143,8 +340291,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -339163,8 +340311,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -339797,8 +340945,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -340017,8 +341165,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -340114,7 +341262,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -340172,7 +341320,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -340207,7 +341359,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -340272,8 +341424,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -340305,8 +341457,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -340325,8 +341477,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -340345,8 +341497,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -340979,8 +342131,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -341199,8 +342351,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -341296,7 +342448,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -341354,7 +342506,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -341389,7 +342545,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -341454,8 +342610,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -341487,8 +342643,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -341507,8 +342663,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -341527,8 +342683,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -342161,8 +343317,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -342381,8 +343537,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -342478,7 +343634,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -342536,7 +343692,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -342571,7 +343731,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -342636,8 +343796,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -342669,8 +343829,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -342689,8 +343849,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -342709,8 +343869,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -343343,8 +344503,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -343563,8 +344723,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -343660,7 +344820,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -343718,7 +344878,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -343753,7 +344917,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -343818,8 +344982,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -343851,8 +345015,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -343871,8 +345035,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -343891,8 +345055,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -344525,8 +345689,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -344745,8 +345909,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -344842,7 +346006,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -344900,7 +346064,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -344935,7 +346103,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -345000,8 +346168,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -345033,8 +346201,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -345053,8 +346221,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -345073,8 +346241,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -345707,8 +346875,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -345927,8 +347095,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -346024,7 +347192,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -346082,7 +347250,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -346117,7 +347289,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -346182,8 +347354,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -346215,8 +347387,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -346235,8 +347407,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -346255,8 +347427,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -346889,8 +348061,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -347109,8 +348281,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -347206,7 +348378,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -347264,7 +348436,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -347299,7 +348475,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -347364,8 +348540,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -347397,8 +348573,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -347417,8 +348593,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -347437,8 +348613,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -348071,8 +349247,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -348291,8 +349467,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -348388,7 +349564,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -348446,7 +349622,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -348481,7 +349661,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -348546,8 +349726,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -348579,8 +349759,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -348599,8 +349779,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -348619,8 +349799,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -349253,8 +350433,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -349473,8 +350653,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -349570,7 +350750,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -349628,7 +350808,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -349663,7 +350847,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -349728,8 +350912,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -349761,8 +350945,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -349781,8 +350965,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -349801,8 +350985,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -350435,8 +351619,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -350655,8 +351839,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -350752,7 +351936,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -350810,7 +351994,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -350845,7 +352033,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -350910,8 +352098,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -350943,8 +352131,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -350963,8 +352151,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -350983,8 +352171,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -351617,8 +352805,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -351837,8 +353025,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -351934,7 +353122,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -351992,7 +353180,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -352027,7 +353219,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -352092,8 +353284,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -352125,8 +353317,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -352145,8 +353337,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -352165,8 +353357,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -352799,8 +353991,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -353019,8 +354211,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -353116,7 +354308,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -353174,7 +354366,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -353209,7 +354405,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -353274,8 +354470,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -353307,8 +354503,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -353327,8 +354523,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -353347,8 +354543,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -353981,8 +355177,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -354201,8 +355397,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -354298,7 +355494,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -354356,7 +355552,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -354391,7 +355591,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -354456,8 +355656,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -354489,8 +355689,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -354509,8 +355709,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -354529,8 +355729,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -355163,8 +356363,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -355383,8 +356583,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -355480,7 +356680,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -355538,7 +356738,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -355573,7 +356777,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -355638,8 +356842,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -355671,8 +356875,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -355691,8 +356895,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -355711,8 +356915,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -356345,8 +357549,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -356565,8 +357769,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -356662,7 +357866,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -356720,7 +357924,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -356755,7 +357963,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -356820,8 +358028,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -356853,8 +358061,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -356873,8 +358081,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -356893,8 +358101,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -357527,8 +358735,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -357747,8 +358955,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -357844,7 +359052,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -357902,7 +359110,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -357937,7 +359149,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -358002,8 +359214,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -358035,8 +359247,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -358055,8 +359267,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -358075,8 +359287,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -358709,8 +359921,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -358929,8 +360141,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -359026,7 +360238,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -359084,7 +360296,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -359119,7 +360335,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -359184,8 +360400,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -359217,8 +360433,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -359237,8 +360453,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -359257,8 +360473,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -359891,8 +361107,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -360111,8 +361327,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -360208,7 +361424,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -360266,7 +361482,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -360301,7 +361521,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -360366,8 +361586,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -360399,8 +361619,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -360419,8 +361639,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -360439,8 +361659,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -361073,8 +362293,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -361293,8 +362513,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -361390,7 +362610,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -361448,7 +362668,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -361483,7 +362707,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -361548,8 +362772,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -361581,8 +362805,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -361601,8 +362825,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -361621,8 +362845,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -362255,8 +363479,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -362475,8 +363699,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -362572,7 +363796,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -362630,7 +363854,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -362665,7 +363893,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -362730,8 +363958,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -362763,8 +363991,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -362783,8 +364011,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -362803,8 +364031,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -363437,8 +364665,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -363657,8 +364885,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -363754,7 +364982,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -363812,7 +365040,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -363847,7 +365079,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -363912,8 +365144,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -363945,8 +365177,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -363965,8 +365197,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -363985,8 +365217,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -364619,8 +365851,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -364839,8 +366071,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -364936,7 +366168,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -364994,7 +366226,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -365029,7 +366265,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -365094,8 +366330,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -365127,8 +366363,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -365147,8 +366383,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -365167,8 +366403,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -365801,8 +367037,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -366021,8 +367257,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -366118,7 +367354,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -366176,7 +367412,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -366211,7 +367451,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -366276,8 +367516,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -366309,8 +367549,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -366329,8 +367569,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -366349,8 +367589,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -366983,8 +368223,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -367203,8 +368443,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -367300,7 +368540,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -367358,7 +368598,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -367393,7 +368637,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -367458,8 +368702,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -367491,8 +368735,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -367511,8 +368755,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -367531,8 +368775,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -368165,8 +369409,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -368385,8 +369629,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -368482,7 +369726,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -368540,7 +369784,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -368575,7 +369823,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -368640,8 +369888,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -368673,8 +369921,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -368693,8 +369941,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -368713,8 +369961,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -369347,8 +370595,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -369567,8 +370815,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -369664,7 +370912,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -369722,7 +370970,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -369757,7 +371009,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -369822,8 +371074,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -369855,8 +371107,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -369875,8 +371127,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -369895,8 +371147,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -370529,8 +371781,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -370749,8 +372001,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -370846,7 +372098,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -370904,7 +372156,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -370939,7 +372195,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -371004,8 +372260,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -371037,8 +372293,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -371057,8 +372313,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -371077,8 +372333,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -371711,8 +372967,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -371931,8 +373187,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -372028,7 +373284,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -372086,7 +373342,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -372121,7 +373381,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -372186,8 +373446,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -372219,8 +373479,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -372239,8 +373499,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -372259,8 +373519,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -372893,8 +374153,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -373113,8 +374373,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -373210,7 +374470,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -373268,7 +374528,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -373303,7 +374567,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -373368,8 +374632,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -373401,8 +374665,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -373421,8 +374685,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -373441,8 +374705,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -374075,8 +375339,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -374295,8 +375559,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -374392,7 +375656,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -374450,7 +375714,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -374485,7 +375753,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -374550,8 +375818,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -374583,8 +375851,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -374603,8 +375871,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -374623,8 +375891,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -375257,8 +376525,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -375477,8 +376745,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -375574,7 +376842,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -375632,7 +376900,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -375667,7 +376939,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -375732,8 +377004,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -375765,8 +377037,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -375785,8 +377057,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -375805,8 +377077,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -376439,8 +377711,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -376659,8 +377931,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -376756,7 +378028,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -376814,7 +378086,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -376849,7 +378125,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -376914,8 +378190,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -376947,8 +378223,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -376967,8 +378243,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -376987,8 +378263,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -377621,8 +378897,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -377841,8 +379117,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -377938,7 +379214,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -377996,7 +379272,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -378031,7 +379311,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -378096,8 +379376,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -378129,8 +379409,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -378149,8 +379429,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -378169,8 +379449,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -378803,8 +380083,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -379023,8 +380303,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -379120,7 +380400,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -379178,7 +380458,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -379213,7 +380497,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -379278,8 +380562,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -379311,8 +380595,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -379331,8 +380615,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -379351,8 +380635,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -379985,8 +381269,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -380205,8 +381489,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -380302,7 +381586,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -380360,7 +381644,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -380395,7 +381683,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -380460,8 +381748,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -380493,8 +381781,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -380513,8 +381801,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -380533,8 +381821,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -381167,8 +382455,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -381387,8 +382675,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -381484,7 +382772,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -381542,7 +382830,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -381577,7 +382869,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -381642,8 +382934,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -381675,8 +382967,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -381695,8 +382987,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -381715,8 +383007,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -382349,8 +383641,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -382569,8 +383861,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -382666,7 +383958,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -382724,7 +384016,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -382759,7 +384055,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -382824,8 +384120,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -382857,8 +384153,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -382877,8 +384173,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -382897,8 +384193,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -383531,8 +384827,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -383751,8 +385047,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -383848,7 +385144,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -383906,7 +385202,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -383941,7 +385241,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -384006,8 +385306,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -384039,8 +385339,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -384059,8 +385359,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -384079,8 +385379,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -384713,8 +386013,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -384933,8 +386233,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -385030,7 +386330,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -385088,7 +386388,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -385123,7 +386427,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -385188,8 +386492,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -385221,8 +386525,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -385241,8 +386545,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -385261,8 +386565,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -385895,8 +387199,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -386115,8 +387419,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -386212,7 +387516,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -386270,7 +387574,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -386305,7 +387613,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -386370,8 +387678,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -386403,8 +387711,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -386423,8 +387731,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -386443,8 +387751,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -387077,8 +388385,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -387297,8 +388605,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -387394,7 +388702,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -387452,7 +388760,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -387487,7 +388799,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -387552,8 +388864,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -387585,8 +388897,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -387605,8 +388917,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -387625,8 +388937,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -388259,8 +389571,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -388479,8 +389791,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -388576,7 +389888,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -388634,7 +389946,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -388669,7 +389985,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -388734,8 +390050,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -388767,8 +390083,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -388787,8 +390103,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -388807,8 +390123,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -389441,8 +390757,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -389661,8 +390977,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -389758,7 +391074,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -389816,7 +391132,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -389851,7 +391171,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -389916,8 +391236,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -389949,8 +391269,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -389969,8 +391289,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -389989,8 +391309,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -390623,8 +391943,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -390843,8 +392163,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -390940,7 +392260,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -390998,7 +392318,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -391033,7 +392357,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -391098,8 +392422,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -391131,8 +392455,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -391151,8 +392475,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -391171,8 +392495,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -391805,8 +393129,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -392025,8 +393349,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -392122,7 +393446,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -392180,7 +393504,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -392215,7 +393543,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -392280,8 +393608,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -392313,8 +393641,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -392333,8 +393661,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -392353,8 +393681,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -392987,8 +394315,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -393207,8 +394535,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -393304,7 +394632,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -393362,7 +394690,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -393397,7 +394729,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -393462,8 +394794,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -393495,8 +394827,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -393515,8 +394847,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -393535,8 +394867,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -394169,8 +395501,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -394389,8 +395721,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -394486,7 +395818,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -394544,7 +395876,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -394579,7 +395915,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -394644,8 +395980,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -394677,8 +396013,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -394697,8 +396033,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -394717,8 +396053,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -395351,8 +396687,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -395571,8 +396907,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -395668,7 +397004,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -395726,7 +397062,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -395761,7 +397101,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -395826,8 +397166,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -395859,8 +397199,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -395879,8 +397219,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -395899,8 +397239,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -396533,8 +397873,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -396753,8 +398093,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -396850,7 +398190,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -396908,7 +398248,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -396943,7 +398287,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -397008,8 +398352,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -397041,8 +398385,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -397061,8 +398405,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -397081,8 +398425,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -397715,8 +399059,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -397935,8 +399279,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -398032,7 +399376,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -398090,7 +399434,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -398125,7 +399473,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -398190,8 +399538,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -398223,8 +399571,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -398243,8 +399591,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -398263,8 +399611,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -398897,8 +400245,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -399117,8 +400465,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -399214,7 +400562,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -399272,7 +400620,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -399307,7 +400659,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -399372,8 +400724,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -399405,8 +400757,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -399425,8 +400777,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -399445,8 +400797,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -400079,8 +401431,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -400299,8 +401651,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -400396,7 +401748,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -400454,7 +401806,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -400489,7 +401845,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -400554,8 +401910,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -400587,8 +401943,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -400607,8 +401963,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -400627,8 +401983,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -401261,8 +402617,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -401481,8 +402837,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -401578,7 +402934,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -401636,7 +402992,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -401671,7 +403031,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -401736,8 +403096,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -401769,8 +403129,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -401789,8 +403149,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -401809,8 +403169,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -402443,8 +403803,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -402663,8 +404023,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -402760,7 +404120,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -402818,7 +404178,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -402853,7 +404217,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -402918,8 +404282,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -402951,8 +404315,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -402971,8 +404335,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -402991,8 +404355,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -403625,8 +404989,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -403845,8 +405209,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -403942,7 +405306,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -404000,7 +405364,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -404035,7 +405403,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -404100,8 +405468,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -404133,8 +405501,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -404153,8 +405521,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -404173,8 +405541,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -404807,8 +406175,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -405027,8 +406395,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -405124,7 +406492,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -405182,7 +406550,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -405217,7 +406589,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -405282,8 +406654,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -405315,8 +406687,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -405335,8 +406707,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -405355,8 +406727,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -405989,8 +407361,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -406209,8 +407581,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -406306,7 +407678,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -406364,7 +407736,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -406399,7 +407775,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -406464,8 +407840,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -406497,8 +407873,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -406517,8 +407893,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -406537,8 +407913,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -407171,8 +408547,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -407391,8 +408767,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -407488,7 +408864,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -407546,7 +408922,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -407581,7 +408961,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -407646,8 +409026,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -407679,8 +409059,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -407699,8 +409079,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -407719,8 +409099,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -408353,8 +409733,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -408573,8 +409953,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -408670,7 +410050,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -408728,7 +410108,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -408763,7 +410147,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -408828,8 +410212,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -408861,8 +410245,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -408881,8 +410265,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -408901,8 +410285,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -409535,8 +410919,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -409755,8 +411139,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -409852,7 +411236,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -409910,7 +411294,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -409945,7 +411333,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -410010,8 +411398,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -410043,8 +411431,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -410063,8 +411451,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -410083,8 +411471,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -410717,8 +412105,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -410937,8 +412325,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -411034,7 +412422,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -411092,7 +412480,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -411127,7 +412519,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -411192,8 +412584,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -411225,8 +412617,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -411245,8 +412637,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -411265,8 +412657,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -411899,8 +413291,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -412119,8 +413511,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -412216,7 +413608,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -412274,7 +413666,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -412309,7 +413705,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -412374,8 +413770,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -412407,8 +413803,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -412427,8 +413823,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -412447,8 +413843,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -413081,8 +414477,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -413301,8 +414697,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -413398,7 +414794,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -413456,7 +414852,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -413491,7 +414891,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -413556,8 +414956,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -413589,8 +414989,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -413609,8 +415009,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -413629,8 +415029,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -414263,8 +415663,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -414483,8 +415883,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -414580,7 +415980,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -414638,7 +416038,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -414673,7 +416077,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -414738,8 +416142,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -414771,8 +416175,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -414791,8 +416195,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -414811,8 +416215,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", @@ -415445,8 +416849,8 @@ {}, { "techniqueID": "T1482", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, {}, {}, @@ -415665,8 +417069,8 @@ {}, { "techniqueID": "T1562.001", - "score": 3, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "score": 14, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, {}, {}, @@ -415762,7 +417166,7 @@ { "techniqueID": "T1036.003", "score": 7, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, {}, { @@ -415820,7 +417224,11 @@ {}, {}, {}, - {}, + { + "techniqueID": "T1197", + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1127.001", "score": 3, @@ -415855,7 +417263,7 @@ {}, { "techniqueID": "T1569", - "score": 4, + "score": 5, "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml" }, { @@ -415920,8 +417328,8 @@ {}, { "techniqueID": "T1526", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_excessive_security_scanning.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/gcp_kubernetes_cluster_scan_detection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/kubernetes_azure_scan_fingerprint.yml" }, {}, {}, @@ -415953,8 +417361,8 @@ {}, { "techniqueID": "T1105", - "score": 2, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "score": 3, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, {}, {}, @@ -415973,8 +417381,8 @@ {}, { "techniqueID": "T1564.001", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, {}, {}, @@ -415993,8 +417401,8 @@ {}, { "techniqueID": "T1569.002", - "score": 1, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "score": 2, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1078.004", diff --git a/docs/mitre-map/detections.csv b/docs/mitre-map/detections.csv index 72f63344b4..1a4b3c7e77 100644 --- a/docs/mitre-map/detections.csv +++ b/docs/mitre-map/detections.csv @@ -7743,710 +7743,1062 @@ T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_prohibited_applications_spawning_cmd_exe.yml,38 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml,38 T1059.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ryuk_wake_on_lan_command.yml,38 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,40 -T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,40 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml,39 +T1105,Yes,https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml,39 T1060,No,-,40 T1547.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/registry_keys_used_for_persistence.yml,39 T1060,No,-,40 @@ -52812,9 +53164,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -52829,9 +53192,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -52846,9 +53220,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -52863,9 +53248,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -52880,9 +53276,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -52897,9 +53304,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -52914,9 +53332,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -52931,9 +53360,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -52948,9 +53388,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -52965,9 +53416,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -52982,9 +53444,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -52999,9 +53472,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53016,9 +53500,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53033,9 +53528,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53050,9 +53556,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53067,9 +53584,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53084,9 +53612,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53101,9 +53640,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53118,9 +53668,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53135,9 +53696,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53152,9 +53724,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53169,9 +53752,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53186,9 +53780,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53203,9 +53808,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53220,9 +53836,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53237,9 +53864,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53254,9 +53892,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53271,9 +53920,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53288,9 +53948,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53305,9 +53976,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53322,9 +54004,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53339,9 +54032,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53356,9 +54060,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53373,9 +54088,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53390,9 +54116,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53407,9 +54144,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53424,9 +54172,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53441,9 +54200,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53458,9 +54228,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53475,9 +54256,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53492,9 +54284,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53509,9 +54312,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53526,9 +54340,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53543,9 +54368,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53560,9 +54396,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53577,9 +54424,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53594,9 +54452,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53611,9 +54480,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53628,9 +54508,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53645,9 +54536,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53662,9 +54564,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53679,9 +54592,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53696,9 +54620,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53713,9 +54648,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53730,9 +54676,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53747,9 +54704,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53764,9 +54732,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53781,9 +54760,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53798,9 +54788,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53815,9 +54816,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53832,9 +54844,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53849,9 +54872,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53866,9 +54900,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53883,9 +54928,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53900,9 +54956,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53917,9 +54984,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53934,9 +55012,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53951,9 +55040,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53968,9 +55068,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -53985,9 +55096,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54002,9 +55124,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54019,9 +55152,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54036,9 +55180,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54053,9 +55208,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54070,9 +55236,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54087,9 +55264,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54104,9 +55292,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54121,9 +55320,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54138,9 +55348,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54155,9 +55376,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54172,9 +55404,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54189,9 +55432,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54206,9 +55460,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54223,9 +55488,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54240,9 +55516,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54257,9 +55544,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54274,9 +55572,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54291,9 +55600,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54308,9 +55628,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54325,9 +55656,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54342,9 +55684,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54359,9 +55712,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54376,9 +55740,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54393,9 +55768,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54410,9 +55796,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54427,9 +55824,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54444,9 +55852,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54461,9 +55880,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54478,9 +55908,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54495,9 +55936,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54512,9 +55964,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54529,9 +55992,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54546,9 +56020,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54563,9 +56048,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54580,9 +56076,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54597,9 +56104,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54614,9 +56132,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54631,9 +56160,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54648,9 +56188,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54665,9 +56216,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54682,9 +56244,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54699,9 +56272,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54716,9 +56300,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54733,9 +56328,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54750,9 +56356,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54767,9 +56384,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54784,9 +56412,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54801,9 +56440,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54818,9 +56468,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54835,9 +56496,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54852,9 +56524,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54869,9 +56552,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54886,9 +56580,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54903,9 +56608,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54920,9 +56636,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54937,9 +56664,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54954,9 +56692,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54971,9 +56720,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -54988,9 +56748,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55005,9 +56776,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55022,9 +56804,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55039,9 +56832,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55056,9 +56860,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55073,9 +56888,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55090,9 +56916,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55107,9 +56944,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55124,9 +56972,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55141,9 +57000,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55158,9 +57028,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55175,9 +57056,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55192,9 +57084,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55209,9 +57112,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55226,9 +57140,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55243,9 +57168,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55260,9 +57196,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55277,9 +57224,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55294,9 +57252,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55311,9 +57280,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55328,9 +57308,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55345,9 +57336,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55362,9 +57364,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55379,9 +57392,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55396,9 +57420,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55413,9 +57448,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55430,9 +57476,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55447,9 +57504,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55464,9 +57532,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55481,9 +57560,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55498,9 +57588,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55515,9 +57616,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55532,9 +57644,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55549,9 +57672,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55566,9 +57700,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55583,9 +57728,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55600,9 +57756,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55617,9 +57784,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55634,9 +57812,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55651,9 +57840,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55668,9 +57868,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55685,9 +57896,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55702,9 +57924,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55719,9 +57952,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55736,9 +57980,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55753,9 +58008,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55770,9 +58036,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55787,9 +58064,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55804,9 +58092,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55821,9 +58120,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55838,9 +58148,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55855,9 +58176,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55872,9 +58204,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55889,9 +58232,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55906,9 +58260,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55923,9 +58288,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55940,9 +58316,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55957,9 +58344,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55974,9 +58372,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -55991,9 +58400,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56008,9 +58428,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56025,9 +58456,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56042,9 +58484,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56059,9 +58512,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56076,9 +58540,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56093,9 +58568,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56110,9 +58596,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56127,9 +58624,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56144,9 +58652,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56161,9 +58680,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56178,9 +58708,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56195,9 +58736,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56212,9 +58764,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56229,9 +58792,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56246,9 +58820,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56263,9 +58848,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56280,9 +58876,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56297,9 +58904,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56314,9 +58932,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56331,9 +58960,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56348,9 +58988,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56365,9 +59016,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56382,9 +59044,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56399,9 +59072,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56416,9 +59100,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56433,9 +59128,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56450,9 +59156,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56467,9 +59184,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56484,9 +59212,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56501,9 +59240,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56518,9 +59268,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56535,9 +59296,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56552,9 +59324,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56569,9 +59352,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56586,9 +59380,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56603,9 +59408,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56620,9 +59436,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56637,9 +59464,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56654,9 +59492,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56671,9 +59520,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56688,9 +59548,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56705,9 +59576,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56722,9 +59604,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56739,9 +59632,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56756,9 +59660,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56773,9 +59688,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56790,9 +59716,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56807,9 +59744,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56824,9 +59772,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56841,9 +59800,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56858,9 +59828,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56875,9 +59856,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56892,9 +59884,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56909,9 +59912,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56926,9 +59940,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56943,9 +59968,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56960,9 +59996,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56977,9 +60024,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -56994,9 +60052,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57011,9 +60080,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57028,9 +60108,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57045,9 +60136,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57062,9 +60164,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57079,9 +60192,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57096,9 +60220,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57113,9 +60248,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57130,9 +60276,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57147,9 +60304,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57164,9 +60332,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57181,9 +60360,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57198,9 +60388,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57215,9 +60416,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57232,9 +60444,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57249,9 +60472,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57266,9 +60500,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57283,9 +60528,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57300,9 +60556,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57317,9 +60584,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57334,9 +60612,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57351,9 +60640,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57368,9 +60668,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57385,9 +60696,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57402,9 +60724,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57419,9 +60752,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57436,9 +60780,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57453,9 +60808,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57470,9 +60836,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57487,9 +60864,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57504,9 +60892,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57521,9 +60920,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57538,9 +60948,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57555,9 +60976,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57572,9 +61004,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57589,9 +61032,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57606,9 +61060,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57623,9 +61088,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57640,9 +61116,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57657,9 +61144,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57674,9 +61172,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57691,9 +61200,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57708,9 +61228,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57725,9 +61256,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57742,9 +61284,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57759,9 +61312,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57776,9 +61340,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57793,9 +61368,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57810,9 +61396,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57827,9 +61424,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57844,9 +61452,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57861,9 +61480,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57878,9 +61508,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57895,9 +61536,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57912,9 +61564,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57929,9 +61592,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57946,9 +61620,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57963,9 +61648,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57980,9 +61676,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -57997,9 +61704,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58014,9 +61732,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58031,9 +61760,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58048,9 +61788,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58065,9 +61816,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58082,9 +61844,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58099,9 +61872,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58116,9 +61900,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58133,9 +61928,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58150,9 +61956,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58167,9 +61984,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58184,9 +62012,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58201,9 +62040,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58218,9 +62068,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58235,9 +62096,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58252,9 +62124,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58269,9 +62152,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58286,9 +62180,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58303,9 +62208,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58320,9 +62236,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58337,9 +62264,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58354,9 +62292,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58371,9 +62320,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58388,9 +62348,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58405,9 +62376,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58422,9 +62404,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58439,9 +62432,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58456,9 +62460,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58473,9 +62488,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58490,9 +62516,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58507,9 +62544,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58524,9 +62572,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58541,9 +62600,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58558,9 +62628,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58575,9 +62656,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58592,9 +62684,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58609,9 +62712,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58626,9 +62740,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58643,9 +62768,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58660,9 +62796,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58677,9 +62824,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58694,9 +62852,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58711,9 +62880,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58728,9 +62908,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58745,9 +62936,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58762,9 +62964,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1113,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,11 T1087.002,No,-,12 @@ -58779,9 +62992,20 @@ T1036,Yes,https://github.com/splunk/security_content/blob/develop/detections/sus T1560,No,-,12 T1136.002,No,-,12 T1041,No,-,12 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,9 -T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,9 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,-2 +T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,-2 T1518.001,No,-,12 T1571,No,-,11 T1073,No,-,11 @@ -61267,7 +65491,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -61289,7 +65514,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -61311,7 +65537,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -61333,7 +65560,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -61355,7 +65583,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -61377,7 +65606,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -61399,7 +65629,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -61421,7 +65652,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -61443,7 +65675,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -61465,7 +65698,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -61487,7 +65721,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -61509,7 +65744,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -61531,7 +65767,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -61553,7 +65790,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -61575,7 +65813,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -61597,7 +65836,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -61619,7 +65859,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -61641,7 +65882,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -61663,7 +65905,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -61685,7 +65928,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -61707,7 +65951,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -61729,7 +65974,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -61751,7 +65997,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -61773,7 +66020,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -61795,7 +66043,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -61817,7 +66066,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -61839,7 +66089,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -61861,7 +66112,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -61883,7 +66135,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -61905,7 +66158,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -61927,7 +66181,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -61949,7 +66204,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -61971,7 +66227,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -61993,7 +66250,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62015,7 +66273,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62037,7 +66296,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62059,7 +66319,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62081,7 +66342,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62103,7 +66365,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62125,7 +66388,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62147,7 +66411,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62169,7 +66434,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62191,7 +66457,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62213,7 +66480,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62235,7 +66503,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62257,7 +66526,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62279,7 +66549,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62301,7 +66572,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62323,7 +66595,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62345,7 +66618,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62367,7 +66641,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62389,7 +66664,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62411,7 +66687,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62433,7 +66710,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62455,7 +66733,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62477,7 +66756,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62499,7 +66779,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62521,7 +66802,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62543,7 +66825,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62565,7 +66848,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62587,7 +66871,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62609,7 +66894,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62631,7 +66917,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62653,7 +66940,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62675,7 +66963,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62697,7 +66986,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62719,7 +67009,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62741,7 +67032,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62763,7 +67055,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62785,7 +67078,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62807,7 +67101,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62829,7 +67124,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62851,7 +67147,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62873,7 +67170,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62895,7 +67193,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62917,7 +67216,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62939,7 +67239,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62961,7 +67262,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -62983,7 +67285,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63005,7 +67308,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63027,7 +67331,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63049,7 +67354,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63071,7 +67377,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63093,7 +67400,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63115,7 +67423,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63137,7 +67446,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63159,7 +67469,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63181,7 +67492,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63203,7 +67515,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63225,7 +67538,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63247,7 +67561,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63269,7 +67584,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63291,7 +67607,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63313,7 +67630,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63335,7 +67653,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63357,7 +67676,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63379,7 +67699,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63401,7 +67722,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63423,7 +67745,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63445,7 +67768,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63467,7 +67791,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63489,7 +67814,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63511,7 +67837,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63533,7 +67860,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63555,7 +67883,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63577,7 +67906,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63599,7 +67929,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63621,7 +67952,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63643,7 +67975,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63665,7 +67998,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63687,7 +68021,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63709,7 +68044,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63731,7 +68067,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63753,7 +68090,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63775,7 +68113,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63797,7 +68136,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63819,7 +68159,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63841,7 +68182,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63863,7 +68205,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63885,7 +68228,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63907,7 +68251,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63929,7 +68274,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63951,7 +68297,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63973,7 +68320,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -63995,7 +68343,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64017,7 +68366,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64039,7 +68389,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64061,7 +68412,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64083,7 +68435,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64105,7 +68458,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64127,7 +68481,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64149,7 +68504,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64171,7 +68527,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64193,7 +68550,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64215,7 +68573,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64237,7 +68596,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64259,7 +68619,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64281,7 +68642,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64303,7 +68665,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64325,7 +68688,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64347,7 +68711,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64369,7 +68734,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64391,7 +68757,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64413,7 +68780,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64435,7 +68803,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64457,7 +68826,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64479,7 +68849,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64501,7 +68872,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64523,7 +68895,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64545,7 +68918,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64567,7 +68941,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64589,7 +68964,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64611,7 +68987,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64633,7 +69010,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64655,7 +69033,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64677,7 +69056,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64699,7 +69079,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64721,7 +69102,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64743,7 +69125,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64765,7 +69148,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64787,7 +69171,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64809,7 +69194,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64831,7 +69217,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64853,7 +69240,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64875,7 +69263,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64897,7 +69286,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64919,7 +69309,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64941,7 +69332,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64963,7 +69355,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -64985,7 +69378,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65007,7 +69401,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65029,7 +69424,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65051,7 +69447,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65073,7 +69470,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65095,7 +69493,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65117,7 +69516,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65139,7 +69539,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65161,7 +69562,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65183,7 +69585,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65205,7 +69608,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65227,7 +69631,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65249,7 +69654,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65271,7 +69677,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65293,7 +69700,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65315,7 +69723,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65337,7 +69746,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65359,7 +69769,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65381,7 +69792,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65403,7 +69815,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65425,7 +69838,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65447,7 +69861,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65469,7 +69884,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65491,7 +69907,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65513,7 +69930,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65535,7 +69953,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65557,7 +69976,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65579,7 +69999,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65601,7 +70022,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65623,7 +70045,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65645,7 +70068,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65667,7 +70091,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65689,7 +70114,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65711,7 +70137,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65733,7 +70160,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65755,7 +70183,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65777,7 +70206,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65799,7 +70229,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65821,7 +70252,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65843,7 +70275,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65865,7 +70298,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65887,7 +70321,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65909,7 +70344,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65931,7 +70367,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65953,7 +70390,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65975,7 +70413,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -65997,7 +70436,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66019,7 +70459,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66041,7 +70482,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66063,7 +70505,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66085,7 +70528,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66107,7 +70551,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66129,7 +70574,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66151,7 +70597,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66173,7 +70620,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66195,7 +70643,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66217,7 +70666,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66239,7 +70689,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66261,7 +70712,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66283,7 +70735,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66305,7 +70758,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66327,7 +70781,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66349,7 +70804,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66371,7 +70827,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66393,7 +70850,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66415,7 +70873,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66437,7 +70896,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66459,7 +70919,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66481,7 +70942,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66503,7 +70965,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66525,7 +70988,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66547,7 +71011,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66569,7 +71034,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66591,7 +71057,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66613,7 +71080,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66635,7 +71103,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66657,7 +71126,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66679,7 +71149,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66701,7 +71172,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66723,7 +71195,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66745,7 +71218,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66767,7 +71241,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66789,7 +71264,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66811,7 +71287,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66833,7 +71310,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66855,7 +71333,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66877,7 +71356,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66899,7 +71379,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66921,7 +71402,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66943,7 +71425,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66965,7 +71448,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -66987,7 +71471,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67009,7 +71494,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67031,7 +71517,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67053,7 +71540,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67075,7 +71563,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67097,7 +71586,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67119,7 +71609,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67141,7 +71632,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67163,7 +71655,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67185,7 +71678,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67207,7 +71701,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67229,7 +71724,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67251,7 +71747,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67273,7 +71770,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67295,7 +71793,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67317,7 +71816,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67339,7 +71839,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67361,7 +71862,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67383,7 +71885,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67405,7 +71908,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67427,7 +71931,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67449,7 +71954,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67471,7 +71977,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67493,7 +72000,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67515,7 +72023,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67537,7 +72046,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67559,7 +72069,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67581,7 +72092,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67603,7 +72115,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67625,7 +72138,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67647,7 +72161,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67669,7 +72184,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67691,7 +72207,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67713,7 +72230,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67735,7 +72253,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67757,7 +72276,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67779,7 +72299,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67801,7 +72322,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67823,7 +72345,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67845,7 +72368,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67867,7 +72391,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67889,7 +72414,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67911,7 +72437,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67933,7 +72460,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67955,7 +72483,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67977,7 +72506,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -67999,7 +72529,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68021,7 +72552,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68043,7 +72575,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68065,7 +72598,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68087,7 +72621,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68109,7 +72644,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68131,7 +72667,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68153,7 +72690,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68175,7 +72713,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68197,7 +72736,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68219,7 +72759,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68241,7 +72782,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68263,7 +72805,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68285,7 +72828,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68307,7 +72851,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68329,7 +72874,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68351,7 +72897,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68373,7 +72920,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68395,7 +72943,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68417,7 +72966,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68439,7 +72989,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68461,7 +73012,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68483,7 +73035,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68505,7 +73058,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68527,7 +73081,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68549,7 +73104,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68571,7 +73127,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68593,7 +73150,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68615,7 +73173,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68637,7 +73196,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68659,7 +73219,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68681,7 +73242,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68703,7 +73265,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68725,7 +73288,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68747,7 +73311,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68769,7 +73334,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68791,7 +73357,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68813,7 +73380,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68835,7 +73403,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68857,7 +73426,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68879,7 +73449,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68901,7 +73472,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68923,7 +73495,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68945,7 +73518,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68967,7 +73541,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1143,No,-,9 T1559.002,No,-,9 @@ -68989,7 +73564,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1102.002,No,-,9 T1564.003,No,-,9 T1173,No,-,9 -T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,8 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml,7 +T1569.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml,7 T1035,No,-,9 T1132.001,No,-,8 T1059.007,No,-,8 @@ -99287,7 +103863,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -99314,7 +103891,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -99341,7 +103919,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -99368,7 +103947,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -99395,7 +103975,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -99422,7 +104003,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -99449,7 +104031,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -99476,7 +104059,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -99503,7 +104087,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -99530,7 +104115,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -99557,7 +104143,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -99584,7 +104171,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -99611,7 +104199,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -99638,7 +104227,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -99665,7 +104255,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -99692,7 +104283,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -99719,7 +104311,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -99746,7 +104339,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -99773,7 +104367,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -99800,7 +104395,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -99827,7 +104423,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -99854,7 +104451,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -99881,7 +104479,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -99908,7 +104507,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -99935,7 +104535,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -99962,7 +104563,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -99989,7 +104591,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100016,7 +104619,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100043,7 +104647,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100070,7 +104675,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100097,7 +104703,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100124,7 +104731,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100151,7 +104759,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100178,7 +104787,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100205,7 +104815,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100232,7 +104843,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100259,7 +104871,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100286,7 +104899,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100313,7 +104927,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100340,7 +104955,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100367,7 +104983,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100394,7 +105011,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100421,7 +105039,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100448,7 +105067,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100475,7 +105095,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100502,7 +105123,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100529,7 +105151,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100556,7 +105179,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100583,7 +105207,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100610,7 +105235,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100637,7 +105263,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100664,7 +105291,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100691,7 +105319,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100718,7 +105347,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100745,7 +105375,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100772,7 +105403,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100799,7 +105431,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100826,7 +105459,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100853,7 +105487,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100880,7 +105515,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100907,7 +105543,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100934,7 +105571,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100961,7 +105599,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -100988,7 +105627,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101015,7 +105655,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101042,7 +105683,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101069,7 +105711,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101096,7 +105739,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101123,7 +105767,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101150,7 +105795,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101177,7 +105823,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101204,7 +105851,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101231,7 +105879,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101258,7 +105907,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101285,7 +105935,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101312,7 +105963,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101339,7 +105991,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101366,7 +106019,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101393,7 +106047,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101420,7 +106075,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101447,7 +106103,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101474,7 +106131,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101501,7 +106159,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101528,7 +106187,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101555,7 +106215,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101582,7 +106243,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101609,7 +106271,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101636,7 +106299,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101663,7 +106327,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101690,7 +106355,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101717,7 +106383,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101744,7 +106411,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101771,7 +106439,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101798,7 +106467,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101825,7 +106495,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101852,7 +106523,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101879,7 +106551,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101906,7 +106579,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101933,7 +106607,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101960,7 +106635,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -101987,7 +106663,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102014,7 +106691,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102041,7 +106719,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102068,7 +106747,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102095,7 +106775,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102122,7 +106803,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102149,7 +106831,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102176,7 +106859,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102203,7 +106887,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102230,7 +106915,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102257,7 +106943,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102284,7 +106971,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102311,7 +106999,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102338,7 +107027,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102365,7 +107055,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102392,7 +107083,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102419,7 +107111,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102446,7 +107139,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102473,7 +107167,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102500,7 +107195,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102527,7 +107223,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102554,7 +107251,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102581,7 +107279,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102608,7 +107307,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102635,7 +107335,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102662,7 +107363,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102689,7 +107391,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102716,7 +107419,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102743,7 +107447,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102770,7 +107475,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102797,7 +107503,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102824,7 +107531,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102851,7 +107559,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102878,7 +107587,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102905,7 +107615,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102932,7 +107643,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102959,7 +107671,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -102986,7 +107699,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103013,7 +107727,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103040,7 +107755,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103067,7 +107783,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103094,7 +107811,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103121,7 +107839,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103148,7 +107867,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103175,7 +107895,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103202,7 +107923,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103229,7 +107951,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103256,7 +107979,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103283,7 +108007,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103310,7 +108035,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103337,7 +108063,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103364,7 +108091,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103391,7 +108119,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103418,7 +108147,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103445,7 +108175,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103472,7 +108203,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103499,7 +108231,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103526,7 +108259,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103553,7 +108287,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103580,7 +108315,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103607,7 +108343,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103634,7 +108371,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103661,7 +108399,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103688,7 +108427,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103715,7 +108455,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103742,7 +108483,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103769,7 +108511,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103796,7 +108539,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103823,7 +108567,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103850,7 +108595,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103877,7 +108623,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103904,7 +108651,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103931,7 +108679,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103958,7 +108707,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -103985,7 +108735,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104012,7 +108763,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104039,7 +108791,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104066,7 +108819,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104093,7 +108847,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104120,7 +108875,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104147,7 +108903,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104174,7 +108931,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104201,7 +108959,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104228,7 +108987,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104255,7 +109015,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104282,7 +109043,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104309,7 +109071,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104336,7 +109099,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104363,7 +109127,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104390,7 +109155,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104417,7 +109183,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104444,7 +109211,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104471,7 +109239,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104498,7 +109267,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104525,7 +109295,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104552,7 +109323,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104579,7 +109351,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104606,7 +109379,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104633,7 +109407,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104660,7 +109435,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104687,7 +109463,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104714,7 +109491,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104741,7 +109519,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104768,7 +109547,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104795,7 +109575,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104822,7 +109603,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104849,7 +109631,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104876,7 +109659,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104903,7 +109687,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104930,7 +109715,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104957,7 +109743,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -104984,7 +109771,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105011,7 +109799,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105038,7 +109827,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105065,7 +109855,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105092,7 +109883,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105119,7 +109911,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105146,7 +109939,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105173,7 +109967,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105200,7 +109995,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105227,7 +110023,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105254,7 +110051,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105281,7 +110079,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105308,7 +110107,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105335,7 +110135,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105362,7 +110163,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105389,7 +110191,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105416,7 +110219,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105443,7 +110247,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105470,7 +110275,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105497,7 +110303,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105524,7 +110331,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105551,7 +110359,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105578,7 +110387,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105605,7 +110415,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105632,7 +110443,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105659,7 +110471,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105686,7 +110499,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105713,7 +110527,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105740,7 +110555,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105767,7 +110583,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105794,7 +110611,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105821,7 +110639,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105848,7 +110667,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105875,7 +110695,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105902,7 +110723,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105929,7 +110751,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105956,7 +110779,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -105983,7 +110807,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106010,7 +110835,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106037,7 +110863,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106064,7 +110891,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106091,7 +110919,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106118,7 +110947,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106145,7 +110975,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106172,7 +111003,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106199,7 +111031,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106226,7 +111059,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106253,7 +111087,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106280,7 +111115,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106307,7 +111143,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106334,7 +111171,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106361,7 +111199,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106388,7 +111227,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106415,7 +111255,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106442,7 +111283,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106469,7 +111311,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106496,7 +111339,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106523,7 +111367,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106550,7 +111395,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106577,7 +111423,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106604,7 +111451,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106631,7 +111479,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106658,7 +111507,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106685,7 +111535,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106712,7 +111563,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106739,7 +111591,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106766,7 +111619,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106793,7 +111647,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106820,7 +111675,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106847,7 +111703,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106874,7 +111731,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106901,7 +111759,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106928,7 +111787,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106955,7 +111815,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -106982,7 +111843,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107009,7 +111871,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107036,7 +111899,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107063,7 +111927,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107090,7 +111955,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107117,7 +111983,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107144,7 +112011,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107171,7 +112039,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107198,7 +112067,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107225,7 +112095,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107252,7 +112123,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107279,7 +112151,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107306,7 +112179,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107333,7 +112207,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107360,7 +112235,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107387,7 +112263,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107414,7 +112291,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107441,7 +112319,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107468,7 +112347,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107495,7 +112375,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107522,7 +112403,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107549,7 +112431,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107576,7 +112459,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107603,7 +112487,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107630,7 +112515,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107657,7 +112543,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107684,7 +112571,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107711,7 +112599,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107738,7 +112627,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107765,7 +112655,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107792,7 +112683,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107819,7 +112711,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107846,7 +112739,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107873,7 +112767,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107900,7 +112795,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107927,7 +112823,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107954,7 +112851,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -107981,7 +112879,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -108008,7 +112907,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -108035,7 +112935,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -108062,7 +112963,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -108089,7 +112991,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -108116,7 +113019,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -108143,7 +113047,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -108170,7 +113075,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -108197,7 +113103,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -108224,7 +113131,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -108251,7 +113159,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -108278,7 +113187,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -108305,7 +113215,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -108332,7 +113243,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -108359,7 +113271,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -108386,7 +113299,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -108413,7 +113327,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -108440,7 +113355,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -108467,7 +113383,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -108494,7 +113411,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -108521,7 +113439,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -108548,7 +113467,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -108575,7 +113495,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -108602,7 +113523,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -108629,7 +113551,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -108656,7 +113579,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -108683,7 +113607,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -108710,7 +113635,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -108737,7 +113663,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1040,No,-,5 @@ -108764,7 +113691,8 @@ T1223,No,-,5 T1158,No,-,5 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_activity_related_to_pass_the_hash_attacks.yml,3 T1550.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___detect_pass_hash.yml,3 -T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,4 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml,3 +T1564.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml,3 T1102.001,No,-,5 T1078.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_excessive_user_account_lockouts.yml,4 T1561.002,No,-,4 @@ -108789,8 +113717,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -108829,8 +113757,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -108869,8 +113797,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -108909,8 +113837,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -108949,8 +113877,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -108989,8 +113917,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -109029,8 +113957,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -109069,8 +113997,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -109109,8 +114037,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -109149,8 +114077,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -109189,8 +114117,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -109229,8 +114157,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -109269,8 +114197,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -109309,8 +114237,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -109349,8 +114277,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -109389,8 +114317,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -109429,8 +114357,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -109469,8 +114397,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -109509,8 +114437,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -109549,8 +114477,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -109589,8 +114517,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -109629,8 +114557,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -109669,8 +114597,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -109709,8 +114637,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -109749,8 +114677,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -109789,8 +114717,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -109829,8 +114757,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -109869,8 +114797,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -109909,8 +114837,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -109949,8 +114877,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -109989,8 +114917,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -110029,8 +114957,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -110069,8 +114997,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -110109,8 +115037,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -110149,8 +115077,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -110189,8 +115117,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -110229,8 +115157,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -110269,8 +115197,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -110309,8 +115237,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -110349,8 +115277,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -110389,8 +115317,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -110429,8 +115357,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -110469,8 +115397,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -110509,8 +115437,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -110549,8 +115477,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -110589,8 +115517,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -110629,8 +115557,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -110669,8 +115597,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -110709,8 +115637,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -110749,8 +115677,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -110789,8 +115717,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -110829,8 +115757,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -110869,8 +115797,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -110909,8 +115837,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -110949,8 +115877,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -110989,8 +115917,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -111029,8 +115957,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -111069,8 +115997,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -111109,8 +116037,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -111149,8 +116077,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -111189,8 +116117,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -111229,8 +116157,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -111269,8 +116197,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -111309,8 +116237,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -111349,8 +116277,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -111389,8 +116317,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -111429,8 +116357,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -111469,8 +116397,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -111509,8 +116437,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -111549,8 +116477,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -111589,8 +116517,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -111629,8 +116557,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -111669,8 +116597,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -111709,8 +116637,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -111749,8 +116677,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -111789,8 +116717,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -111829,8 +116757,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -111869,8 +116797,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -111909,8 +116837,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -111949,8 +116877,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -111989,8 +116917,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -112029,8 +116957,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -112069,8 +116997,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -112109,8 +117037,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -112149,8 +117077,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -112189,8 +117117,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -112229,8 +117157,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -112269,8 +117197,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -112309,8 +117237,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -112349,8 +117277,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -112389,8 +117317,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -112429,8 +117357,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -112469,8 +117397,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -112509,8 +117437,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -112549,8 +117477,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -112589,8 +117517,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -112629,8 +117557,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -112669,8 +117597,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -112709,8 +117637,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -112749,8 +117677,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -112789,8 +117717,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -112829,8 +117757,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -112869,8 +117797,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -112909,8 +117837,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -112949,8 +117877,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -112989,8 +117917,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -113029,8 +117957,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -113069,8 +117997,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -113109,8 +118037,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -113149,8 +118077,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -113189,8 +118117,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -113229,8 +118157,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -113269,8 +118197,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -113309,8 +118237,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -113349,8 +118277,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -113389,8 +118317,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -113429,8 +118357,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -113469,8 +118397,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -113509,8 +118437,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -113549,8 +118477,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -113589,8 +118517,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -113629,8 +118557,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -113669,8 +118597,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -113709,8 +118637,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -113749,8 +118677,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -113789,8 +118717,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -113829,8 +118757,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -113869,8 +118797,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -113909,8 +118837,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -113949,8 +118877,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -113989,8 +118917,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -114029,8 +118957,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -114069,8 +118997,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -114109,8 +119037,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -114149,8 +119077,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -114189,8 +119117,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -114229,8 +119157,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -114269,8 +119197,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -114309,8 +119237,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -114349,8 +119277,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -114389,8 +119317,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -114429,8 +119357,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -114469,8 +119397,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -114509,8 +119437,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -114549,8 +119477,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -114589,8 +119517,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -114629,8 +119557,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -114669,8 +119597,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -114709,8 +119637,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -114749,8 +119677,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -114789,8 +119717,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -114829,8 +119757,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -114869,8 +119797,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -114909,8 +119837,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -114949,8 +119877,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -114989,8 +119917,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -115029,8 +119957,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -115069,8 +119997,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -115109,8 +120037,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -115149,8 +120077,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -115189,8 +120117,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -115229,8 +120157,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -115269,8 +120197,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -115309,8 +120237,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -115349,8 +120277,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -115389,8 +120317,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -115429,8 +120357,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -115469,8 +120397,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -115509,8 +120437,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -115549,8 +120477,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -115589,8 +120517,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -115629,8 +120557,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -115669,8 +120597,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -115709,8 +120637,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -115749,8 +120677,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -115789,8 +120717,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -115829,8 +120757,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -115869,8 +120797,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -115909,8 +120837,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -115949,8 +120877,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -115989,8 +120917,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -116029,8 +120957,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -116069,8 +120997,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -116109,8 +121037,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -116149,8 +121077,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -116189,8 +121117,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -116229,8 +121157,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -116269,8 +121197,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -116309,8 +121237,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -116349,8 +121277,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -116389,8 +121317,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -116429,8 +121357,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -116469,8 +121397,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -116509,8 +121437,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -116549,8 +121477,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -116589,8 +121517,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -116629,8 +121557,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -116669,8 +121597,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -116709,8 +121637,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -116749,8 +121677,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -116789,8 +121717,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -116829,8 +121757,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -116869,8 +121797,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -116909,8 +121837,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -116949,8 +121877,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -116989,8 +121917,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -117029,8 +121957,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -117069,8 +121997,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -117109,8 +122037,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -117149,8 +122077,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -117189,8 +122117,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -117229,8 +122157,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -117269,8 +122197,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -117309,8 +122237,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -117349,8 +122277,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -117389,8 +122317,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -117429,8 +122357,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -117469,8 +122397,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -117509,8 +122437,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -117549,8 +122477,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -117589,8 +122517,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -117629,8 +122557,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -117669,8 +122597,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -117709,8 +122637,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -117749,8 +122677,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -117789,8 +122717,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -117829,8 +122757,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -117869,8 +122797,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -117909,8 +122837,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -117949,8 +122877,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -117989,8 +122917,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -118029,8 +122957,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -118069,8 +122997,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -118109,8 +123037,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -118149,8 +123077,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -118189,8 +123117,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -118229,8 +123157,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -118269,8 +123197,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -118309,8 +123237,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -118349,8 +123277,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -118389,8 +123317,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -118429,8 +123357,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -118469,8 +123397,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -118509,8 +123437,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -118549,8 +123477,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -118589,8 +123517,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -118629,8 +123557,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -118669,8 +123597,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -118709,8 +123637,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -118749,8 +123677,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -118789,8 +123717,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -118829,8 +123757,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -118869,8 +123797,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -118909,8 +123837,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -118949,8 +123877,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -118989,8 +123917,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -119029,8 +123957,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -119069,8 +123997,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -119109,8 +124037,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -119149,8 +124077,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -119189,8 +124117,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -119229,8 +124157,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -119269,8 +124197,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -119309,8 +124237,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -119349,8 +124277,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -119389,8 +124317,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -119429,8 +124357,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -119469,8 +124397,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -119509,8 +124437,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -119549,8 +124477,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -119589,8 +124517,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -119629,8 +124557,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -119669,8 +124597,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -119709,8 +124637,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -119749,8 +124677,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -119789,8 +124717,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -119829,8 +124757,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -119869,8 +124797,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -119909,8 +124837,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -119949,8 +124877,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -119989,8 +124917,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -120029,8 +124957,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -120069,8 +124997,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -120109,8 +125037,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -120149,8 +125077,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -120189,8 +125117,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -120229,8 +125157,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -120269,8 +125197,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -120309,8 +125237,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -120349,8 +125277,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -120389,8 +125317,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -120429,8 +125357,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -120469,8 +125397,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -120509,8 +125437,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -120549,8 +125477,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -120589,8 +125517,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -120629,8 +125557,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -120669,8 +125597,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -120709,8 +125637,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -120749,8 +125677,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -120789,8 +125717,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -120829,8 +125757,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -120869,8 +125797,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -120909,8 +125837,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -120949,8 +125877,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -120989,8 +125917,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -121029,8 +125957,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -121069,8 +125997,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -121109,8 +126037,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -121149,8 +126077,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -121189,8 +126117,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -121229,8 +126157,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -121269,8 +126197,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -121309,8 +126237,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -121349,8 +126277,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -121389,8 +126317,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -121429,8 +126357,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -121469,8 +126397,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -121509,8 +126437,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -121549,8 +126477,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -121589,8 +126517,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -121629,8 +126557,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -121669,8 +126597,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -121709,8 +126637,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -121749,8 +126677,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -121789,8 +126717,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -121829,8 +126757,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -121869,8 +126797,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -121909,8 +126837,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -121949,8 +126877,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -121989,8 +126917,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -122029,8 +126957,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -122069,8 +126997,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -122109,8 +127037,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -122149,8 +127077,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -122189,8 +127117,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -122229,8 +127157,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -122269,8 +127197,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -122309,8 +127237,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -122349,8 +127277,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -122389,8 +127317,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -122429,8 +127357,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -122469,8 +127397,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -122509,8 +127437,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -122549,8 +127477,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -122589,8 +127517,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -122629,8 +127557,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -122669,8 +127597,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -122709,8 +127637,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -122749,8 +127677,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -122789,8 +127717,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -122829,8 +127757,8 @@ T1039,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa T1055.012,No,-,4 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,-3 -T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,-3 +T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,-3 T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,-3 @@ -122879,7 +127807,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -122924,7 +127854,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -122969,7 +127901,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -123014,7 +127948,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -123059,7 +127995,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -123104,7 +128042,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -123149,7 +128089,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -123194,7 +128136,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -123239,7 +128183,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -123284,7 +128230,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -123329,7 +128277,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -123374,7 +128324,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -123419,7 +128371,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -123464,7 +128418,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -123509,7 +128465,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -123554,7 +128512,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -123599,7 +128559,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -123644,7 +128606,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -123689,7 +128653,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -123734,7 +128700,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -123779,7 +128747,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -123824,7 +128794,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -123869,7 +128841,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -123914,7 +128888,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -123959,7 +128935,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -124004,7 +128982,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -124049,7 +129029,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -124094,7 +129076,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -124139,7 +129123,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -124184,7 +129170,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -124229,7 +129217,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -124274,7 +129264,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -124319,7 +129311,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -124364,7 +129358,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -124409,7 +129405,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -124454,7 +129452,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -124499,7 +129499,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -124544,7 +129546,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -124589,7 +129593,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -124634,7 +129640,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -124679,7 +129687,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -124724,7 +129734,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -124769,7 +129781,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -124814,7 +129828,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -124859,7 +129875,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -124904,7 +129922,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -124949,7 +129969,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -124994,7 +130016,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -125039,7 +130063,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -125084,7 +130110,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -125129,7 +130157,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -125174,7 +130204,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -125219,7 +130251,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -125264,7 +130298,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -125309,7 +130345,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -125354,7 +130392,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -125399,7 +130439,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -125444,7 +130486,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -125489,7 +130533,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -125534,7 +130580,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -125579,7 +130627,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -125624,7 +130674,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -125669,7 +130721,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -125714,7 +130768,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -125759,7 +130815,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -125804,7 +130862,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -125849,7 +130909,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -125894,7 +130956,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -125939,7 +131003,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -125984,7 +131050,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -126029,7 +131097,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -126074,7 +131144,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -126119,7 +131191,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -126164,7 +131238,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -126209,7 +131285,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -126254,7 +131332,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -126299,7 +131379,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -126344,7 +131426,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -126389,7 +131473,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -126434,7 +131520,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -126479,7 +131567,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -126524,7 +131614,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -126569,7 +131661,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -126614,7 +131708,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -126659,7 +131755,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -126704,7 +131802,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -126749,7 +131849,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -126794,7 +131896,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -126839,7 +131943,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -126884,7 +131990,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -126929,7 +132037,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -126974,7 +132084,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -127019,7 +132131,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -127064,7 +132178,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -127109,7 +132225,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -127154,7 +132272,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -127199,7 +132319,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -127244,7 +132366,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -127289,7 +132413,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -127334,7 +132460,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -127379,7 +132507,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -127424,7 +132554,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -127469,7 +132601,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -127514,7 +132648,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -127559,7 +132695,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -127604,7 +132742,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -127649,7 +132789,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -127694,7 +132836,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -127739,7 +132883,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -127784,7 +132930,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -127829,7 +132977,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -127874,7 +133024,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -127919,7 +133071,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -127964,7 +133118,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -128009,7 +133165,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -128054,7 +133212,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -128099,7 +133259,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -128144,7 +133306,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -128189,7 +133353,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -128234,7 +133400,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -128279,7 +133447,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -128324,7 +133494,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -128369,7 +133541,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -128414,7 +133588,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -128459,7 +133635,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -128504,7 +133682,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -128549,7 +133729,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -128594,7 +133776,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -128639,7 +133823,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -128684,7 +133870,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -128729,7 +133917,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -128774,7 +133964,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -128819,7 +134011,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -128864,7 +134058,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -128909,7 +134105,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -128954,7 +134152,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -128999,7 +134199,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -129044,7 +134246,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -129089,7 +134293,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -129134,7 +134340,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -129179,7 +134387,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -129224,7 +134434,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -129269,7 +134481,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -129314,7 +134528,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -129359,7 +134575,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -129404,7 +134622,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -129449,7 +134669,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -129494,7 +134716,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -129539,7 +134763,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -129584,7 +134810,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -129629,7 +134857,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -129674,7 +134904,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -129719,7 +134951,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -129764,7 +134998,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -129809,7 +135045,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -129854,7 +135092,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -129899,7 +135139,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -129944,7 +135186,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -129989,7 +135233,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -130034,7 +135280,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -130079,7 +135327,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -130124,7 +135374,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -130169,7 +135421,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -130214,7 +135468,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -130259,7 +135515,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -130304,7 +135562,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -130349,7 +135609,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -130394,7 +135656,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -130439,7 +135703,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -130484,7 +135750,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -130529,7 +135797,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -130574,7 +135844,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -130619,7 +135891,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -130664,7 +135938,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -130709,7 +135985,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -130754,7 +136032,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -130799,7 +136079,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -130844,7 +136126,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -130889,7 +136173,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -130934,7 +136220,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -130979,7 +136267,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -131024,7 +136314,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -131069,7 +136361,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -131114,7 +136408,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -131159,7 +136455,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -131204,7 +136502,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -131249,7 +136549,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -131294,7 +136596,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -131339,7 +136643,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -131384,7 +136690,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -131429,7 +136737,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -131474,7 +136784,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -131519,7 +136831,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -131564,7 +136878,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -131609,7 +136925,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -131654,7 +136972,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -131699,7 +137019,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -131744,7 +137066,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -131789,7 +137113,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -131834,7 +137160,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -131879,7 +137207,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -131924,7 +137254,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -131969,7 +137301,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -132014,7 +137348,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -132059,7 +137395,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -132104,7 +137442,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -132149,7 +137489,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -132194,7 +137536,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -132239,7 +137583,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -132284,7 +137630,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -132329,7 +137677,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -132374,7 +137724,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -132419,7 +137771,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -132464,7 +137818,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -132509,7 +137865,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -132554,7 +137912,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -132599,7 +137959,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -132644,7 +138006,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -132689,7 +138053,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -132734,7 +138100,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -132779,7 +138147,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -132824,7 +138194,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -132869,7 +138241,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -132914,7 +138288,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -132959,7 +138335,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -133004,7 +138382,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -133049,7 +138429,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -133094,7 +138476,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -133139,7 +138523,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -133184,7 +138570,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -133229,7 +138617,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -133274,7 +138664,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -133319,7 +138711,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -133364,7 +138758,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -133409,7 +138805,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -133454,7 +138852,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -133499,7 +138899,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -133544,7 +138946,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -133589,7 +138993,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -133634,7 +139040,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -133679,7 +139087,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -133724,7 +139134,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -133769,7 +139181,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -133814,7 +139228,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -133859,7 +139275,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -133904,7 +139322,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -133949,7 +139369,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -133994,7 +139416,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -134039,7 +139463,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -134084,7 +139510,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -134129,7 +139557,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -134174,7 +139604,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -134219,7 +139651,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -134264,7 +139698,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -134309,7 +139745,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -134354,7 +139792,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -134399,7 +139839,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -134444,7 +139886,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -134489,7 +139933,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -134534,7 +139980,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -134579,7 +140027,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -134624,7 +140074,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -134669,7 +140121,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -134714,7 +140168,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -134759,7 +140215,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -134804,7 +140262,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -134849,7 +140309,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -134894,7 +140356,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -134939,7 +140403,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -134984,7 +140450,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -135029,7 +140497,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -135074,7 +140544,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -135119,7 +140591,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -135164,7 +140638,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -135209,7 +140685,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -135254,7 +140732,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -135299,7 +140779,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -135344,7 +140826,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -135389,7 +140873,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -135434,7 +140920,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -135479,7 +140967,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -135524,7 +141014,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -135569,7 +141061,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -135614,7 +141108,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -135659,7 +141155,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -135704,7 +141202,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -135749,7 +141249,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -135794,7 +141296,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -135839,7 +141343,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -135884,7 +141390,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -135929,7 +141437,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -135974,7 +141484,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -136019,7 +141531,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -136064,7 +141578,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -136109,7 +141625,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -136154,7 +141672,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -136199,7 +141719,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -136244,7 +141766,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -136289,7 +141813,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -136334,7 +141860,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -136379,7 +141907,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -136424,7 +141954,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -136469,7 +142001,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -136514,7 +142048,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -136559,7 +142095,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -136604,7 +142142,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -136649,7 +142189,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -136694,7 +142236,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -136739,7 +142283,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -136784,7 +142330,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -136829,7 +142377,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -136874,7 +142424,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -136919,7 +142471,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -136964,7 +142518,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -137009,7 +142565,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -137054,7 +142612,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -137099,7 +142659,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -137144,7 +142706,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -137189,7 +142753,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -137234,7 +142800,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -137279,7 +142847,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -137324,7 +142894,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -137369,7 +142941,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -137414,7 +142988,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -137459,7 +143035,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -137504,7 +143082,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -137549,7 +143129,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -137594,7 +143176,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -137639,7 +143223,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -137684,7 +143270,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -137729,7 +143317,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -137774,7 +143364,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -137819,7 +143411,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -137864,7 +143458,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -137909,7 +143505,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -137954,7 +143552,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -137999,7 +143599,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -138044,7 +143646,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -138089,7 +143693,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -138134,7 +143740,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -138179,7 +143787,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -138224,7 +143834,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -138269,7 +143881,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -138314,7 +143928,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -138359,7 +143975,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -138404,7 +144022,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -138449,7 +144069,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -138494,7 +144116,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -138539,7 +144163,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -138584,7 +144210,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -138629,7 +144257,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -138674,7 +144304,9 @@ T1486,Yes,https://github.com/splunk/security_content/blob/develop/detections/sam T1573,No,-,3 T1028,No,-,3 T1027.004,No,-,3 -T1197,No,-,3 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml,0 +T1197,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml,0 T1585,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml,2 T1500,No,-,3 T1485,Yes,https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml,0 @@ -138713,8 +144345,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -138758,8 +144391,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -138803,8 +144437,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -138848,8 +144483,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -138893,8 +144529,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -138938,8 +144575,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -138983,8 +144621,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -139028,8 +144667,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -139073,8 +144713,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -139118,8 +144759,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -139163,8 +144805,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -139208,8 +144851,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -139253,8 +144897,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -139298,8 +144943,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -139343,8 +144989,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -139388,8 +145035,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -139433,8 +145081,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -139478,8 +145127,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -139523,8 +145173,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -139568,8 +145219,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -139613,8 +145265,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -139658,8 +145311,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -139703,8 +145357,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -139748,8 +145403,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -139793,8 +145449,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -139838,8 +145495,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -139883,8 +145541,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -139928,8 +145587,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -139973,8 +145633,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -140018,8 +145679,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -140063,8 +145725,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -140108,8 +145771,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -140153,8 +145817,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -140198,8 +145863,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -140243,8 +145909,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -140288,8 +145955,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -140333,8 +146001,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -140378,8 +146047,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -140423,8 +146093,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -140468,8 +146139,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -140513,8 +146185,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -140558,8 +146231,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -140603,8 +146277,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -140648,8 +146323,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -140693,8 +146369,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -140738,8 +146415,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -140783,8 +146461,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -140828,8 +146507,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -140873,8 +146553,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -140918,8 +146599,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -140963,8 +146645,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -141008,8 +146691,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -141053,8 +146737,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -141098,8 +146783,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -141143,8 +146829,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -141188,8 +146875,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -141233,8 +146921,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -141278,8 +146967,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -141323,8 +147013,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -141368,8 +147059,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -141413,8 +147105,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -141458,8 +147151,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -141503,8 +147197,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -141548,8 +147243,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -141593,8 +147289,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -141638,8 +147335,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -141683,8 +147381,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -141728,8 +147427,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -141773,8 +147473,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -141818,8 +147519,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -141863,8 +147565,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -141908,8 +147611,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -141953,8 +147657,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -141998,8 +147703,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -142043,8 +147749,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -142088,8 +147795,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -142133,8 +147841,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -142178,8 +147887,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -142223,8 +147933,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -142268,8 +147979,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -142313,8 +148025,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -142358,8 +148071,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -142403,8 +148117,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -142448,8 +148163,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -142493,8 +148209,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -142538,8 +148255,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -142583,8 +148301,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -142628,8 +148347,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -142673,8 +148393,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -142718,8 +148439,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -142763,8 +148485,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -142808,8 +148531,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -142853,8 +148577,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -142898,8 +148623,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -142943,8 +148669,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -142988,8 +148715,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -143033,8 +148761,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -143078,8 +148807,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -143123,8 +148853,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -143168,8 +148899,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -143213,8 +148945,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -143258,8 +148991,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -143303,8 +149037,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -143348,8 +149083,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -143393,8 +149129,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -143438,8 +149175,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -143483,8 +149221,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -143528,8 +149267,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -143573,8 +149313,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -143618,8 +149359,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -143663,8 +149405,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -143708,8 +149451,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -143753,8 +149497,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -143798,8 +149543,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -143843,8 +149589,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -143888,8 +149635,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -143933,8 +149681,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -143978,8 +149727,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -144023,8 +149773,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -144068,8 +149819,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -144113,8 +149865,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -144158,8 +149911,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -144203,8 +149957,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -144248,8 +150003,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -144293,8 +150049,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -144338,8 +150095,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -144383,8 +150141,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -144428,8 +150187,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -144473,8 +150233,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -144518,8 +150279,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -144563,8 +150325,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -144608,8 +150371,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -144653,8 +150417,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -144698,8 +150463,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -144743,8 +150509,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -144788,8 +150555,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -144833,8 +150601,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -144878,8 +150647,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -144923,8 +150693,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -144968,8 +150739,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -145013,8 +150785,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -145058,8 +150831,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -145103,8 +150877,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -145148,8 +150923,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -145193,8 +150969,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -145238,8 +151015,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -145283,8 +151061,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -145328,8 +151107,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -145373,8 +151153,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -145418,8 +151199,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -145463,8 +151245,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -145508,8 +151291,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -145553,8 +151337,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -145598,8 +151383,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -145643,8 +151429,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -145688,8 +151475,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -145733,8 +151521,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -145778,8 +151567,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -145823,8 +151613,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -145868,8 +151659,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -145913,8 +151705,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -145958,8 +151751,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -146003,8 +151797,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -146048,8 +151843,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -146093,8 +151889,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -146138,8 +151935,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -146183,8 +151981,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -146228,8 +152027,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -146273,8 +152073,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -146318,8 +152119,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -146363,8 +152165,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -146408,8 +152211,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -146453,8 +152257,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -146498,8 +152303,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -146543,8 +152349,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -146588,8 +152395,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -146633,8 +152441,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -146678,8 +152487,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -146723,8 +152533,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -146768,8 +152579,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -146813,8 +152625,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -146858,8 +152671,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -146903,8 +152717,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -146948,8 +152763,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -146993,8 +152809,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -147038,8 +152855,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -147083,8 +152901,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -147128,8 +152947,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -147173,8 +152993,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -147218,8 +153039,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -147263,8 +153085,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -147308,8 +153131,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -147353,8 +153177,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -147398,8 +153223,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -147443,8 +153269,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -147488,8 +153315,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -147533,8 +153361,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -147578,8 +153407,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -147623,8 +153453,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -147668,8 +153499,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -147713,8 +153545,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -147758,8 +153591,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -147803,8 +153637,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -147848,8 +153683,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -147893,8 +153729,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -147938,8 +153775,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -147983,8 +153821,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -148028,8 +153867,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -148073,8 +153913,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -148118,8 +153959,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -148163,8 +154005,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -148208,8 +154051,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -148253,8 +154097,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -148298,8 +154143,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -148343,8 +154189,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -148388,8 +154235,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -148433,8 +154281,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -148478,8 +154327,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -148523,8 +154373,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -148568,8 +154419,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -148613,8 +154465,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -148658,8 +154511,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -148703,8 +154557,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -148748,8 +154603,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -148793,8 +154649,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -148838,8 +154695,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -148883,8 +154741,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -148928,8 +154787,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -148973,8 +154833,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -149018,8 +154879,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -149063,8 +154925,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -149108,8 +154971,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -149153,8 +155017,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -149198,8 +155063,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -149243,8 +155109,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -149288,8 +155155,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -149333,8 +155201,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -149378,8 +155247,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -149423,8 +155293,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -149468,8 +155339,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -149513,8 +155385,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -149558,8 +155431,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -149603,8 +155477,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -149648,8 +155523,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -149693,8 +155569,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -149738,8 +155615,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -149783,8 +155661,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -149828,8 +155707,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -149873,8 +155753,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -149918,8 +155799,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -149963,8 +155845,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -150008,8 +155891,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -150053,8 +155937,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -150098,8 +155983,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -150143,8 +156029,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -150188,8 +156075,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -150233,8 +156121,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -150278,8 +156167,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -150323,8 +156213,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -150368,8 +156259,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -150413,8 +156305,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -150458,8 +156351,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -150503,8 +156397,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -150548,8 +156443,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -150593,8 +156489,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -150638,8 +156535,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -150683,8 +156581,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -150728,8 +156627,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -150773,8 +156673,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -150818,8 +156719,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -150863,8 +156765,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -150908,8 +156811,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -150953,8 +156857,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -150998,8 +156903,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -151043,8 +156949,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -151088,8 +156995,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -151133,8 +157041,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -151178,8 +157087,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -151223,8 +157133,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -151268,8 +157179,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -151313,8 +157225,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -151358,8 +157271,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -151403,8 +157317,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -151448,8 +157363,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -151493,8 +157409,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -151538,8 +157455,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -151583,8 +157501,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -151628,8 +157547,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -151673,8 +157593,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -151718,8 +157639,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -151763,8 +157685,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -151808,8 +157731,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -151853,8 +157777,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -151898,8 +157823,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -151943,8 +157869,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -151988,8 +157915,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -152033,8 +157961,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -152078,8 +158007,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -152123,8 +158053,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -152168,8 +158099,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -152213,8 +158145,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -152258,8 +158191,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -152303,8 +158237,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -152348,8 +158283,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -152393,8 +158329,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -152438,8 +158375,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -152483,8 +158421,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -152528,8 +158467,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -152573,8 +158513,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -152618,8 +158559,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -152663,8 +158605,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -152708,8 +158651,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -152753,8 +158697,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -152798,8 +158743,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -152843,8 +158789,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -152888,8 +158835,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -152933,8 +158881,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -152978,8 +158927,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -153023,8 +158973,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -153068,8 +159019,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -153113,8 +159065,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -153158,8 +159111,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -153203,8 +159157,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -153248,8 +159203,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -153293,8 +159249,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -153338,8 +159295,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -153383,8 +159341,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -153428,8 +159387,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -153473,8 +159433,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -153518,8 +159479,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -153563,8 +159525,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -153608,8 +159571,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -153653,8 +159617,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -153698,8 +159663,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -153743,8 +159709,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -153788,8 +159755,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -153833,8 +159801,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -153878,8 +159847,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -153923,8 +159893,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -153968,8 +159939,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -154013,8 +159985,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -154058,8 +160031,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -154103,8 +160077,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -154148,8 +160123,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -154193,8 +160169,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -154238,8 +160215,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -154283,8 +160261,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -154328,8 +160307,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -154373,8 +160353,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -154418,8 +160399,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -154463,8 +160445,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 @@ -154508,8 +160491,9 @@ T1552.004,No,-,2 T1583.004,No,-,2 T1134.002,No,-,2 T1125,No,-,2 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,0 -T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,0 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml,-1 +T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,-1 T1542.002,No,-,2 T1583.003,No,-,2 T1191,No,-,2 diff --git a/docs/mitre-map/detections.json b/docs/mitre-map/detections.json index e6a83917b9..9de8d21fc9 100644 --- a/docs/mitre-map/detections.json +++ b/docs/mitre-map/detections.json @@ -15494,2115 +15494,2115 @@ }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1105", - "score": 40, + "score": 39, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/certutil_download_with_verifyctl_and_split_arguments.yml" }, { "techniqueID": "T1060", @@ -53067,169 +53067,94 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { - "techniqueID": "T1016", - "score": 22, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml" - }, - { - "techniqueID": "T1057", - "score": 21, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml" - }, - { - "techniqueID": "T1203", - "score": 22, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" - }, - { - "techniqueID": "T1016", - "score": 22, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml" - }, - { - "techniqueID": "T1057", - "score": 21, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml" - }, - { - "techniqueID": "T1203", - "score": 22, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" - }, - { - "techniqueID": "T1016", - "score": 22, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml" - }, - { - "techniqueID": "T1057", - "score": 21, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml" - }, - { - "techniqueID": "T1203", - "score": 22, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" - }, - { - "techniqueID": "T1016", - "score": 22, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml" - }, - { - "techniqueID": "T1057", - "score": 21, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml" - }, - { - "techniqueID": "T1203", - "score": 22, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" - }, - { - "techniqueID": "T1016", - "score": 22, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml" - }, - { - "techniqueID": "T1057", - "score": 21, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml" - }, - { - "techniqueID": "T1203", - "score": 22, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" - }, - { - "techniqueID": "T1036.005", + "techniqueID": "T1016", "score": 22, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml" }, { - "techniqueID": "T1036.005", - "score": 22, - "showSubtechniques": false + "techniqueID": "T1057", + "score": 21, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml" }, { - "techniqueID": "T1036.005", + "techniqueID": "T1203", "score": 22, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { - "techniqueID": "T1036.005", + "techniqueID": "T1016", "score": 22, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml" }, { - "techniqueID": "T1036.005", - "score": 22, - "showSubtechniques": false + "techniqueID": "T1057", + "score": 21, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml" }, { - "techniqueID": "T1036.005", + "techniqueID": "T1203", "score": 22, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { - "techniqueID": "T1036.005", + "techniqueID": "T1016", "score": 22, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml" }, { - "techniqueID": "T1036.005", - "score": 22, - "showSubtechniques": false + "techniqueID": "T1057", + "score": 21, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml" }, { - "techniqueID": "T1036.005", + "techniqueID": "T1203", "score": 22, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { - "techniqueID": "T1036.005", + "techniqueID": "T1016", "score": 22, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml" }, { - "techniqueID": "T1036.005", - "score": 22, - "showSubtechniques": false + "techniqueID": "T1057", + "score": 21, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml" }, { - "techniqueID": "T1036.005", + "techniqueID": "T1203", "score": 22, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { - "techniqueID": "T1036.005", + "techniqueID": "T1016", "score": 22, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_processes_used_for_system_network_configuration_discovery.yml" }, { - "techniqueID": "T1036.005", - "score": 22, - "showSubtechniques": false + "techniqueID": "T1057", + "score": 21, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml" }, { - "techniqueID": "T1036.005", + "techniqueID": "T1203", "score": 22, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { "techniqueID": "T1036.005", @@ -54917,195 +54842,78 @@ "showSubtechniques": false }, { - "techniqueID": "T1055", - "score": 12, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml" - }, - { - "techniqueID": "T1076", - "score": 21, - "showSubtechniques": false - }, - { - "techniqueID": "T1021.001", - "score": 21, - "showSubtechniques": false - }, - { - "techniqueID": "T1055", - "score": 12, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml" - }, - { - "techniqueID": "T1076", - "score": 21, - "showSubtechniques": false - }, - { - "techniqueID": "T1021.001", - "score": 21, - "showSubtechniques": false - }, - { - "techniqueID": "T1055", - "score": 12, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml" - }, - { - "techniqueID": "T1076", - "score": 21, - "showSubtechniques": false - }, - { - "techniqueID": "T1021.001", - "score": 21, - "showSubtechniques": false - }, - { - "techniqueID": "T1055", - "score": 12, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml" - }, - { - "techniqueID": "T1076", - "score": 21, - "showSubtechniques": false - }, - { - "techniqueID": "T1021.001", - "score": 21, - "showSubtechniques": false - }, - { - "techniqueID": "T1055", - "score": 12, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml" - }, - { - "techniqueID": "T1076", - "score": 21, - "showSubtechniques": false - }, - { - "techniqueID": "T1021.001", - "score": 21, + "techniqueID": "T1036.005", + "score": 22, "showSubtechniques": false }, { - "techniqueID": "T1055", - "score": 12, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml" - }, - { - "techniqueID": "T1076", - "score": 21, + "techniqueID": "T1036.005", + "score": 22, "showSubtechniques": false }, { - "techniqueID": "T1021.001", - "score": 21, + "techniqueID": "T1036.005", + "score": 22, "showSubtechniques": false }, { - "techniqueID": "T1055", - "score": 12, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml" - }, - { - "techniqueID": "T1076", - "score": 21, + "techniqueID": "T1036.005", + "score": 22, "showSubtechniques": false }, { - "techniqueID": "T1021.001", - "score": 21, + "techniqueID": "T1036.005", + "score": 22, "showSubtechniques": false }, { - "techniqueID": "T1055", - "score": 12, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml" - }, - { - "techniqueID": "T1076", - "score": 21, + "techniqueID": "T1036.005", + "score": 22, "showSubtechniques": false }, { - "techniqueID": "T1021.001", - "score": 21, + "techniqueID": "T1036.005", + "score": 22, "showSubtechniques": false }, { - "techniqueID": "T1055", - "score": 12, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml" - }, - { - "techniqueID": "T1076", - "score": 21, + "techniqueID": "T1036.005", + "score": 22, "showSubtechniques": false }, { - "techniqueID": "T1021.001", - "score": 21, + "techniqueID": "T1036.005", + "score": 22, "showSubtechniques": false }, { - "techniqueID": "T1055", - "score": 12, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml" - }, - { - "techniqueID": "T1076", - "score": 21, + "techniqueID": "T1036.005", + "score": 22, "showSubtechniques": false }, { - "techniqueID": "T1021.001", - "score": 21, + "techniqueID": "T1036.005", + "score": 22, "showSubtechniques": false }, { - "techniqueID": "T1055", - "score": 12, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml" - }, - { - "techniqueID": "T1076", - "score": 21, + "techniqueID": "T1036.005", + "score": 22, "showSubtechniques": false }, { - "techniqueID": "T1021.001", - "score": 21, + "techniqueID": "T1036.005", + "score": 22, "showSubtechniques": false }, { - "techniqueID": "T1055", - "score": 12, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml" - }, - { - "techniqueID": "T1076", - "score": 21, + "techniqueID": "T1036.005", + "score": 22, "showSubtechniques": false }, { - "techniqueID": "T1021.001", - "score": 21, + "techniqueID": "T1036.005", + "score": 22, "showSubtechniques": false }, { @@ -60549,273 +60357,195 @@ "showSubtechniques": false }, { - "techniqueID": "T1056.001", - "score": 20, - "showSubtechniques": false - }, - { - "techniqueID": "T1140", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml" - }, - { - "techniqueID": "T1059", - "score": 16, + "techniqueID": "T1055", + "score": 12, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml" - }, - { - "techniqueID": "T1018", - "score": 20, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml" }, { - "techniqueID": "T1204.001", - "score": 20, + "techniqueID": "T1076", + "score": 21, "showSubtechniques": false }, { - "techniqueID": "T1056.001", - "score": 20, + "techniqueID": "T1021.001", + "score": 21, "showSubtechniques": false }, { - "techniqueID": "T1140", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml" - }, - { - "techniqueID": "T1059", - "score": 16, + "techniqueID": "T1055", + "score": 12, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml" - }, - { - "techniqueID": "T1018", - "score": 20, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml" }, { - "techniqueID": "T1204.001", - "score": 20, + "techniqueID": "T1076", + "score": 21, "showSubtechniques": false }, { - "techniqueID": "T1056.001", - "score": 20, + "techniqueID": "T1021.001", + "score": 21, "showSubtechniques": false }, { - "techniqueID": "T1140", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml" - }, - { - "techniqueID": "T1059", - "score": 16, + "techniqueID": "T1055", + "score": 12, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml" - }, - { - "techniqueID": "T1018", - "score": 20, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml" }, { - "techniqueID": "T1204.001", - "score": 20, + "techniqueID": "T1076", + "score": 21, "showSubtechniques": false }, { - "techniqueID": "T1056.001", - "score": 20, + "techniqueID": "T1021.001", + "score": 21, "showSubtechniques": false }, { - "techniqueID": "T1140", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml" - }, - { - "techniqueID": "T1059", - "score": 16, + "techniqueID": "T1055", + "score": 12, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml" - }, - { - "techniqueID": "T1018", - "score": 20, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml" }, { - "techniqueID": "T1204.001", - "score": 20, + "techniqueID": "T1076", + "score": 21, "showSubtechniques": false }, { - "techniqueID": "T1056.001", - "score": 20, + "techniqueID": "T1021.001", + "score": 21, "showSubtechniques": false }, { - "techniqueID": "T1140", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml" - }, - { - "techniqueID": "T1059", - "score": 16, + "techniqueID": "T1055", + "score": 12, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml" - }, - { - "techniqueID": "T1018", - "score": 20, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml" }, { - "techniqueID": "T1204.001", - "score": 20, + "techniqueID": "T1076", + "score": 21, "showSubtechniques": false }, { - "techniqueID": "T1056.001", - "score": 20, + "techniqueID": "T1021.001", + "score": 21, "showSubtechniques": false }, { - "techniqueID": "T1140", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml" - }, - { - "techniqueID": "T1059", - "score": 16, + "techniqueID": "T1055", + "score": 12, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml" - }, - { - "techniqueID": "T1018", - "score": 20, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml" }, { - "techniqueID": "T1204.001", - "score": 20, + "techniqueID": "T1076", + "score": 21, "showSubtechniques": false }, { - "techniqueID": "T1056.001", - "score": 20, + "techniqueID": "T1021.001", + "score": 21, "showSubtechniques": false }, { - "techniqueID": "T1140", - "score": 19, + "techniqueID": "T1055", + "score": 12, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml" }, { - "techniqueID": "T1059", - "score": 16, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml" + "techniqueID": "T1076", + "score": 21, + "showSubtechniques": false }, { - "techniqueID": "T1018", - "score": 20, + "techniqueID": "T1021.001", + "score": 21, "showSubtechniques": false }, { - "techniqueID": "T1204.001", - "score": 20, - "showSubtechniques": false + "techniqueID": "T1055", + "score": 12, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml" }, { - "techniqueID": "T1056.001", - "score": 20, + "techniqueID": "T1076", + "score": 21, "showSubtechniques": false }, { - "techniqueID": "T1140", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml" + "techniqueID": "T1021.001", + "score": 21, + "showSubtechniques": false }, { - "techniqueID": "T1059", - "score": 16, + "techniqueID": "T1055", + "score": 12, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml" - }, - { - "techniqueID": "T1018", - "score": 20, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml" }, { - "techniqueID": "T1204.001", - "score": 20, + "techniqueID": "T1076", + "score": 21, "showSubtechniques": false }, { - "techniqueID": "T1056.001", - "score": 20, + "techniqueID": "T1021.001", + "score": 21, "showSubtechniques": false }, { - "techniqueID": "T1140", - "score": 19, + "techniqueID": "T1055", + "score": 12, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml" }, { - "techniqueID": "T1059", - "score": 16, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml" + "techniqueID": "T1076", + "score": 21, + "showSubtechniques": false }, { - "techniqueID": "T1018", - "score": 20, + "techniqueID": "T1021.001", + "score": 21, "showSubtechniques": false }, { - "techniqueID": "T1204.001", - "score": 20, - "showSubtechniques": false + "techniqueID": "T1055", + "score": 12, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml" }, { - "techniqueID": "T1056.001", - "score": 20, + "techniqueID": "T1076", + "score": 21, "showSubtechniques": false }, { - "techniqueID": "T1140", - "score": 19, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml" + "techniqueID": "T1021.001", + "score": 21, + "showSubtechniques": false }, { - "techniqueID": "T1059", - "score": 16, + "techniqueID": "T1055", + "score": 12, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml" }, { - "techniqueID": "T1018", - "score": 20, + "techniqueID": "T1076", + "score": 21, "showSubtechniques": false }, { - "techniqueID": "T1204.001", - "score": 20, + "techniqueID": "T1021.001", + "score": 21, "showSubtechniques": false }, { @@ -70053,89 +69783,274 @@ "showSubtechniques": false }, { - "techniqueID": "T1047", - "score": 14, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": false }, { - "techniqueID": "T1033", + "techniqueID": "T1140", "score": 19, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml" + }, + { + "techniqueID": "T1059", + "score": 16, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml" + }, + { + "techniqueID": "T1018", + "score": 20, "showSubtechniques": false }, { - "techniqueID": "T1189", - "score": 18, + "techniqueID": "T1204.001", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1140", + "score": 19, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml" }, { - "techniqueID": "T1047", - "score": 14, + "techniqueID": "T1059", + "score": 16, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml" }, { - "techniqueID": "T1033", + "techniqueID": "T1018", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1204.001", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1140", "score": 19, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml" + }, + { + "techniqueID": "T1059", + "score": 16, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml" + }, + { + "techniqueID": "T1018", + "score": 20, "showSubtechniques": false }, { - "techniqueID": "T1189", - "score": 18, + "techniqueID": "T1204.001", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1140", + "score": 19, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml" }, { - "techniqueID": "T1047", - "score": 14, + "techniqueID": "T1059", + "score": 16, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml" }, { - "techniqueID": "T1033", + "techniqueID": "T1018", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1204.001", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1140", "score": 19, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml" + }, + { + "techniqueID": "T1059", + "score": 16, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml" + }, + { + "techniqueID": "T1018", + "score": 20, "showSubtechniques": false }, { - "techniqueID": "T1189", - "score": 18, + "techniqueID": "T1204.001", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1140", + "score": 19, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml" }, { - "techniqueID": "T1047", - "score": 14, + "techniqueID": "T1059", + "score": 16, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml" }, { - "techniqueID": "T1033", + "techniqueID": "T1018", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1204.001", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1140", "score": 19, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml" + }, + { + "techniqueID": "T1059", + "score": 16, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml" + }, + { + "techniqueID": "T1018", + "score": 20, "showSubtechniques": false }, { - "techniqueID": "T1189", - "score": 18, + "techniqueID": "T1204.001", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1140", + "score": 19, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml" }, { - "techniqueID": "T1047", - "score": 14, + "techniqueID": "T1059", + "score": 16, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml" }, { - "techniqueID": "T1033", + "techniqueID": "T1018", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1204.001", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1140", "score": 19, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml" + }, + { + "techniqueID": "T1059", + "score": 16, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml" + }, + { + "techniqueID": "T1018", + "score": 20, "showSubtechniques": false }, { - "techniqueID": "T1189", - "score": 18, + "techniqueID": "T1204.001", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1056.001", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1140", + "score": 19, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/certutil_with_decode_argument.yml" + }, + { + "techniqueID": "T1059", + "score": 16, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml" + }, + { + "techniqueID": "T1018", + "score": 20, + "showSubtechniques": false + }, + { + "techniqueID": "T1204.001", + "score": 20, + "showSubtechniques": false }, { "techniqueID": "T1047", @@ -76037,34 +75952,89 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, { - "techniqueID": "T1560.001", - "score": 18, + "techniqueID": "T1047", + "score": 14, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1033", + "score": 19, "showSubtechniques": false }, { - "techniqueID": "T1560.001", + "techniqueID": "T1189", "score": 18, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1047", + "score": 14, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1033", + "score": 19, "showSubtechniques": false }, { - "techniqueID": "T1560.001", + "techniqueID": "T1189", "score": 18, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1047", + "score": 14, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1033", + "score": 19, "showSubtechniques": false }, { - "techniqueID": "T1560.001", + "techniqueID": "T1189", "score": 18, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1047", + "score": 14, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1033", + "score": 19, "showSubtechniques": false }, { - "techniqueID": "T1560.001", + "techniqueID": "T1189", "score": 18, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" + }, + { + "techniqueID": "T1047", + "score": 14, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/remote_wmi_command_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/process_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/remote_process_instantiation_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/script_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1033", + "score": 19, "showSubtechniques": false }, { - "techniqueID": "T1560.001", + "techniqueID": "T1189", "score": 18, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml" }, { "techniqueID": "T1560.001", @@ -77797,184 +77767,34 @@ "showSubtechniques": false }, { - "techniqueID": "T1003", - "score": 6, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml" - }, - { - "techniqueID": "T1543.003", - "score": 16, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" - }, - { - "techniqueID": "T1003", - "score": 6, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml" - }, - { - "techniqueID": "T1543.003", - "score": 16, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" - }, - { - "techniqueID": "T1003", - "score": 6, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml" - }, - { - "techniqueID": "T1543.003", - "score": 16, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" - }, - { - "techniqueID": "T1003", - "score": 6, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml" - }, - { - "techniqueID": "T1543.003", - "score": 16, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" - }, - { - "techniqueID": "T1003", - "score": 6, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml" - }, - { - "techniqueID": "T1543.003", - "score": 16, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" - }, - { - "techniqueID": "T1003", - "score": 6, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml" - }, - { - "techniqueID": "T1543.003", - "score": 16, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" - }, - { - "techniqueID": "T1003", - "score": 6, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml" - }, - { - "techniqueID": "T1543.003", - "score": 16, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" - }, - { - "techniqueID": "T1003", - "score": 6, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml" - }, - { - "techniqueID": "T1543.003", - "score": 16, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" - }, - { - "techniqueID": "T1003", - "score": 6, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml" - }, - { - "techniqueID": "T1543.003", - "score": 16, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" - }, - { - "techniqueID": "T1003", - "score": 6, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml" - }, - { - "techniqueID": "T1543.003", - "score": 16, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" - }, - { - "techniqueID": "T1003", - "score": 6, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml" - }, - { - "techniqueID": "T1543.003", - "score": 16, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" - }, - { - "techniqueID": "T1003", - "score": 6, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml" - }, - { - "techniqueID": "T1543.003", - "score": 16, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" - }, - { - "techniqueID": "T1003", - "score": 6, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml" + "techniqueID": "T1560.001", + "score": 18, + "showSubtechniques": false }, { - "techniqueID": "T1543.003", - "score": 16, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + "techniqueID": "T1560.001", + "score": 18, + "showSubtechniques": false }, { - "techniqueID": "T1003", - "score": 6, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml" + "techniqueID": "T1560.001", + "score": 18, + "showSubtechniques": false }, { - "techniqueID": "T1543.003", - "score": 16, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + "techniqueID": "T1560.001", + "score": 18, + "showSubtechniques": false }, { - "techniqueID": "T1003", - "score": 6, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml" + "techniqueID": "T1560.001", + "score": 18, + "showSubtechniques": false }, { - "techniqueID": "T1543.003", - "score": 16, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" + "techniqueID": "T1560.001", + "score": 18, + "showSubtechniques": false }, { "techniqueID": "T1003", @@ -82021,108 +81841,184 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" }, { - "techniqueID": "T1116", - "score": 16, - "showSubtechniques": false + "techniqueID": "T1003", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml" }, { - "techniqueID": "T1553.002", + "techniqueID": "T1543.003", "score": 16, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" }, { - "techniqueID": "T1503", + "techniqueID": "T1003", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml" + }, + { + "techniqueID": "T1543.003", "score": 16, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" }, { - "techniqueID": "T1112", - "score": 14, + "techniqueID": "T1003", + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml" }, { - "techniqueID": "T1555.003", + "techniqueID": "T1543.003", "score": 16, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" }, { - "techniqueID": "T1116", + "techniqueID": "T1003", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml" + }, + { + "techniqueID": "T1543.003", "score": 16, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" }, { - "techniqueID": "T1553.002", + "techniqueID": "T1003", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml" + }, + { + "techniqueID": "T1543.003", "score": 16, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" }, { - "techniqueID": "T1503", + "techniqueID": "T1003", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml" + }, + { + "techniqueID": "T1543.003", "score": 16, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" }, { - "techniqueID": "T1112", - "score": 14, + "techniqueID": "T1003", + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml" }, { - "techniqueID": "T1555.003", + "techniqueID": "T1543.003", "score": 16, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" }, { - "techniqueID": "T1116", + "techniqueID": "T1003", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml" + }, + { + "techniqueID": "T1543.003", "score": 16, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" }, { - "techniqueID": "T1553.002", + "techniqueID": "T1003", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml" + }, + { + "techniqueID": "T1543.003", "score": 16, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" }, { - "techniqueID": "T1503", + "techniqueID": "T1003", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml" + }, + { + "techniqueID": "T1543.003", "score": 16, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" }, { - "techniqueID": "T1112", - "score": 14, + "techniqueID": "T1003", + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml" }, { - "techniqueID": "T1555.003", + "techniqueID": "T1543.003", "score": 16, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" }, { - "techniqueID": "T1116", + "techniqueID": "T1003", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml" + }, + { + "techniqueID": "T1543.003", "score": 16, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" }, { - "techniqueID": "T1553.002", + "techniqueID": "T1003", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml" + }, + { + "techniqueID": "T1543.003", "score": 16, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" }, { - "techniqueID": "T1503", + "techniqueID": "T1003", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml" + }, + { + "techniqueID": "T1543.003", "score": 16, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" }, { - "techniqueID": "T1112", - "score": 14, + "techniqueID": "T1003", + "score": 6, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml" }, { - "techniqueID": "T1555.003", + "techniqueID": "T1543.003", "score": 16, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/sc_exe_manipulating_windows_services.yml" }, { "techniqueID": "T1116", @@ -91173,103 +91069,107 @@ "showSubtechniques": false }, { - "techniqueID": "T1043", - "score": 15, + "techniqueID": "T1116", + "score": 16, "showSubtechniques": false }, { - "techniqueID": "T1043", - "score": 15, + "techniqueID": "T1553.002", + "score": 16, "showSubtechniques": false }, { - "techniqueID": "T1043", - "score": 15, + "techniqueID": "T1503", + "score": 16, "showSubtechniques": false }, { - "techniqueID": "T1043", - "score": 15, - "showSubtechniques": false + "techniqueID": "T1112", + "score": 14, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml" }, { - "techniqueID": "T1043", - "score": 15, + "techniqueID": "T1555.003", + "score": 16, "showSubtechniques": false }, { - "techniqueID": "T1043", - "score": 15, + "techniqueID": "T1116", + "score": 16, "showSubtechniques": false }, { - "techniqueID": "T1043", - "score": 15, + "techniqueID": "T1553.002", + "score": 16, "showSubtechniques": false }, { - "techniqueID": "T1043", - "score": 15, + "techniqueID": "T1503", + "score": 16, "showSubtechniques": false }, { - "techniqueID": "T1043", - "score": 15, - "showSubtechniques": false + "techniqueID": "T1112", + "score": 14, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml" }, { - "techniqueID": "T1043", - "score": 15, + "techniqueID": "T1555.003", + "score": 16, "showSubtechniques": false }, { - "techniqueID": "T1043", - "score": 15, + "techniqueID": "T1116", + "score": 16, "showSubtechniques": false }, { - "techniqueID": "T1043", - "score": 15, + "techniqueID": "T1553.002", + "score": 16, "showSubtechniques": false }, { - "techniqueID": "T1043", - "score": 15, + "techniqueID": "T1503", + "score": 16, "showSubtechniques": false }, { - "techniqueID": "T1043", - "score": 15, - "showSubtechniques": false + "techniqueID": "T1112", + "score": 14, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml" }, { - "techniqueID": "T1043", - "score": 15, + "techniqueID": "T1555.003", + "score": 16, "showSubtechniques": false }, { - "techniqueID": "T1043", - "score": 15, + "techniqueID": "T1116", + "score": 16, "showSubtechniques": false }, { - "techniqueID": "T1043", - "score": 15, + "techniqueID": "T1553.002", + "score": 16, "showSubtechniques": false }, { - "techniqueID": "T1043", - "score": 15, + "techniqueID": "T1503", + "score": 16, "showSubtechniques": false }, { - "techniqueID": "T1043", - "score": 15, - "showSubtechniques": false + "techniqueID": "T1112", + "score": 14, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_reg_exe_process.yml" }, { - "techniqueID": "T1043", - "score": 15, + "techniqueID": "T1555.003", + "score": 16, "showSubtechniques": false }, { @@ -92933,108 +92833,103 @@ "showSubtechniques": false }, { - "techniqueID": "T1133", - "score": 14, + "techniqueID": "T1043", + "score": 15, "showSubtechniques": false }, { - "techniqueID": "T1087.001", - "score": 14, + "techniqueID": "T1043", + "score": 15, "showSubtechniques": false }, { - "techniqueID": "T1136.001", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml" + "techniqueID": "T1043", + "score": 15, + "showSubtechniques": false }, { - "techniqueID": "T1049", - "score": 14, + "techniqueID": "T1043", + "score": 15, "showSubtechniques": false }, { - "techniqueID": "T1133", - "score": 14, + "techniqueID": "T1043", + "score": 15, "showSubtechniques": false }, { - "techniqueID": "T1087.001", - "score": 14, + "techniqueID": "T1043", + "score": 15, "showSubtechniques": false }, { - "techniqueID": "T1136.001", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml" + "techniqueID": "T1043", + "score": 15, + "showSubtechniques": false }, { - "techniqueID": "T1049", - "score": 14, + "techniqueID": "T1043", + "score": 15, "showSubtechniques": false }, { - "techniqueID": "T1133", - "score": 14, + "techniqueID": "T1043", + "score": 15, "showSubtechniques": false }, { - "techniqueID": "T1087.001", - "score": 14, + "techniqueID": "T1043", + "score": 15, "showSubtechniques": false }, { - "techniqueID": "T1136.001", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml" + "techniqueID": "T1043", + "score": 15, + "showSubtechniques": false }, { - "techniqueID": "T1049", - "score": 14, + "techniqueID": "T1043", + "score": 15, "showSubtechniques": false }, { - "techniqueID": "T1133", - "score": 14, + "techniqueID": "T1043", + "score": 15, "showSubtechniques": false }, { - "techniqueID": "T1087.001", - "score": 14, + "techniqueID": "T1043", + "score": 15, "showSubtechniques": false }, { - "techniqueID": "T1136.001", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml" + "techniqueID": "T1043", + "score": 15, + "showSubtechniques": false }, { - "techniqueID": "T1049", - "score": 14, + "techniqueID": "T1043", + "score": 15, "showSubtechniques": false }, { - "techniqueID": "T1133", - "score": 14, + "techniqueID": "T1043", + "score": 15, "showSubtechniques": false }, { - "techniqueID": "T1087.001", - "score": 14, + "techniqueID": "T1043", + "score": 15, "showSubtechniques": false }, { - "techniqueID": "T1136.001", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml" + "techniqueID": "T1043", + "score": 15, + "showSubtechniques": false }, { - "techniqueID": "T1049", - "score": 14, + "techniqueID": "T1043", + "score": 15, "showSubtechniques": false }, { @@ -100325,195 +100220,110 @@ "showSubtechniques": false }, { - "techniqueID": "T1218.011", - "score": 5, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" + "techniqueID": "T1133", + "score": 14, + "showSubtechniques": false }, { - "techniqueID": "T1074.001", - "score": 13, + "techniqueID": "T1087.001", + "score": 14, "showSubtechniques": false }, { - "techniqueID": "T1021.002", - "score": 9, + "techniqueID": "T1136.001", + "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml" }, { - "techniqueID": "T1085", - "score": 13, + "techniqueID": "T1049", + "score": 14, "showSubtechniques": false }, { - "techniqueID": "T1045", - "score": 13, + "techniqueID": "T1133", + "score": 14, "showSubtechniques": false }, { - "techniqueID": "T1027.002", - "score": 13, + "techniqueID": "T1087.001", + "score": 14, "showSubtechniques": false }, { - "techniqueID": "T1046", + "techniqueID": "T1136.001", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml" - }, - { - "techniqueID": "T1218.011", - "score": 5, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" - }, - { - "techniqueID": "T1074.001", - "score": 13, - "showSubtechniques": false - }, - { - "techniqueID": "T1021.002", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml" }, { - "techniqueID": "T1085", - "score": 13, + "techniqueID": "T1049", + "score": 14, "showSubtechniques": false }, { - "techniqueID": "T1045", - "score": 13, + "techniqueID": "T1133", + "score": 14, "showSubtechniques": false }, { - "techniqueID": "T1027.002", - "score": 13, + "techniqueID": "T1087.001", + "score": 14, "showSubtechniques": false }, { - "techniqueID": "T1046", + "techniqueID": "T1136.001", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml" - }, - { - "techniqueID": "T1218.011", - "score": 5, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" - }, - { - "techniqueID": "T1074.001", - "score": 13, - "showSubtechniques": false - }, - { - "techniqueID": "T1021.002", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml" }, { - "techniqueID": "T1085", - "score": 13, + "techniqueID": "T1049", + "score": 14, "showSubtechniques": false }, { - "techniqueID": "T1045", - "score": 13, + "techniqueID": "T1133", + "score": 14, "showSubtechniques": false }, { - "techniqueID": "T1027.002", - "score": 13, + "techniqueID": "T1087.001", + "score": 14, "showSubtechniques": false }, { - "techniqueID": "T1046", + "techniqueID": "T1136.001", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml" - }, - { - "techniqueID": "T1218.011", - "score": 5, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" - }, - { - "techniqueID": "T1074.001", - "score": 13, - "showSubtechniques": false - }, - { - "techniqueID": "T1021.002", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml" }, { - "techniqueID": "T1085", - "score": 13, + "techniqueID": "T1049", + "score": 14, "showSubtechniques": false }, { - "techniqueID": "T1045", - "score": 13, + "techniqueID": "T1133", + "score": 14, "showSubtechniques": false }, { - "techniqueID": "T1027.002", - "score": 13, + "techniqueID": "T1087.001", + "score": 14, "showSubtechniques": false }, { - "techniqueID": "T1046", + "techniqueID": "T1136.001", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml" - }, - { - "techniqueID": "T1218.011", - "score": 5, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" - }, - { - "techniqueID": "T1074.001", - "score": 13, - "showSubtechniques": false - }, - { - "techniqueID": "T1021.002", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1085", - "score": 13, - "showSubtechniques": false - }, - { - "techniqueID": "T1045", - "score": 13, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_new_local_admin_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/short_lived_windows_accounts.yml" }, { - "techniqueID": "T1027.002", - "score": 13, + "techniqueID": "T1049", + "score": 14, "showSubtechniques": false }, - { - "techniqueID": "T1046", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml" - }, { "techniqueID": "T1218.011", "score": 5, @@ -113701,244 +113511,194 @@ "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml" }, { - "techniqueID": "T1113", - "score": 11, + "techniqueID": "T1218.011", + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1087.002", - "score": 12, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { - "techniqueID": "T1063", - "score": 12, + "techniqueID": "T1074.001", + "score": 13, "showSubtechniques": false }, { - "techniqueID": "T1190", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" - }, - { - "techniqueID": "T1555", + "techniqueID": "T1021.002", "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { - "techniqueID": "T1036", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" + "techniqueID": "T1085", + "score": 13, + "showSubtechniques": false }, { - "techniqueID": "T1560", - "score": 12, + "techniqueID": "T1045", + "score": 13, "showSubtechniques": false }, { - "techniqueID": "T1136.002", - "score": 12, + "techniqueID": "T1027.002", + "score": 13, "showSubtechniques": false }, { - "techniqueID": "T1041", - "score": 12, - "showSubtechniques": false + "techniqueID": "T1046", + "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml" }, { - "techniqueID": "T1562.001", - "score": 9, + "techniqueID": "T1218.011", + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { - "techniqueID": "T1518.001", - "score": 12, + "techniqueID": "T1074.001", + "score": 13, "showSubtechniques": false }, { - "techniqueID": "T1113", - "score": 11, + "techniqueID": "T1021.002", + "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { - "techniqueID": "T1087.002", - "score": 12, + "techniqueID": "T1085", + "score": 13, "showSubtechniques": false }, { - "techniqueID": "T1063", - "score": 12, + "techniqueID": "T1045", + "score": 13, "showSubtechniques": false }, { - "techniqueID": "T1190", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" + "techniqueID": "T1027.002", + "score": 13, + "showSubtechniques": false }, { - "techniqueID": "T1555", - "score": 9, + "techniqueID": "T1046", + "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml" }, { - "techniqueID": "T1036", - "score": 9, + "techniqueID": "T1218.011", + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" - }, - { - "techniqueID": "T1560", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1136.002", - "score": 12, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { - "techniqueID": "T1041", - "score": 12, + "techniqueID": "T1074.001", + "score": 13, "showSubtechniques": false }, { - "techniqueID": "T1562.001", + "techniqueID": "T1021.002", "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { - "techniqueID": "T1518.001", - "score": 12, + "techniqueID": "T1085", + "score": 13, "showSubtechniques": false }, { - "techniqueID": "T1113", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1087.002", - "score": 12, + "techniqueID": "T1045", + "score": 13, "showSubtechniques": false }, { - "techniqueID": "T1063", - "score": 12, + "techniqueID": "T1027.002", + "score": 13, "showSubtechniques": false }, { - "techniqueID": "T1190", + "techniqueID": "T1046", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" - }, - { - "techniqueID": "T1555", - "score": 9, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml" }, { - "techniqueID": "T1036", - "score": 9, + "techniqueID": "T1218.011", + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" - }, - { - "techniqueID": "T1560", - "score": 12, - "showSubtechniques": false - }, - { - "techniqueID": "T1136.002", - "score": 12, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { - "techniqueID": "T1041", - "score": 12, + "techniqueID": "T1074.001", + "score": 13, "showSubtechniques": false }, { - "techniqueID": "T1562.001", + "techniqueID": "T1021.002", "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { - "techniqueID": "T1518.001", - "score": 12, + "techniqueID": "T1085", + "score": 13, "showSubtechniques": false }, { - "techniqueID": "T1113", - "score": 11, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1087.002", - "score": 12, + "techniqueID": "T1045", + "score": 13, "showSubtechniques": false }, { - "techniqueID": "T1063", - "score": 12, + "techniqueID": "T1027.002", + "score": 13, "showSubtechniques": false }, { - "techniqueID": "T1190", + "techniqueID": "T1046", "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml" }, { - "techniqueID": "T1555", - "score": 9, + "techniqueID": "T1218.011", + "score": 5, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_with_no_command_line_arguments.yml" }, { - "techniqueID": "T1036", + "techniqueID": "T1074.001", + "score": 13, + "showSubtechniques": false + }, + { + "techniqueID": "T1021.002", "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" }, { - "techniqueID": "T1560", - "score": 12, + "techniqueID": "T1085", + "score": 13, "showSubtechniques": false }, { - "techniqueID": "T1136.002", - "score": 12, + "techniqueID": "T1045", + "score": 13, "showSubtechniques": false }, { - "techniqueID": "T1041", - "score": 12, + "techniqueID": "T1027.002", + "score": 13, "showSubtechniques": false }, { - "techniqueID": "T1562.001", - "score": 9, + "techniqueID": "T1046", + "score": 11, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" - }, - { - "techniqueID": "T1518.001", - "score": 12, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_processes_and_services_via_mimikatz_modules.yml" }, { "techniqueID": "T1113", @@ -113991,9 +113751,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -114051,9 +113811,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -114111,9 +113871,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -114171,9 +113931,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -114231,9 +113991,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -114291,9 +114051,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -114351,9 +114111,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -114411,9 +114171,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -114471,9 +114231,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -114531,9 +114291,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -114591,9 +114351,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -114651,9 +114411,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -114711,9 +114471,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -114771,9 +114531,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -114831,9 +114591,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -114891,9 +114651,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -114951,9 +114711,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -115011,9 +114771,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -115071,9 +114831,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -115131,9 +114891,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -115191,9 +114951,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -115251,9 +115011,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -115311,9 +115071,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -115371,9 +115131,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -115431,9 +115191,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -115491,9 +115251,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -115551,9 +115311,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -115611,9 +115371,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -115671,9 +115431,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -115731,9 +115491,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -115791,9 +115551,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -115851,9 +115611,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -115911,9 +115671,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -115971,9 +115731,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -116031,9 +115791,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -116091,9 +115851,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -116151,9 +115911,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -116211,9 +115971,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -116271,9 +116031,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -116331,9 +116091,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -116391,9 +116151,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -116451,9 +116211,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -116511,9 +116271,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -116571,9 +116331,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -116631,9 +116391,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -116691,9 +116451,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -116751,9 +116511,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -116811,9 +116571,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -116871,9 +116631,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -116931,9 +116691,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -116991,9 +116751,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -117051,9 +116811,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -117111,9 +116871,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -117171,9 +116931,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -117231,9 +116991,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -117291,9 +117051,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -117351,9 +117111,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -117411,9 +117171,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -117471,9 +117231,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -117531,9 +117291,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -117591,9 +117351,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -117651,9 +117411,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -117711,9 +117471,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -117771,9 +117531,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -117831,9 +117591,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -117891,9 +117651,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -117951,9 +117711,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -118011,9 +117771,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -118071,9 +117831,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -118131,9 +117891,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -118191,9 +117951,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -118251,9 +118011,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -118311,9 +118071,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -118371,9 +118131,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -118431,9 +118191,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -118491,9 +118251,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -118551,9 +118311,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -118611,9 +118371,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -118671,9 +118431,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -118731,9 +118491,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -118791,9 +118551,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -118851,9 +118611,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -118911,9 +118671,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -118971,9 +118731,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -119031,9 +118791,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -119091,9 +118851,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -119151,9 +118911,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -119211,9 +118971,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -119271,9 +119031,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -119331,9 +119091,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -119391,9 +119151,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -119451,9 +119211,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -119511,9 +119271,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -119571,9 +119331,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -119631,9 +119391,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -119691,9 +119451,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -119751,9 +119511,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -119811,9 +119571,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -119871,9 +119631,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -119931,9 +119691,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -119991,9 +119751,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -120051,9 +119811,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -120111,9 +119871,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -120171,9 +119931,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -120231,9 +119991,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -120291,9 +120051,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -120351,9 +120111,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -120411,9 +120171,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -120471,9 +120231,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -120531,9 +120291,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -120591,9 +120351,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -120651,9 +120411,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -120711,9 +120471,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -120771,9 +120531,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -120831,9 +120591,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -120891,9 +120651,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -120951,9 +120711,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -121011,9 +120771,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -121071,9 +120831,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -121131,9 +120891,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -121191,9 +120951,69 @@ }, { "techniqueID": "T1562.001", + "score": -2, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + }, + { + "techniqueID": "T1518.001", + "score": 12, + "showSubtechniques": false + }, + { + "techniqueID": "T1113", + "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1087.002", + "score": 12, + "showSubtechniques": false + }, + { + "techniqueID": "T1063", + "score": 12, + "showSubtechniques": false + }, + { + "techniqueID": "T1190", + "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" + }, + { + "techniqueID": "T1555", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" + }, + { + "techniqueID": "T1036", "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": false + }, + { + "techniqueID": "T1136.002", + "score": 12, + "showSubtechniques": false + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": false + }, + { + "techniqueID": "T1562.001", + "score": -2, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -121251,9 +121071,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -121311,9 +121131,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -121371,9 +121191,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -121431,9 +121251,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -121491,9 +121311,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -121551,9 +121371,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -121611,9 +121431,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -121671,9 +121491,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -121731,9 +121551,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -121791,9 +121611,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -121851,9 +121671,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -121911,9 +121731,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -121971,9 +121791,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -122031,9 +121851,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -122091,9 +121911,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -122151,9 +121971,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -122211,9 +122031,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -122271,9 +122091,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -122331,9 +122151,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -122391,9 +122211,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -122451,9 +122271,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -122511,9 +122331,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -122571,9 +122391,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -122631,9 +122451,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -122691,9 +122511,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -122751,9 +122571,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -122811,9 +122631,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -122871,9 +122691,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -122931,9 +122751,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -122991,9 +122811,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -123051,9 +122871,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -123111,9 +122931,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -123171,9 +122991,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -123231,9 +123051,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -123291,9 +123111,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -123351,9 +123171,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -123411,9 +123231,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -123471,9 +123291,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -123531,9 +123351,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -123591,9 +123411,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -123651,9 +123471,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -123711,9 +123531,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -123771,9 +123591,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -123831,9 +123651,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -123891,9 +123711,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -123951,9 +123771,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -124011,9 +123831,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -124071,9 +123891,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -124131,9 +123951,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -124191,9 +124011,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -124251,9 +124071,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -124311,9 +124131,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -124371,9 +124191,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -124431,9 +124251,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -124491,9 +124311,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -124551,9 +124371,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -124611,9 +124431,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -124671,9 +124491,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -124731,9 +124551,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -124791,9 +124611,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -124851,9 +124671,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -124911,9 +124731,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -124971,9 +124791,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -125031,9 +124851,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -125091,9 +124911,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -125151,9 +124971,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -125211,9 +125031,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -125271,9 +125091,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -125331,9 +125151,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -125391,9 +125211,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -125451,9 +125271,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -125511,9 +125331,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -125571,9 +125391,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -125631,9 +125451,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -125691,9 +125511,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -125751,9 +125571,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -125811,9 +125631,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -125871,9 +125691,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -125931,9 +125751,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -125991,9 +125811,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -126051,9 +125871,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -126111,9 +125931,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -126171,9 +125991,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -126231,9 +126051,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -126291,9 +126111,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -126351,9 +126171,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -126411,9 +126231,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -126471,9 +126291,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -126531,9 +126351,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -126591,9 +126411,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -126651,9 +126471,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -126711,9 +126531,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -126771,9 +126591,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -126831,9 +126651,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -126891,9 +126711,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -126951,9 +126771,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -127011,9 +126831,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -127071,9 +126891,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -127131,9 +126951,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -127191,9 +127011,69 @@ }, { "techniqueID": "T1562.001", + "score": -2, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + }, + { + "techniqueID": "T1518.001", + "score": 12, + "showSubtechniques": false + }, + { + "techniqueID": "T1113", + "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1087.002", + "score": 12, + "showSubtechniques": false + }, + { + "techniqueID": "T1063", + "score": 12, + "showSubtechniques": false + }, + { + "techniqueID": "T1190", + "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" + }, + { + "techniqueID": "T1555", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" + }, + { + "techniqueID": "T1036", "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": false + }, + { + "techniqueID": "T1136.002", + "score": 12, + "showSubtechniques": false + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": false + }, + { + "techniqueID": "T1562.001", + "score": -2, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -127251,9 +127131,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -127311,9 +127191,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -127371,9 +127251,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -127431,9 +127311,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -127491,9 +127371,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -127551,9 +127431,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -127611,9 +127491,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -127671,9 +127551,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -127731,9 +127611,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -127791,9 +127671,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -127851,9 +127731,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -127911,9 +127791,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -127971,9 +127851,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -128031,9 +127911,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -128091,9 +127971,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -128151,9 +128031,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -128211,9 +128091,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -128271,9 +128151,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -128331,9 +128211,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -128391,9 +128271,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -128451,9 +128331,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -128511,9 +128391,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -128571,9 +128451,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -128631,9 +128511,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -128691,9 +128571,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -128751,9 +128631,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -128811,9 +128691,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -128871,9 +128751,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -128931,9 +128811,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -128991,9 +128871,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -129051,9 +128931,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -129111,9 +128991,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -129171,9 +129051,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -129231,9 +129111,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -129291,9 +129171,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -129351,9 +129231,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -129411,9 +129291,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -129471,9 +129351,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -129531,9 +129411,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -129591,9 +129471,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -129651,9 +129531,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -129711,9 +129591,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -129771,9 +129651,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -129831,9 +129711,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -129891,9 +129771,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -129951,9 +129831,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -130011,9 +129891,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -130071,9 +129951,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -130131,9 +130011,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -130191,9 +130071,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -130251,9 +130131,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -130311,9 +130191,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -130371,9 +130251,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -130431,9 +130311,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -130491,9 +130371,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -130551,9 +130431,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -130611,9 +130491,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -130671,9 +130551,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -130731,9 +130611,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -130791,9 +130671,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -130851,9 +130731,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -130911,9 +130791,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -130971,9 +130851,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -131031,9 +130911,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -131091,9 +130971,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -131151,9 +131031,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -131211,9 +131091,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -131271,9 +131151,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -131331,9 +131211,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -131391,9 +131271,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -131451,9 +131331,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -131511,9 +131391,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -131571,9 +131451,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -131631,9 +131511,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -131691,9 +131571,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -131751,9 +131631,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -131811,9 +131691,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -131871,9 +131751,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -131931,9 +131811,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -131991,9 +131871,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -132051,9 +131931,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -132111,9 +131991,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -132171,9 +132051,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -132231,9 +132111,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -132291,9 +132171,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -132351,9 +132231,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -132411,9 +132291,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -132471,9 +132351,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -132531,9 +132411,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -132591,9 +132471,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -132651,9 +132531,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -132711,9 +132591,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -132771,9 +132651,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -132831,9 +132711,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -132891,9 +132771,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -132951,9 +132831,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -133011,9 +132891,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -133071,9 +132951,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -133131,9 +133011,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -133191,9 +133071,69 @@ }, { "techniqueID": "T1562.001", + "score": -2, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + }, + { + "techniqueID": "T1518.001", + "score": 12, + "showSubtechniques": false + }, + { + "techniqueID": "T1113", + "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1087.002", + "score": 12, + "showSubtechniques": false + }, + { + "techniqueID": "T1063", + "score": 12, + "showSubtechniques": false + }, + { + "techniqueID": "T1190", + "score": 11, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" + }, + { + "techniqueID": "T1555", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" + }, + { + "techniqueID": "T1036", "score": 9, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" + }, + { + "techniqueID": "T1560", + "score": 12, + "showSubtechniques": false + }, + { + "techniqueID": "T1136.002", + "score": 12, + "showSubtechniques": false + }, + { + "techniqueID": "T1041", + "score": 12, + "showSubtechniques": false + }, + { + "techniqueID": "T1562.001", + "score": -2, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -133251,9 +133191,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -133311,9 +133251,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -133371,9 +133311,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -133431,9 +133371,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -133491,9 +133431,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -133551,9 +133491,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -133611,9 +133551,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -133671,9 +133611,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -133731,9 +133671,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -133791,9 +133731,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -133851,9 +133791,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -133911,9 +133851,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -133971,9 +133911,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -134031,9 +133971,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -134091,9 +134031,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -134151,9 +134091,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -134211,9 +134151,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -134271,9 +134211,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -134331,9 +134271,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -134391,9 +134331,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -134451,9 +134391,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -134511,9 +134451,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -134571,9 +134511,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -134631,9 +134571,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -134691,9 +134631,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -134751,9 +134691,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -134811,9 +134751,9 @@ }, { "techniqueID": "T1562.001", - "score": 9, + "score": -2, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" }, { "techniqueID": "T1518.001", @@ -134821,48 +134761,63 @@ "showSubtechniques": false }, { - "techniqueID": "T1571", + "techniqueID": "T1113", "score": 11, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml" }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1087.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", - "score": 11, + "techniqueID": "T1063", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", + "techniqueID": "T1190", "score": 11, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/unified_messaging_service_spawning_a_process.yml" }, { - "techniqueID": "T1073", - "score": 11, - "showSubtechniques": false + "techniqueID": "T1555", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml" }, { - "techniqueID": "T1574.002", - "score": 11, + "techniqueID": "T1036", + "score": 9, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_system_volume_information.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___system_process_running_unexpected_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_writes_to_windows_recycle_bin.yml" + }, + { + "techniqueID": "T1560", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1571", - "score": 11, + "techniqueID": "T1136.002", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1073", - "score": 11, + "techniqueID": "T1041", + "score": 12, "showSubtechniques": false }, { - "techniqueID": "T1574.002", - "score": 11, + "techniqueID": "T1562.001", + "score": -2, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml" + }, + { + "techniqueID": "T1518.001", + "score": 12, "showSubtechniques": false }, { @@ -140101,163 +140056,48 @@ "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, - "showSubtechniques": false - }, - { - "techniqueID": "T1505.003", - "score": 8, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" - }, - { - "techniqueID": "T1100", - "score": 10, - "showSubtechniques": false - }, - { - "techniqueID": "T1119", - "score": 10, - "showSubtechniques": false - }, - { - "techniqueID": "T1505.003", - "score": 8, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" - }, - { - "techniqueID": "T1100", - "score": 10, - "showSubtechniques": false - }, - { - "techniqueID": "T1119", - "score": 10, - "showSubtechniques": false - }, - { - "techniqueID": "T1505.003", - "score": 8, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" - }, - { - "techniqueID": "T1100", - "score": 10, - "showSubtechniques": false - }, - { - "techniqueID": "T1119", - "score": 10, - "showSubtechniques": false - }, - { - "techniqueID": "T1505.003", - "score": 8, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" - }, - { - "techniqueID": "T1100", - "score": 10, - "showSubtechniques": false - }, - { - "techniqueID": "T1119", - "score": 10, - "showSubtechniques": false - }, - { - "techniqueID": "T1505.003", - "score": 8, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" - }, - { - "techniqueID": "T1100", - "score": 10, - "showSubtechniques": false - }, - { - "techniqueID": "T1119", - "score": 10, - "showSubtechniques": false - }, - { - "techniqueID": "T1505.003", - "score": 8, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" - }, - { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 8, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" - }, - { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 8, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" - }, - { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 8, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" - }, - { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1571", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1119", - "score": 10, + "techniqueID": "T1073", + "score": 11, "showSubtechniques": false }, { - "techniqueID": "T1505.003", - "score": 8, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" - }, - { - "techniqueID": "T1100", - "score": 10, + "techniqueID": "T1574.002", + "score": 11, "showSubtechniques": false }, { @@ -145733,259 +145573,163 @@ "showSubtechniques": false }, { - "techniqueID": "T1143", - "score": 9, - "showSubtechniques": false - }, - { - "techniqueID": "T1559.002", - "score": 9, - "showSubtechniques": false - }, - { - "techniqueID": "T1135", - "score": 6, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1090.002", - "score": 9, - "showSubtechniques": false - }, - { - "techniqueID": "T1036.004", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1110", + "techniqueID": "T1505.003", "score": 8, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" - }, - { - "techniqueID": "T1068", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1102.002", - "score": 9, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { - "techniqueID": "T1564.003", - "score": 9, + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1173", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1569.002", + "techniqueID": "T1505.003", "score": 8, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" - }, - { - "techniqueID": "T1035", - "score": 9, - "showSubtechniques": false - }, - { - "techniqueID": "T1143", - "score": 9, - "showSubtechniques": false - }, - { - "techniqueID": "T1559.002", - "score": 9, - "showSubtechniques": false - }, - { - "techniqueID": "T1135", - "score": 6, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { - "techniqueID": "T1090.002", - "score": 9, + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1036.004", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1110", + "techniqueID": "T1505.003", "score": 8, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" - }, - { - "techniqueID": "T1068", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1102.002", - "score": 9, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { - "techniqueID": "T1564.003", - "score": 9, + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1173", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1569.002", + "techniqueID": "T1505.003", "score": 8, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" - }, - { - "techniqueID": "T1035", - "score": 9, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { - "techniqueID": "T1143", - "score": 9, + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1559.002", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1135", - "score": 6, + "techniqueID": "T1505.003", + "score": 8, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { - "techniqueID": "T1090.002", - "score": 9, + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1036.004", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1110", + "techniqueID": "T1505.003", "score": 8, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" - }, - { - "techniqueID": "T1068", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1102.002", - "score": 9, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { - "techniqueID": "T1564.003", - "score": 9, + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1173", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1569.002", + "techniqueID": "T1505.003", "score": 8, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" - }, - { - "techniqueID": "T1035", - "score": 9, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { - "techniqueID": "T1143", - "score": 9, + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1559.002", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1135", - "score": 6, + "techniqueID": "T1505.003", + "score": 8, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { - "techniqueID": "T1090.002", - "score": 9, + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1036.004", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1110", + "techniqueID": "T1505.003", "score": 8, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" - }, - { - "techniqueID": "T1068", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1102.002", - "score": 9, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { - "techniqueID": "T1564.003", - "score": 9, + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1173", - "score": 9, + "techniqueID": "T1119", + "score": 10, "showSubtechniques": false }, { - "techniqueID": "T1569.002", + "techniqueID": "T1505.003", "score": 8, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/w3wp_spawning_shell.yml" }, { - "techniqueID": "T1035", - "score": 9, + "techniqueID": "T1100", + "score": 10, "showSubtechniques": false }, { @@ -146043,9 +145787,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -146107,9 +145851,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -146171,9 +145915,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -146235,9 +145979,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -146299,9 +146043,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -146363,9 +146107,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -146427,9 +146171,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -146491,9 +146235,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -146555,9 +146299,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -146619,9 +146363,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -146683,9 +146427,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -146747,9 +146491,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -146811,9 +146555,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -146875,9 +146619,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -146939,9 +146683,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -147003,9 +146747,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -147067,9 +146811,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -147131,9 +146875,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -147195,9 +146939,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -147259,9 +147003,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -147323,9 +147067,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -147387,9 +147131,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -147451,9 +147195,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -147515,9 +147259,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -147579,9 +147323,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -147643,9 +147387,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -147707,9 +147451,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -147771,9 +147515,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -147835,9 +147579,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -147899,9 +147643,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -147963,9 +147707,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -148027,9 +147771,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -148091,9 +147835,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -148155,9 +147899,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -148219,9 +147963,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -148283,9 +148027,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -148347,9 +148091,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -148411,9 +148155,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -148475,9 +148219,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -148539,9 +148283,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -148603,9 +148347,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -148667,9 +148411,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -148731,9 +148475,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -148795,9 +148539,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -148859,9 +148603,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -148923,9 +148667,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -148987,9 +148731,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -149051,9 +148795,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -149115,9 +148859,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -149179,9 +148923,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -149243,9 +148987,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -149307,9 +149051,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -149371,9 +149115,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -149435,9 +149179,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -149499,9 +149243,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -149563,9 +149307,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -149627,9 +149371,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -149691,9 +149435,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -149755,9 +149499,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -149819,9 +149563,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -149883,9 +149627,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -149947,9 +149691,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -150011,9 +149755,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -150075,9 +149819,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -150139,9 +149883,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -150203,9 +149947,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -150267,9 +150011,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -150331,9 +150075,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -150395,9 +150139,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -150459,9 +150203,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -150523,9 +150267,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -150587,9 +150331,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -150651,9 +150395,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -150715,9 +150459,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -150779,9 +150523,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -150843,9 +150587,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -150907,9 +150651,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -150971,9 +150715,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -151035,9 +150779,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -151099,9 +150843,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -151163,9 +150907,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -151227,9 +150971,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -151291,9 +151035,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -151355,9 +151099,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -151419,9 +151163,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -151483,9 +151227,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -151547,9 +151291,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -151611,9 +151355,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -151675,9 +151419,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -151739,9 +151483,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -151803,9 +151547,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -151867,9 +151611,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -151931,9 +151675,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -151995,9 +151739,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -152059,9 +151803,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -152123,9 +151867,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -152187,9 +151931,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -152251,9 +151995,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -152315,9 +152059,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -152379,9 +152123,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -152443,9 +152187,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -152507,9 +152251,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -152571,9 +152315,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -152635,9 +152379,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -152699,9 +152443,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -152763,9 +152507,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -152827,9 +152571,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -152891,9 +152635,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -152955,9 +152699,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -153019,9 +152763,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -153083,9 +152827,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -153147,9 +152891,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -153211,9 +152955,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -153275,9 +153019,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -153339,9 +153083,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -153403,9 +153147,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -153467,9 +153211,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -153531,9 +153275,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -153595,9 +153339,73 @@ }, { "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" + }, + { + "techniqueID": "T1035", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1135", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1036.004", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1110", "score": 8, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" + }, + { + "techniqueID": "T1068", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1102.002", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -153659,9 +153467,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -153723,9 +153531,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -153787,9 +153595,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -153851,9 +153659,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -153915,9 +153723,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -153979,9 +153787,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -154043,9 +153851,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -154107,9 +153915,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -154171,9 +153979,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -154235,9 +154043,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -154299,9 +154107,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -154363,9 +154171,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -154427,9 +154235,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -154491,9 +154299,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -154555,9 +154363,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -154619,9 +154427,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -154683,9 +154491,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -154747,9 +154555,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -154811,9 +154619,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -154875,9 +154683,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -154939,9 +154747,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -155003,9 +154811,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -155067,9 +154875,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -155131,9 +154939,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -155195,9 +155003,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -155259,9 +155067,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -155323,9 +155131,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -155387,9 +155195,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -155451,9 +155259,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -155515,9 +155323,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -155579,9 +155387,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -155643,9 +155451,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -155707,9 +155515,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -155771,9 +155579,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -155835,9 +155643,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -155899,9 +155707,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -155963,9 +155771,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -156027,9 +155835,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -156091,9 +155899,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -156155,9 +155963,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -156219,9 +156027,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -156283,9 +156091,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -156347,9 +156155,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -156411,9 +156219,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -156475,9 +156283,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -156539,9 +156347,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -156603,9 +156411,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -156667,9 +156475,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -156731,9 +156539,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -156795,9 +156603,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -156859,9 +156667,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -156923,9 +156731,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -156987,9 +156795,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -157051,9 +156859,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -157115,9 +156923,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -157179,9 +156987,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -157243,9 +157051,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -157307,9 +157115,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -157371,9 +157179,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -157435,9 +157243,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -157499,9 +157307,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -157563,9 +157371,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -157627,9 +157435,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -157691,9 +157499,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -157755,9 +157563,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -157819,9 +157627,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -157883,9 +157691,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -157947,9 +157755,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -158011,9 +157819,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -158075,9 +157883,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -158139,9 +157947,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -158203,9 +158011,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -158267,9 +158075,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -158331,9 +158139,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -158395,9 +158203,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -158459,9 +158267,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -158523,9 +158331,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -158587,9 +158395,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -158651,9 +158459,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -158715,9 +158523,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -158779,9 +158587,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -158843,9 +158651,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -158907,9 +158715,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -158971,9 +158779,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -159035,9 +158843,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -159099,9 +158907,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -159163,9 +158971,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -159227,9 +159035,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -159291,9 +159099,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -159355,9 +159163,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -159419,9 +159227,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -159483,9 +159291,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -159547,9 +159355,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -159611,9 +159419,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -159675,9 +159483,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -159739,9 +159547,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -159803,9 +159611,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -159867,9 +159675,73 @@ }, { "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" + }, + { + "techniqueID": "T1035", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1135", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1036.004", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1110", "score": 8, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" + }, + { + "techniqueID": "T1068", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1102.002", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -159931,9 +159803,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -159995,9 +159867,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -160059,9 +159931,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -160123,9 +159995,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -160187,9 +160059,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -160251,9 +160123,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -160315,9 +160187,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -160379,9 +160251,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -160443,9 +160315,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -160507,9 +160379,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -160571,9 +160443,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -160635,9 +160507,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -160699,9 +160571,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -160763,9 +160635,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -160827,9 +160699,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -160891,9 +160763,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -160955,9 +160827,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -161019,9 +160891,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -161083,9 +160955,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -161147,9 +161019,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -161211,9 +161083,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -161275,9 +161147,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -161339,9 +161211,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -161403,9 +161275,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -161467,9 +161339,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -161531,9 +161403,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -161595,9 +161467,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -161659,9 +161531,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -161723,9 +161595,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -161787,9 +161659,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -161851,9 +161723,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -161915,9 +161787,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -161979,9 +161851,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -162043,9 +161915,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -162107,9 +161979,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -162171,9 +162043,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -162235,9 +162107,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -162299,9 +162171,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -162363,9 +162235,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -162427,9 +162299,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -162491,9 +162363,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -162555,9 +162427,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -162619,9 +162491,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -162683,9 +162555,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -162747,9 +162619,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -162811,9 +162683,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -162875,9 +162747,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -162939,9 +162811,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -163003,9 +162875,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -163067,9 +162939,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -163131,9 +163003,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -163195,9 +163067,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -163259,9 +163131,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -163323,9 +163195,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -163387,9 +163259,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -163451,9 +163323,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -163515,9 +163387,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -163579,9 +163451,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -163643,9 +163515,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -163707,9 +163579,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -163771,9 +163643,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -163835,9 +163707,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -163899,9 +163771,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -163963,9 +163835,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -164027,9 +163899,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -164091,9 +163963,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -164155,9 +164027,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -164219,9 +164091,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -164283,9 +164155,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -164347,9 +164219,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -164411,9 +164283,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -164475,9 +164347,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -164539,9 +164411,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -164603,9 +164475,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -164667,9 +164539,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -164731,9 +164603,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -164795,9 +164667,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -164859,9 +164731,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -164923,9 +164795,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -164987,9 +164859,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -165051,9 +164923,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -165115,9 +164987,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -165179,9 +165051,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -165243,9 +165115,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -165307,9 +165179,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -165371,9 +165243,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -165435,9 +165307,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -165499,9 +165371,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -165563,9 +165435,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -165627,9 +165499,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -165691,9 +165563,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -165755,9 +165627,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -165819,9 +165691,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -165883,9 +165755,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -165947,9 +165819,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -166011,9 +165883,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -166075,9 +165947,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -166139,9 +166011,73 @@ }, { "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" + }, + { + "techniqueID": "T1035", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1135", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1036.004", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1110", "score": 8, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" + }, + { + "techniqueID": "T1068", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1102.002", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -166203,9 +166139,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -166267,9 +166203,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -166331,9 +166267,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -166395,9 +166331,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -166459,9 +166395,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -166523,9 +166459,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -166587,9 +166523,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -166651,9 +166587,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -166715,9 +166651,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -166779,9 +166715,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -166843,9 +166779,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -166907,9 +166843,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -166971,9 +166907,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -167035,9 +166971,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -167099,9 +167035,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -167163,9 +167099,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -167227,9 +167163,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -167291,9 +167227,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -167355,9 +167291,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -167419,9 +167355,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -167483,9 +167419,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -167547,9 +167483,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -167611,9 +167547,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -167675,9 +167611,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -167739,9 +167675,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -167803,9 +167739,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -167867,9 +167803,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -167931,9 +167867,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -167995,9 +167931,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -168059,9 +167995,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -168123,9 +168059,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -168187,9 +168123,9 @@ }, { "techniqueID": "T1569.002", - "score": 8, + "score": 7, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -168251,9 +168187,73 @@ }, { "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" + }, + { + "techniqueID": "T1035", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1143", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1559.002", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1135", + "score": 6, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1090.002", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1036.004", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1110", "score": 8, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml" + }, + { + "techniqueID": "T1068", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/first_time_seen_child_process_of_zoom.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_dsinternals_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_mimikatz_modules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___setting_credentials_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1102.002", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1564.003", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1173", + "score": 9, + "showSubtechniques": false + }, + { + "techniqueID": "T1569.002", + "score": 7, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/create_service_in_suspicious_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_executed_as_a_service.yml" }, { "techniqueID": "T1035", @@ -269724,9 +269724,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -269827,9 +269827,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -269930,9 +269930,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -270033,9 +270033,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -270136,9 +270136,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -270239,9 +270239,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -270342,9 +270342,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -270445,9 +270445,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -270548,9 +270548,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -270651,9 +270651,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -270754,9 +270754,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -270857,9 +270857,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -270960,9 +270960,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -271063,9 +271063,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -271166,9 +271166,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -271269,9 +271269,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -271372,9 +271372,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -271475,9 +271475,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -271578,9 +271578,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -271681,9 +271681,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -271784,9 +271784,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -271887,9 +271887,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -271990,9 +271990,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -272093,9 +272093,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -272196,9 +272196,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -272299,9 +272299,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -272402,9 +272402,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -272505,9 +272505,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -272608,9 +272608,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -272711,9 +272711,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -272814,9 +272814,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -272917,9 +272917,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -273020,9 +273020,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -273123,9 +273123,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -273226,9 +273226,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -273329,9 +273329,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -273432,9 +273432,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -273535,9 +273535,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -273638,9 +273638,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -273741,9 +273741,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -273844,9 +273844,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -273947,9 +273947,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -274050,9 +274050,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -274153,9 +274153,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -274256,9 +274256,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -274359,9 +274359,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -274462,9 +274462,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -274565,9 +274565,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -274668,9 +274668,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -274771,9 +274771,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -274874,9 +274874,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -274977,9 +274977,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -275080,9 +275080,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -275183,9 +275183,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -275286,9 +275286,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -275389,9 +275389,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -275492,9 +275492,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -275595,9 +275595,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -275698,9 +275698,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -275801,9 +275801,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -275904,9 +275904,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -276007,9 +276007,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -276110,9 +276110,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -276213,9 +276213,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -276316,9 +276316,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -276419,9 +276419,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -276522,9 +276522,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -276625,9 +276625,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -276728,9 +276728,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -276831,9 +276831,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -276934,9 +276934,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -277037,9 +277037,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -277140,9 +277140,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -277243,9 +277243,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -277346,9 +277346,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -277449,9 +277449,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -277552,9 +277552,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -277655,9 +277655,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -277758,9 +277758,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -277861,9 +277861,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -277964,9 +277964,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -278067,9 +278067,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -278170,9 +278170,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -278273,9 +278273,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -278376,9 +278376,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -278479,9 +278479,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -278582,9 +278582,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -278685,9 +278685,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -278788,9 +278788,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -278891,9 +278891,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -278994,9 +278994,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -279097,9 +279097,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -279200,9 +279200,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -279303,9 +279303,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -279406,9 +279406,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -279509,9 +279509,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -279612,9 +279612,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -279715,9 +279715,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -279818,9 +279818,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -279921,9 +279921,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -280024,9 +280024,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -280127,9 +280127,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -280230,9 +280230,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -280333,9 +280333,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -280436,9 +280436,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -280539,9 +280539,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -280642,9 +280642,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -280745,9 +280745,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -280848,9 +280848,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -280951,9 +280951,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -281054,9 +281054,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -281157,9 +281157,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -281260,9 +281260,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -281363,9 +281363,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -281466,9 +281466,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -281569,9 +281569,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -281672,9 +281672,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -281775,9 +281775,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -281878,9 +281878,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -281981,9 +281981,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -282084,9 +282084,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -282187,9 +282187,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -282290,9 +282290,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -282393,9 +282393,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -282496,9 +282496,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -282599,9 +282599,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -282702,9 +282702,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -282805,9 +282805,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -282908,9 +282908,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -283011,9 +283011,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -283114,9 +283114,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -283217,9 +283217,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -283320,9 +283320,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -283423,9 +283423,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -283526,9 +283526,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -283629,9 +283629,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -283732,9 +283732,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -283835,9 +283835,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -283938,9 +283938,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -284041,9 +284041,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -284144,9 +284144,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -284247,9 +284247,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -284350,9 +284350,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -284453,9 +284453,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -284556,9 +284556,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -284659,9 +284659,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -284762,9 +284762,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -284865,9 +284865,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -284968,9 +284968,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -285071,9 +285071,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -285174,9 +285174,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -285277,9 +285277,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -285380,9 +285380,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -285483,9 +285483,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -285586,9 +285586,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -285689,9 +285689,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -285792,9 +285792,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -285895,9 +285895,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -285998,9 +285998,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -286101,9 +286101,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -286204,9 +286204,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -286307,9 +286307,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -286410,9 +286410,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -286513,9 +286513,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -286616,9 +286616,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -286719,9 +286719,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -286822,9 +286822,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -286925,9 +286925,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -287028,9 +287028,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -287131,9 +287131,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -287234,9 +287234,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -287337,9 +287337,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -287440,9 +287440,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -287543,9 +287543,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -287646,9 +287646,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -287749,9 +287749,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -287852,9 +287852,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -287955,9 +287955,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -288058,9 +288058,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -288161,9 +288161,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -288264,9 +288264,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -288367,9 +288367,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -288470,9 +288470,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -288573,9 +288573,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -288676,9 +288676,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -288779,9 +288779,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -288882,9 +288882,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -288985,9 +288985,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -289088,9 +289088,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -289191,9 +289191,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -289294,9 +289294,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -289397,9 +289397,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -289500,9 +289500,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -289603,9 +289603,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -289706,9 +289706,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -289809,9 +289809,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -289912,9 +289912,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -290015,9 +290015,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -290118,9 +290118,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -290221,9 +290221,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -290324,9 +290324,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -290427,9 +290427,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -290530,9 +290530,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -290633,9 +290633,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -290736,9 +290736,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -290839,9 +290839,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -290942,9 +290942,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -291045,9 +291045,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -291148,9 +291148,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -291251,9 +291251,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -291354,9 +291354,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -291457,9 +291457,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -291560,9 +291560,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -291663,9 +291663,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -291766,9 +291766,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -291869,9 +291869,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -291972,9 +291972,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -292075,9 +292075,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -292178,9 +292178,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -292281,9 +292281,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -292384,9 +292384,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -292487,9 +292487,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -292590,9 +292590,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -292693,9 +292693,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -292796,9 +292796,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -292899,9 +292899,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -293002,9 +293002,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -293105,9 +293105,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -293208,9 +293208,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -293311,9 +293311,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -293414,9 +293414,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -293517,9 +293517,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -293620,9 +293620,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -293723,9 +293723,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -293826,9 +293826,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -293929,9 +293929,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -294032,9 +294032,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -294135,9 +294135,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -294238,9 +294238,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -294341,9 +294341,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -294444,9 +294444,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -294547,9 +294547,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -294650,9 +294650,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -294753,9 +294753,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -294856,9 +294856,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -294959,9 +294959,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -295062,9 +295062,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -295165,9 +295165,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -295268,9 +295268,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -295371,9 +295371,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -295474,9 +295474,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -295577,9 +295577,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -295680,9 +295680,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -295783,9 +295783,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -295886,9 +295886,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -295989,9 +295989,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -296092,9 +296092,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -296195,9 +296195,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -296298,9 +296298,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -296401,9 +296401,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -296504,9 +296504,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -296607,9 +296607,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -296710,9 +296710,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -296813,9 +296813,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -296916,9 +296916,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -297019,9 +297019,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -297122,9 +297122,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -297225,9 +297225,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -297328,9 +297328,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -297431,9 +297431,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -297534,9 +297534,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -297637,9 +297637,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -297740,9 +297740,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -297843,9 +297843,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -297946,9 +297946,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -298049,9 +298049,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -298152,9 +298152,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -298255,9 +298255,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -298358,9 +298358,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -298461,9 +298461,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -298564,9 +298564,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -298667,9 +298667,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -298770,9 +298770,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -298873,9 +298873,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -298976,9 +298976,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -299079,9 +299079,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -299182,9 +299182,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -299285,9 +299285,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -299388,9 +299388,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -299491,9 +299491,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -299594,9 +299594,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -299697,9 +299697,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -299800,9 +299800,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -299903,9 +299903,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -300006,9 +300006,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -300109,9 +300109,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -300212,9 +300212,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -300315,9 +300315,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -300418,9 +300418,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -300521,9 +300521,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -300624,9 +300624,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -300727,9 +300727,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -300830,9 +300830,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -300933,9 +300933,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -301036,9 +301036,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -301139,9 +301139,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -301242,9 +301242,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -301345,9 +301345,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -301448,9 +301448,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -301551,9 +301551,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -301654,9 +301654,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -301757,9 +301757,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -301860,9 +301860,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -301963,9 +301963,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -302066,9 +302066,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -302169,9 +302169,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -302272,9 +302272,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -302375,9 +302375,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -302478,9 +302478,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -302581,9 +302581,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -302684,9 +302684,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -302787,9 +302787,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -302890,9 +302890,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -302993,9 +302993,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -303096,9 +303096,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -303199,9 +303199,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -303302,9 +303302,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -303405,9 +303405,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -303508,9 +303508,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -303611,9 +303611,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -303714,9 +303714,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -303817,9 +303817,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -303920,9 +303920,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -304023,9 +304023,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -304126,9 +304126,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -304229,9 +304229,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -304332,9 +304332,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -304435,9 +304435,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -304538,9 +304538,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -304641,9 +304641,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -304744,9 +304744,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -304847,9 +304847,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -304950,9 +304950,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -305053,9 +305053,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -305156,9 +305156,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -305259,9 +305259,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -305362,9 +305362,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -305465,9 +305465,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -305568,9 +305568,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -305671,9 +305671,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -305774,9 +305774,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -305877,9 +305877,9 @@ }, { "techniqueID": "T1564.001", - "score": 4, + "score": 3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/disable_show_hidden_files.yml" }, { "techniqueID": "T1102.001", @@ -305987,7 +305987,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -306126,7 +306126,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -306265,7 +306265,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -306404,7 +306404,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -306543,7 +306543,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -306682,7 +306682,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -306821,7 +306821,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -306960,7 +306960,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -307099,7 +307099,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -307238,7 +307238,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -307377,7 +307377,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -307516,7 +307516,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -307655,7 +307655,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -307794,7 +307794,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -307933,7 +307933,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -308072,7 +308072,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -308211,7 +308211,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -308350,7 +308350,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -308489,7 +308489,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -308628,7 +308628,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -308767,7 +308767,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -308906,7 +308906,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -309045,7 +309045,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -309184,7 +309184,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -309323,7 +309323,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -309462,7 +309462,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -309601,7 +309601,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -309740,7 +309740,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -309879,7 +309879,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -310018,7 +310018,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -310157,7 +310157,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -310296,7 +310296,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -310435,7 +310435,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -310574,7 +310574,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -310713,7 +310713,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -310852,7 +310852,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -310991,7 +310991,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -311130,7 +311130,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -311269,7 +311269,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -311408,7 +311408,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -311547,7 +311547,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -311686,7 +311686,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -311825,7 +311825,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -311964,7 +311964,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -312103,7 +312103,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -312242,7 +312242,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -312381,7 +312381,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -312520,7 +312520,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -312659,7 +312659,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -312798,7 +312798,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -312937,7 +312937,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -313076,7 +313076,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -313215,7 +313215,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -313354,7 +313354,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -313493,7 +313493,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -313632,7 +313632,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -313771,7 +313771,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -313910,7 +313910,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -314049,7 +314049,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -314188,7 +314188,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -314327,7 +314327,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -314466,7 +314466,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -314605,7 +314605,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -314744,7 +314744,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -314883,7 +314883,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -315022,7 +315022,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -315161,7 +315161,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -315300,7 +315300,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -315439,7 +315439,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -315578,7 +315578,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -315717,7 +315717,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -315856,7 +315856,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -315995,7 +315995,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -316134,7 +316134,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -316273,7 +316273,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -316412,7 +316412,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -316551,7 +316551,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -316690,7 +316690,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -316829,7 +316829,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -316968,7 +316968,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -317107,7 +317107,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -317246,7 +317246,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -317385,7 +317385,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -317524,7 +317524,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -317663,7 +317663,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -317802,7 +317802,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -317941,7 +317941,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -318080,7 +318080,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -318219,7 +318219,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -318358,7 +318358,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -318497,7 +318497,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -318636,7 +318636,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -318775,7 +318775,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -318914,7 +318914,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -319053,7 +319053,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -319192,7 +319192,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -319331,7 +319331,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -319470,7 +319470,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -319609,7 +319609,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -319748,7 +319748,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -319887,7 +319887,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -320026,7 +320026,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -320165,7 +320165,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -320304,7 +320304,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -320443,7 +320443,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -320582,7 +320582,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -320721,7 +320721,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -320860,7 +320860,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -320999,7 +320999,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -321138,7 +321138,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -321277,7 +321277,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -321416,7 +321416,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -321555,7 +321555,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -321694,7 +321694,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -321833,7 +321833,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -321972,7 +321972,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -322111,7 +322111,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -322250,7 +322250,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -322389,7 +322389,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -322528,7 +322528,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -322667,7 +322667,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -322806,7 +322806,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -322945,7 +322945,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -323084,7 +323084,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -323223,7 +323223,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -323362,7 +323362,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -323501,7 +323501,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -323640,7 +323640,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -323779,7 +323779,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -323918,7 +323918,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -324057,7 +324057,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -324196,7 +324196,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -324335,7 +324335,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -324474,7 +324474,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -324613,7 +324613,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -324752,7 +324752,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -324891,7 +324891,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -325030,7 +325030,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -325169,7 +325169,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -325308,7 +325308,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -325447,7 +325447,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -325586,7 +325586,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -325725,7 +325725,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -325864,7 +325864,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -326003,7 +326003,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -326142,7 +326142,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -326281,7 +326281,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -326420,7 +326420,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -326559,7 +326559,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -326698,7 +326698,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -326837,7 +326837,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -326976,7 +326976,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -327115,7 +327115,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -327254,7 +327254,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -327393,7 +327393,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -327532,7 +327532,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -327671,7 +327671,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -327810,7 +327810,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -327949,7 +327949,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -328088,7 +328088,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -328227,7 +328227,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -328366,7 +328366,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -328505,7 +328505,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -328644,7 +328644,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -328783,7 +328783,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -328922,7 +328922,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -329061,7 +329061,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -329200,7 +329200,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -329339,7 +329339,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -329478,7 +329478,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -329617,7 +329617,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -329756,7 +329756,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -329895,7 +329895,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -330034,7 +330034,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -330173,7 +330173,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -330312,7 +330312,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -330451,7 +330451,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -330590,7 +330590,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -330729,7 +330729,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -330868,7 +330868,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -331007,7 +331007,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -331146,7 +331146,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -331285,7 +331285,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -331424,7 +331424,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -331563,7 +331563,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -331702,7 +331702,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -331841,7 +331841,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -331980,7 +331980,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -332119,7 +332119,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -332258,7 +332258,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -332397,7 +332397,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -332536,7 +332536,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -332675,7 +332675,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -332814,7 +332814,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -332953,7 +332953,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -333092,7 +333092,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -333231,7 +333231,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -333370,7 +333370,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -333509,7 +333509,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -333648,7 +333648,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -333787,7 +333787,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -333926,7 +333926,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -334065,7 +334065,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -334204,7 +334204,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -334343,7 +334343,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -334482,7 +334482,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -334621,7 +334621,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -334760,7 +334760,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -334899,7 +334899,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -335038,7 +335038,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -335177,7 +335177,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -335316,7 +335316,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -335455,7 +335455,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -335594,7 +335594,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -335733,7 +335733,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -335872,7 +335872,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -336011,7 +336011,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -336150,7 +336150,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -336289,7 +336289,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -336428,7 +336428,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -336567,7 +336567,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -336706,7 +336706,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -336845,7 +336845,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -336984,7 +336984,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -337123,7 +337123,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -337262,7 +337262,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -337401,7 +337401,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -337540,7 +337540,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -337679,7 +337679,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -337818,7 +337818,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -337957,7 +337957,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -338096,7 +338096,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -338235,7 +338235,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -338374,7 +338374,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -338513,7 +338513,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -338652,7 +338652,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -338791,7 +338791,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -338930,7 +338930,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -339069,7 +339069,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -339208,7 +339208,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -339347,7 +339347,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -339486,7 +339486,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -339625,7 +339625,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -339764,7 +339764,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -339903,7 +339903,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -340042,7 +340042,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -340181,7 +340181,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -340320,7 +340320,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -340459,7 +340459,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -340598,7 +340598,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -340737,7 +340737,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -340876,7 +340876,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -341015,7 +341015,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -341154,7 +341154,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -341293,7 +341293,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -341432,7 +341432,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -341571,7 +341571,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -341710,7 +341710,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -341849,7 +341849,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -341988,7 +341988,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -342127,7 +342127,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -342266,7 +342266,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -342405,7 +342405,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -342544,7 +342544,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -342683,7 +342683,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -342822,7 +342822,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -342961,7 +342961,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -343100,7 +343100,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -343239,7 +343239,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -343378,7 +343378,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -343517,7 +343517,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -343656,7 +343656,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -343795,7 +343795,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -343934,7 +343934,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -344073,7 +344073,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -344212,7 +344212,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -344351,7 +344351,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -344490,7 +344490,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -344629,7 +344629,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -344768,7 +344768,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -344907,7 +344907,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -345046,7 +345046,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -345185,7 +345185,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -345324,7 +345324,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -345463,7 +345463,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -345602,7 +345602,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -345741,7 +345741,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -345880,7 +345880,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -346019,7 +346019,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -346158,7 +346158,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -346297,7 +346297,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -346436,7 +346436,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -346575,7 +346575,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -346714,7 +346714,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -346853,7 +346853,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -346992,7 +346992,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -347131,7 +347131,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -347270,7 +347270,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -347409,7 +347409,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -347548,7 +347548,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -347687,7 +347687,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -347826,7 +347826,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -347965,7 +347965,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -348104,7 +348104,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -348243,7 +348243,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -348382,7 +348382,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -348521,7 +348521,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -348660,7 +348660,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -348799,7 +348799,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -348938,7 +348938,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -349077,7 +349077,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -349216,7 +349216,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -349355,7 +349355,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -349494,7 +349494,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -349633,7 +349633,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -349772,7 +349772,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -349911,7 +349911,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -350050,7 +350050,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -350189,7 +350189,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -350328,7 +350328,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -350467,7 +350467,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -350606,7 +350606,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -350745,7 +350745,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -350884,7 +350884,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -351023,7 +351023,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -351162,7 +351162,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -351301,7 +351301,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -351440,7 +351440,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -351579,7 +351579,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -351718,7 +351718,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -351857,7 +351857,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -351996,7 +351996,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -352135,7 +352135,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -352274,7 +352274,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -352413,7 +352413,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -352552,7 +352552,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -352691,7 +352691,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -352830,7 +352830,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -352969,7 +352969,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -353108,7 +353108,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -353247,7 +353247,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -353386,7 +353386,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -353525,7 +353525,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -353664,7 +353664,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -353803,7 +353803,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -353942,7 +353942,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -354081,7 +354081,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -354220,7 +354220,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -354359,7 +354359,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -354498,7 +354498,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -354637,7 +354637,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -354776,7 +354776,7 @@ "techniqueID": "T1036.003", "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml" }, { "techniqueID": "T1570", @@ -354961,204 +354961,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1585", - "score": 2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1500", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1485", "score": 0, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml" - }, - { - "techniqueID": "T1498", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1588.003", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1008", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1053.002", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1090.001", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1584.001", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1529", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1067", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1542.003", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1080", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1587.002", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1091", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1583.001", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1572", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1004", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1071.003", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1021.006", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1547.004", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1550.003", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1188", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1074", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1104", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1583.006", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1072", - "score": 2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" - }, - { - "techniqueID": "T1210", - "score": 2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml" - }, - { - "techniqueID": "T1199", - "score": 2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1069.001", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1097", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1090.003", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1584.006", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1486", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml" - }, - { - "techniqueID": "T1573", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1028", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1027.004", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -355353,8 +355158,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -355549,204 +355355,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1585", - "score": 2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1500", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1485", "score": 0, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml" - }, - { - "techniqueID": "T1498", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1588.003", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1008", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1053.002", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1090.001", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1584.001", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1529", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1067", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1542.003", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1080", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1587.002", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1091", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1583.001", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1572", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1004", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1071.003", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1021.006", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1547.004", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1550.003", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1188", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1074", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1104", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1583.006", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1072", - "score": 2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" - }, - { - "techniqueID": "T1210", - "score": 2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml" - }, - { - "techniqueID": "T1199", - "score": 2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1069.001", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1097", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1090.003", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1584.006", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1486", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml" - }, - { - "techniqueID": "T1573", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1028", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1027.004", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -355941,204 +355552,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1585", - "score": 2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1500", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1485", "score": 0, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml" - }, - { - "techniqueID": "T1498", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1588.003", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1008", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1053.002", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1090.001", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1584.001", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1529", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1067", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1542.003", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1080", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1587.002", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1091", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1583.001", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1572", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1004", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1071.003", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1021.006", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1547.004", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1550.003", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1188", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1074", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1104", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1583.006", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1072", - "score": 2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" - }, - { - "techniqueID": "T1210", - "score": 2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml" - }, - { - "techniqueID": "T1199", - "score": 2, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1069.001", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1097", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1090.003", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1584.006", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1486", - "score": -3, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml" - }, - { - "techniqueID": "T1573", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1028", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1027.004", - "score": 3, - "showSubtechniques": false - }, - { - "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -356333,8 +355749,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -356529,8 +355946,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -356725,8 +356143,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -356921,8 +356340,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -357117,8 +356537,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -357313,8 +356734,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -357509,8 +356931,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -357705,8 +357128,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -357901,8 +357325,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -358097,8 +357522,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -358293,8 +357719,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -358489,8 +357916,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -358685,8 +358113,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -358881,8 +358310,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -359077,8 +358507,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -359273,8 +358704,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -359469,8 +358901,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -359665,8 +359098,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -359861,8 +359295,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -360057,9 +359492,207 @@ }, { "techniqueID": "T1197", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, + { + "techniqueID": "T1585", + "score": 2, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1500", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1485", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml" + }, + { + "techniqueID": "T1498", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1588.003", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1008", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1053.002", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1090.001", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.001", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1529", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1067", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1542.003", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1080", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1587.002", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1091", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.001", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1572", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1004", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1071.003", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1021.006", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1547.004", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1550.003", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1188", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1074", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1104", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.006", "score": 3, "showSubtechniques": false }, + { + "techniqueID": "T1072", + "score": 2, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" + }, + { + "techniqueID": "T1210", + "score": 2, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml" + }, + { + "techniqueID": "T1199", + "score": 2, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1069.001", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1097", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1090.003", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.006", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1486", + "score": -3, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml" + }, + { + "techniqueID": "T1573", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1028", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1027.004", + "score": 3, + "showSubtechniques": false + }, + { + "techniqueID": "T1197", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" + }, { "techniqueID": "T1585", "score": 2, @@ -360253,8 +359886,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -360449,8 +360083,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -360645,8 +360280,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -360841,8 +360477,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -361037,8 +360674,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -361233,8 +360871,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -361429,8 +361068,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -361625,8 +361265,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -361821,8 +361462,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -362017,8 +361659,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -362213,8 +361856,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -362409,8 +362053,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -362605,8 +362250,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -362801,8 +362447,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -362997,8 +362644,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -363193,8 +362841,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -363389,8 +363038,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -363585,8 +363235,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -363781,8 +363432,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -363977,8 +363629,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -364173,8 +363826,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -364369,8 +364023,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -364565,8 +364220,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -364761,8 +364417,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -364957,8 +364614,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -365153,8 +364811,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -365349,8 +365008,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -365545,8 +365205,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -365741,8 +365402,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -365937,8 +365599,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -366133,8 +365796,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -366329,8 +365993,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -366525,8 +366190,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -366721,8 +366387,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -366917,8 +366584,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -367113,8 +366781,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -367309,8 +366978,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -367505,8 +367175,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -367701,8 +367372,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -367897,8 +367569,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -368093,8 +367766,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -368289,8 +367963,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -368485,8 +368160,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -368681,8 +368357,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -368877,8 +368554,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -369073,8 +368751,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -369269,8 +368948,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -369465,8 +369145,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -369661,8 +369342,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -369857,8 +369539,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -370053,8 +369736,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -370249,8 +369933,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -370445,8 +370130,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -370641,8 +370327,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -370837,8 +370524,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -371033,8 +370721,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -371229,8 +370918,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -371425,8 +371115,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -371621,8 +371312,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -371817,8 +371509,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -372013,8 +371706,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -372209,8 +371903,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -372405,8 +372100,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -372601,8 +372297,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -372797,8 +372494,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -372993,8 +372691,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -373189,8 +372888,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -373385,8 +373085,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -373581,8 +373282,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -373777,8 +373479,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -373973,8 +373676,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -374169,8 +373873,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -374365,8 +374070,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -374561,8 +374267,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -374757,8 +374464,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -374953,8 +374661,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -375149,8 +374858,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -375345,8 +375055,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -375541,8 +375252,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -375737,8 +375449,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -375933,8 +375646,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -376129,8 +375843,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -376325,8 +376040,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -376521,8 +376237,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -376717,8 +376434,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -376913,8 +376631,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -377109,8 +376828,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -377305,8 +377025,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -377501,8 +377222,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -377697,8 +377419,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -377893,8 +377616,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -378089,8 +377813,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -378285,8 +378010,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -378481,8 +378207,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -378677,8 +378404,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -378873,8 +378601,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -379069,8 +378798,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -379265,8 +378995,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -379461,8 +379192,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -379657,8 +379389,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -379853,8 +379586,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -380049,8 +379783,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -380245,8 +379980,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -380441,8 +380177,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -380637,8 +380374,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -380833,8 +380571,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -381029,8 +380768,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -381225,8 +380965,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -381421,8 +381162,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -381617,8 +381359,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -381813,8 +381556,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -382009,8 +381753,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -382205,8 +381950,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -382401,8 +382147,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -382597,8 +382344,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -382793,8 +382541,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -382989,8 +382738,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -383185,8 +382935,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -383381,8 +383132,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -383577,8 +383329,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -383773,8 +383526,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -383969,8 +383723,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -384165,8 +383920,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -384361,8 +384117,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -384557,8 +384314,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -384753,8 +384511,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -384949,8 +384708,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -385145,8 +384905,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -385341,8 +385102,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -385537,8 +385299,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -385733,8 +385496,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -385929,8 +385693,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -386125,8 +385890,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -386321,8 +386087,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -386517,8 +386284,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -386713,8 +386481,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -386909,8 +386678,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -387105,8 +386875,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -387301,8 +387072,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -387497,8 +387269,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -387693,8 +387466,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -387889,8 +387663,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -388085,8 +387860,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -388281,8 +388057,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -388477,8 +388254,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -388673,8 +388451,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -388869,8 +388648,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -389065,8 +388845,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -389261,8 +389042,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -389457,8 +389239,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -389653,8 +389436,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -389849,8 +389633,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -390045,8 +389830,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -390241,8 +390027,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -390437,8 +390224,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -390633,8 +390421,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -390829,8 +390618,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -391025,8 +390815,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -391221,8 +391012,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -391417,8 +391209,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -391613,8 +391406,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -391809,8 +391603,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -392005,8 +391800,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -392201,8 +391997,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -392397,8 +392194,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -392593,8 +392391,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -392789,8 +392588,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -392985,8 +392785,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -393181,8 +392982,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -393377,8 +393179,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -393573,8 +393376,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -393769,8 +393573,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -393965,8 +393770,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -394161,8 +393967,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -394357,8 +394164,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -394553,8 +394361,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -394749,8 +394558,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -394945,8 +394755,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -395141,8 +394952,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -395337,8 +395149,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -395533,8 +395346,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -395729,8 +395543,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -395925,8 +395740,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -396121,8 +395937,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -396317,8 +396134,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -396513,8 +396331,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -396709,8 +396528,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -396905,8 +396725,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -397101,8 +396922,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -397297,8 +397119,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -397493,8 +397316,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -397689,8 +397513,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -397885,8 +397710,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -398081,8 +397907,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -398277,8 +398104,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -398473,8 +398301,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -398669,8 +398498,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -398865,8 +398695,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -399061,8 +398892,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -399257,8 +399089,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -399453,8 +399286,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -399649,8 +399483,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -399845,8 +399680,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -400041,8 +399877,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -400237,8 +400074,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -400433,8 +400271,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -400629,8 +400468,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -400825,8 +400665,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -401021,8 +400862,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -401217,8 +401059,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -401413,8 +401256,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -401609,8 +401453,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -401805,8 +401650,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -402001,8 +401847,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -402197,8 +402044,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -402393,8 +402241,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -402589,8 +402438,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -402785,8 +402635,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -402981,8 +402832,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -403177,8 +403029,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -403373,8 +403226,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -403569,8 +403423,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -403765,8 +403620,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -403961,8 +403817,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -404157,8 +404014,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -404353,8 +404211,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -404549,8 +404408,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -404745,8 +404605,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -404941,8 +404802,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -405137,8 +404999,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -405333,8 +405196,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -405529,8 +405393,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -405725,8 +405590,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -405921,8 +405787,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -406117,8 +405984,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -406313,8 +406181,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -406509,8 +406378,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -406705,8 +406575,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -406901,8 +406772,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -407097,8 +406969,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -407293,8 +407166,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -407489,8 +407363,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -407685,8 +407560,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -407881,8 +407757,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -408077,8 +407954,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -408273,8 +408151,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -408469,8 +408348,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -408665,8 +408545,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -408861,8 +408742,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -409057,8 +408939,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -409253,8 +409136,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -409449,8 +409333,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -409645,8 +409530,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -409841,8 +409727,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -410037,8 +409924,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -410233,8 +410121,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -410429,8 +410318,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -410625,8 +410515,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -410821,8 +410712,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -411017,8 +410909,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -411213,8 +411106,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -411409,8 +411303,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -411605,8 +411500,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -411801,8 +411697,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -411997,8 +411894,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -412193,8 +412091,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -412389,8 +412288,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -412585,8 +412485,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -412781,8 +412682,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -412977,8 +412879,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -413173,8 +413076,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -413369,8 +413273,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -413565,8 +413470,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -413761,8 +413667,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -413957,8 +413864,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -414153,8 +414061,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -414349,8 +414258,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -414545,8 +414455,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -414741,8 +414652,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -414937,8 +414849,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -415133,8 +415046,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -415329,8 +415243,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -415525,8 +415440,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -415721,8 +415637,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -415917,8 +415834,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -416113,8 +416031,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -416309,8 +416228,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -416505,8 +416425,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -416701,8 +416622,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -416897,8 +416819,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -417093,8 +417016,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -417289,8 +417213,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -417485,8 +417410,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -417681,8 +417607,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -417877,8 +417804,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -418073,8 +418001,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -418269,8 +418198,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -418465,8 +418395,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -418661,8 +418592,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -418857,8 +418789,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -419053,8 +418986,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -419249,8 +419183,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -419445,8 +419380,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -419641,8 +419577,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -419837,8 +419774,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -420033,8 +419971,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -420229,8 +420168,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -420425,8 +420365,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -420621,8 +420562,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -420817,8 +420759,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -421013,8 +420956,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -421209,8 +421153,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -421405,8 +421350,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -421601,8 +421547,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -421797,8 +421744,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -421993,8 +421941,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -422189,8 +422138,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -422385,8 +422335,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -422581,8 +422532,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -422777,8 +422729,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -422973,8 +422926,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -423169,8 +423123,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -423365,8 +423320,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -423561,8 +423517,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -423757,8 +423714,9 @@ }, { "techniqueID": "T1197", - "score": 3, - "showSubtechniques": false + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { "techniqueID": "T1585", @@ -423813,443 +423771,399 @@ "showSubtechniques": false }, { - "techniqueID": "T1596.003", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1222.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1492", - "score": 2, + "techniqueID": "T1067", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1213.002", - "score": 2, + "techniqueID": "T1542.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1109", - "score": 2, + "techniqueID": "T1080", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1588.004", - "score": 2, + "techniqueID": "T1587.002", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1587.003", - "score": 2, + "techniqueID": "T1091", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1565.001", - "score": 2, + "techniqueID": "T1583.001", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1114.001", - "score": 2, + "techniqueID": "T1572", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1489", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml" - }, - { - "techniqueID": "T1568.001", - "score": 2, + "techniqueID": "T1004", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1559.001", - "score": 2, + "techniqueID": "T1071.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1115", - "score": 2, + "techniqueID": "T1021.006", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1218.007", - "score": 2, + "techniqueID": "T1547.004", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1176", - "score": 2, + "techniqueID": "T1550.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1584.003", - "score": 2, + "techniqueID": "T1188", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1560.002", - "score": 2, + "techniqueID": "T1074", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1032", - "score": 2, + "techniqueID": "T1104", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1087.003", - "score": 2, + "techniqueID": "T1583.006", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1218.003", + "techniqueID": "T1072", "score": 2, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { - "techniqueID": "T1562.002", + "techniqueID": "T1210", "score": 2, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml" }, { - "techniqueID": "T1145", + "techniqueID": "T1199", "score": 2, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { - "techniqueID": "T1552.004", - "score": 2, + "techniqueID": "T1069.001", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1583.004", - "score": 2, + "techniqueID": "T1097", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1134.002", - "score": 2, + "techniqueID": "T1090.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1125", - "score": 2, + "techniqueID": "T1584.006", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1482", - "score": 0, + "techniqueID": "T1486", + "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1542.002", - "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1583.003", - "score": 2, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml" }, { - "techniqueID": "T1191", - "score": 2, + "techniqueID": "T1573", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1055.002", - "score": 2, + "techniqueID": "T1028", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1059.004", - "score": 2, + "techniqueID": "T1027.004", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1208", - "score": 2, - "showSubtechniques": false + "techniqueID": "T1197", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { - "techniqueID": "T1036.001", + "techniqueID": "T1585", "score": 2, - "showSubtechniques": false - }, - { - "techniqueID": "T1201", - "score": 1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml" }, { - "techniqueID": "T1187", - "score": 2, + "techniqueID": "T1500", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1567.002", - "score": 2, - "showSubtechniques": false + "techniqueID": "T1485", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml" }, { - "techniqueID": "T1564.005", - "score": 2, + "techniqueID": "T1498", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1584.004", - "score": 2, + "techniqueID": "T1588.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1098.002", - "score": 2, + "techniqueID": "T1008", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1037.001", - "score": 2, + "techniqueID": "T1053.002", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1480.001", - "score": 2, + "techniqueID": "T1090.001", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1558.003", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml" - }, - { - "techniqueID": "T1596.003", - "score": 2, + "techniqueID": "T1584.001", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1222.002", - "score": 2, + "techniqueID": "T1529", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1492", - "score": 2, + "techniqueID": "T1067", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1213.002", - "score": 2, + "techniqueID": "T1542.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1109", - "score": 2, + "techniqueID": "T1080", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1588.004", - "score": 2, + "techniqueID": "T1587.002", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1587.003", - "score": 2, + "techniqueID": "T1091", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1565.001", - "score": 2, + "techniqueID": "T1583.001", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1114.001", - "score": 2, + "techniqueID": "T1572", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1489", - "score": 1, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml" - }, - { - "techniqueID": "T1568.001", - "score": 2, + "techniqueID": "T1004", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1559.001", - "score": 2, + "techniqueID": "T1071.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1115", - "score": 2, + "techniqueID": "T1021.006", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1218.007", - "score": 2, + "techniqueID": "T1547.004", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1176", - "score": 2, + "techniqueID": "T1550.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1584.003", - "score": 2, + "techniqueID": "T1188", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1560.002", - "score": 2, + "techniqueID": "T1074", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1032", - "score": 2, + "techniqueID": "T1104", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1087.003", - "score": 2, + "techniqueID": "T1583.006", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1218.003", + "techniqueID": "T1072", "score": 2, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml" }, { - "techniqueID": "T1562.002", + "techniqueID": "T1210", "score": 2, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml" }, { - "techniqueID": "T1145", + "techniqueID": "T1199", "score": 2, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { - "techniqueID": "T1552.004", - "score": 2, + "techniqueID": "T1069.001", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1583.004", - "score": 2, + "techniqueID": "T1097", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1134.002", - "score": 2, + "techniqueID": "T1090.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1125", - "score": 2, + "techniqueID": "T1584.006", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1482", - "score": 0, + "techniqueID": "T1486", + "score": -3, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" - }, - { - "techniqueID": "T1542.002", - "score": 2, - "showSubtechniques": false + "comment": "https://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/aws_detect_users_with_kms_keys_performing_encryption_s3.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/high_process_termination_frequency.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ransomware_notes_bulk_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ryuk_test_files_detected.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/samsam_test_file_write.yml" }, { - "techniqueID": "T1583.003", - "score": 2, + "techniqueID": "T1573", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1191", - "score": 2, + "techniqueID": "T1028", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1055.002", - "score": 2, + "techniqueID": "T1027.004", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1059.004", - "score": 2, - "showSubtechniques": false + "techniqueID": "T1197", + "score": 0, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/bits_job_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/powershell_start_bitstransfer.yml" }, { - "techniqueID": "T1208", + "techniqueID": "T1585", "score": 2, - "showSubtechniques": false + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_account_creation_via_powersploit_modules.yml" }, { - "techniqueID": "T1036.001", - "score": 2, + "techniqueID": "T1500", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1201", - "score": 1, + "techniqueID": "T1485", + "score": 0, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/common_ransomware_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/common_ransomware_notes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/high_file_deletion_frequency.yml" }, { - "techniqueID": "T1187", - "score": 2, + "techniqueID": "T1498", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1567.002", - "score": 2, + "techniqueID": "T1588.003", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1564.005", - "score": 2, + "techniqueID": "T1008", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1584.004", - "score": 2, + "techniqueID": "T1053.002", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1098.002", - "score": 2, + "techniqueID": "T1090.001", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1037.001", - "score": 2, + "techniqueID": "T1584.001", + "score": 3, "showSubtechniques": false }, { - "techniqueID": "T1480.001", - "score": 2, + "techniqueID": "T1529", + "score": 3, "showSubtechniques": false }, - { - "techniqueID": "T1558.003", - "score": 0, - "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml" - }, { "techniqueID": "T1596.003", "score": 2, @@ -424383,9 +424297,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -424602,9 +424516,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -424821,9 +424735,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -425040,9 +424954,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -425259,9 +425173,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -425478,9 +425392,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -425697,9 +425611,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -425916,9 +425830,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -426135,9 +426049,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -426354,9 +426268,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -426573,9 +426487,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -426792,9 +426706,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -427011,9 +426925,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -427230,9 +427144,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -427449,9 +427363,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -427668,9 +427582,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -427887,9 +427801,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -428106,9 +428020,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -428325,9 +428239,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -428544,9 +428458,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -428763,9 +428677,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -428982,9 +428896,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -429201,9 +429115,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -429420,9 +429334,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -429639,9 +429553,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -429858,9 +429772,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -430077,9 +429991,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -430296,9 +430210,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -430515,9 +430429,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -430734,9 +430648,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -430953,9 +430867,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -431172,9 +431086,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -431391,9 +431305,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -431610,9 +431524,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -431829,9 +431743,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -432048,9 +431962,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -432267,9 +432181,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -432486,9 +432400,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -432705,9 +432619,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -432924,9 +432838,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -433143,9 +433057,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -433362,9 +433276,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -433581,9 +433495,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -433800,9 +433714,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -434019,9 +433933,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -434238,9 +434152,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -434457,9 +434371,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -434676,9 +434590,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -434895,9 +434809,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -435114,9 +435028,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -435333,9 +435247,228 @@ }, { "techniqueID": "T1482", + "score": -1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1208", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1036.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1201", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml" + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1098.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1558.003", "score": 0, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml" + }, + { + "techniqueID": "T1596.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1588.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1587.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1114.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml" + }, + { + "techniqueID": "T1568.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1562.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1145", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1552.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1482", + "score": -1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -435552,9 +435685,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -435771,9 +435904,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -435990,9 +436123,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -436209,9 +436342,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -436428,9 +436561,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -436647,9 +436780,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -436866,9 +436999,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -437085,9 +437218,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -437304,9 +437437,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -437523,9 +437656,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -437742,9 +437875,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -437961,9 +438094,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -438180,9 +438313,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -438399,9 +438532,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -438618,9 +438751,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -438837,9 +438970,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -439056,9 +439189,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -439275,9 +439408,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -439494,9 +439627,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -439713,9 +439846,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -439932,9 +440065,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -440151,9 +440284,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -440370,9 +440503,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -440589,9 +440722,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -440808,9 +440941,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -441027,9 +441160,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -441246,9 +441379,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -441465,9 +441598,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -441684,9 +441817,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -441903,9 +442036,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -442122,9 +442255,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -442341,9 +442474,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -442560,9 +442693,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -442779,9 +442912,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -442998,9 +443131,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -443217,9 +443350,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -443436,9 +443569,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -443655,9 +443788,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -443874,9 +444007,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -444093,9 +444226,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -444312,9 +444445,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -444531,9 +444664,228 @@ }, { "techniqueID": "T1482", + "score": -1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + }, + { + "techniqueID": "T1542.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1191", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1055.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1059.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1208", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1036.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1201", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml" + }, + { + "techniqueID": "T1187", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1567.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1564.005", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1098.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1037.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1480.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1558.003", "score": 0, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/kerberoasting_spn_request_with_rc4_encryption.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___detect_kerberoasting.yml" + }, + { + "techniqueID": "T1596.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1222.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1492", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1213.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1109", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1588.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1587.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1565.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1114.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1489", + "score": 1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/windows_security_account_manager_stopped.yml" + }, + { + "techniqueID": "T1568.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1559.001", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1115", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.007", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1176", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1584.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1560.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1032", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1087.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1218.003", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1562.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1145", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1552.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1583.004", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1134.002", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1125", + "score": 2, + "showSubtechniques": false + }, + { + "techniqueID": "T1482", + "score": -1, + "showSubtechniques": false, + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -444750,9 +445102,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -444969,9 +445321,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -445188,9 +445540,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -445407,9 +445759,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -445626,9 +445978,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -445845,9 +446197,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -446064,9 +446416,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -446283,9 +446635,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -446502,9 +446854,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -446721,9 +447073,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -446940,9 +447292,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -447159,9 +447511,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -447378,9 +447730,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -447597,9 +447949,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -447816,9 +448168,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -448035,9 +448387,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -448254,9 +448606,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -448473,9 +448825,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -448692,9 +449044,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -448911,9 +449263,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -449130,9 +449482,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -449349,9 +449701,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -449568,9 +449920,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -449787,9 +450139,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -450006,9 +450358,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -450225,9 +450577,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -450444,9 +450796,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -450663,9 +451015,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -450882,9 +451234,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -451101,9 +451453,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -451320,9 +451672,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -451539,9 +451891,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -451758,9 +452110,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -451977,9 +452329,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -452196,9 +452548,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -452415,9 +452767,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -452634,9 +452986,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -452853,9 +453205,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -453072,9 +453424,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -453291,9 +453643,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -453510,9 +453862,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -453729,9 +454081,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -453948,9 +454300,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -454167,9 +454519,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -454386,9 +454738,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -454605,9 +454957,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -454824,9 +455176,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -455043,9 +455395,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -455262,9 +455614,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -455481,9 +455833,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -455700,9 +456052,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -455919,9 +456271,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -456138,9 +456490,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -456357,9 +456709,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -456576,9 +456928,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -456795,9 +457147,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -457014,9 +457366,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -457233,9 +457585,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -457452,9 +457804,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -457671,9 +458023,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -457890,9 +458242,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -458109,9 +458461,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -458328,9 +458680,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -458547,9 +458899,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -458766,9 +459118,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -458985,9 +459337,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -459204,9 +459556,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -459423,9 +459775,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -459642,9 +459994,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -459861,9 +460213,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -460080,9 +460432,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -460299,9 +460651,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -460518,9 +460870,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -460737,9 +461089,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -460956,9 +461308,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -461175,9 +461527,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -461394,9 +461746,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -461613,9 +461965,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -461832,9 +462184,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -462051,9 +462403,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -462270,9 +462622,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -462489,9 +462841,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -462708,9 +463060,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -462927,9 +463279,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -463146,9 +463498,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -463365,9 +463717,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -463584,9 +463936,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -463803,9 +464155,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -464022,9 +464374,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -464241,9 +464593,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -464460,9 +464812,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -464679,9 +465031,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -464898,9 +465250,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -465117,9 +465469,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -465336,9 +465688,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -465555,9 +465907,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -465774,9 +466126,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -465993,9 +466345,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -466212,9 +466564,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -466431,9 +466783,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -466650,9 +467002,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -466869,9 +467221,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -467088,9 +467440,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -467307,9 +467659,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -467526,9 +467878,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -467745,9 +468097,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -467964,9 +468316,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -468183,9 +468535,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -468402,9 +468754,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -468621,9 +468973,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -468840,9 +469192,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -469059,9 +469411,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -469278,9 +469630,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -469497,9 +469849,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -469716,9 +470068,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -469935,9 +470287,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -470154,9 +470506,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -470373,9 +470725,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -470592,9 +470944,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -470811,9 +471163,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -471030,9 +471382,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -471249,9 +471601,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -471468,9 +471820,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -471687,9 +472039,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -471906,9 +472258,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -472125,9 +472477,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -472344,9 +472696,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -472563,9 +472915,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -472782,9 +473134,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -473001,9 +473353,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -473220,9 +473572,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -473439,9 +473791,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -473658,9 +474010,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -473877,9 +474229,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -474096,9 +474448,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -474315,9 +474667,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -474534,9 +474886,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -474753,9 +475105,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -474972,9 +475324,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -475191,9 +475543,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -475410,9 +475762,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -475629,9 +475981,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -475848,9 +476200,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -476067,9 +476419,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -476286,9 +476638,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -476505,9 +476857,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -476724,9 +477076,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -476943,9 +477295,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -477162,9 +477514,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -477381,9 +477733,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -477600,9 +477952,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -477819,9 +478171,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -478038,9 +478390,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -478257,9 +478609,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -478476,9 +478828,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -478695,9 +479047,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -478914,9 +479266,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -479133,9 +479485,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -479352,9 +479704,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -479571,9 +479923,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -479790,9 +480142,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -480009,9 +480361,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -480228,9 +480580,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -480447,9 +480799,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -480666,9 +481018,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -480885,9 +481237,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -481104,9 +481456,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -481323,9 +481675,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -481542,9 +481894,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -481761,9 +482113,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -481980,9 +482332,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -482199,9 +482551,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -482418,9 +482770,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -482637,9 +482989,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -482856,9 +483208,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -483075,9 +483427,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -483294,9 +483646,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -483513,9 +483865,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -483732,9 +484084,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -483951,9 +484303,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -484170,9 +484522,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -484389,9 +484741,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -484608,9 +484960,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -484827,9 +485179,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -485046,9 +485398,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -485265,9 +485617,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -485484,9 +485836,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -485703,9 +486055,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -485922,9 +486274,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -486141,9 +486493,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -486360,9 +486712,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -486579,9 +486931,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -486798,9 +487150,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -487017,9 +487369,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -487236,9 +487588,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -487455,9 +487807,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -487674,9 +488026,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -487893,9 +488245,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -488112,9 +488464,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -488331,9 +488683,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -488550,9 +488902,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -488769,9 +489121,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -488988,9 +489340,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -489207,9 +489559,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -489426,9 +489778,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -489645,9 +489997,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -489864,9 +490216,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -490083,9 +490435,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -490302,9 +490654,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -490521,9 +490873,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -490740,9 +491092,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -490959,9 +491311,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -491178,9 +491530,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -491397,9 +491749,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -491616,9 +491968,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -491835,9 +492187,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -492054,9 +492406,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -492273,9 +492625,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -492492,9 +492844,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -492711,9 +493063,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -492930,9 +493282,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -493149,9 +493501,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -493368,9 +493720,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -493587,9 +493939,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -493806,9 +494158,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -494025,9 +494377,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -494244,9 +494596,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -494463,9 +494815,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -494682,9 +495034,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -494901,9 +495253,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -495120,9 +495472,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -495339,9 +495691,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -495558,9 +495910,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -495777,9 +496129,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -495996,9 +496348,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -496215,9 +496567,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -496434,9 +496786,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -496653,9 +497005,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -496872,9 +497224,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -497091,9 +497443,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -497310,9 +497662,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -497529,9 +497881,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -497748,9 +498100,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -497967,9 +498319,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -498186,9 +498538,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -498405,9 +498757,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -498624,9 +498976,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -498843,9 +499195,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -499062,9 +499414,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -499281,9 +499633,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -499500,9 +499852,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -499719,9 +500071,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -499938,9 +500290,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -500157,9 +500509,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -500376,9 +500728,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -500595,9 +500947,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", @@ -500814,9 +501166,9 @@ }, { "techniqueID": "T1482", - "score": 0, + "score": -1, "showSubtechniques": false, - "comment": "https://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" + "comment": "https://github.com/splunk/security_content/blob/develop/detections/dsquery_domain_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/nltest_domain_trust_discovery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml" }, { "techniqueID": "T1542.002", diff --git a/docs/stories.md b/docs/stories.md index 6a9447404c..7b2dded0d1 100644 --- a/docs/stories.md +++ b/docs/stories.md @@ -284,6 +284,50 @@ _version_: 1
details +### BITS Jobs +Adversaries may abuse BITS jobs to persistently execute or clean up after malicious payloads. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1105](https://attack.mitre.org/techniques/T1105/), [T1197](https://attack.mitre.org/techniques/T1197/) +- **Last Updated**: 2021-03-26 + +
+ details + +#### Detection Profile + +* [BITS Job Persistence](detections.md#bits-job-persistence) + +* [BITSAdmin Download File](detections.md#bitsadmin-download-file) + +* [PowerShell Start-BitsTransfer](detections.md#powershell-start-bitstransfer) + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1197 | BITS Jobs | Defense Evasion, Persistence | +| T1105 | Ingress Tool Transfer | Command and Control | + +#### Kill Chain Phase + +* Exploitation + + +#### Reference + +* https://attack.mitre.org/techniques/T1197/ + +* https://docs.microsoft.com/en-us/windows/win32/bits/bitsadmin-tool + + +_version_: 1 +
+ +--- + ### Baron Samedit CVE-2021-3156 Uncover activity consistent with CVE-2021-3156. Discovered by the Qualys Research Team, this vulnerability has been found to affect sudo across multiple Linux distributions (Ubuntu 20.04 and prior, Debian 10 and prior, Fedora 33 and prior). As this vulnerability was committed to code in July 2011, there will be many distributions affected. Successful exploitation of this vulnerability allows any unprivileged user to gain root privileges on the vulnerable host. @@ -924,6 +968,48 @@ _version_: 2 --- +### Domain Trust Discovery +Adversaries may attempt to gather information on domain trust relationships that may be used to identify lateral movement opportunities in Windows multi-domain/forest environments. + +- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Datamodel**: Endpoint +- **ATT&CK**: [T1018](https://attack.mitre.org/techniques/T1018/), [T1482](https://attack.mitre.org/techniques/T1482/) +- **Last Updated**: 2021-03-25 + +
+ details + +#### Detection Profile + +* [DSQuery Domain Discovery](detections.md#dsquery-domain-discovery) + +* [NLTest Domain Trust Discovery](detections.md#nltest-domain-trust-discovery) + +* [Windows AdFind Exe](detections.md#windows-adfind-exe) + + +#### ATT&CK + +| ID | Technique | Tactic | +| ----------- | ----------- |--------------| +| T1482 | Domain Trust Discovery | Discovery | +| T1018 | Remote System Discovery | Discovery | + +#### Kill Chain Phase + +* Exploitation + + +#### Reference + +* https://attack.mitre.org/techniques/T1482/ + + +_version_: 1 +
+ +--- + ### F5 TMUI RCE CVE-2020-5902 Uncover activity consistent with CVE-2020-5902. Discovered by Positive Technologies researchers, this vulnerability affects F5 BIG-IP, BIG-IQ. and Traffix SDC devices (vulnerable versions in F5 support link below). This vulnerability allows unauthenticated users, along with authenticated users, who have access to the configuration utility to execute system commands, create/delete files, disable services, and/or execute Java code. This vulnerability can result in full system compromise. @@ -1054,7 +1140,7 @@ Adversaries may transfer tools or other files from an external system into a com - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: Endpoint -- **ATT&CK**: [T1105](https://attack.mitre.org/techniques/T1105/) +- **ATT&CK**: [T1059.001](https://attack.mitre.org/techniques/T1059.001/), [T1105](https://attack.mitre.org/techniques/T1105/), [T1197](https://attack.mitre.org/techniques/T1197/) - **Last Updated**: 2021-03-24
@@ -1062,6 +1148,12 @@ Adversaries may transfer tools or other files from an external system into a com #### Detection Profile +* [Any Powershell DownloadFile](detections.md#any-powershell-downloadfile) + +* [Any Powershell DownloadString](detections.md#any-powershell-downloadstring) + +* [BITSAdmin Download File](detections.md#bitsadmin-download-file) + * [CertUtil Download With URLCache and Split Arguments](detections.md#certutil-download-with-urlcache-and-split-arguments) * [CertUtil Download With VerifyCtl and Split Arguments](detections.md#certutil-download-with-verifyctl-and-split-arguments) @@ -1073,7 +1165,21 @@ Adversaries may transfer tools or other files from an external system into a com | ID | Technique | Tactic | | ----------- | ----------- |--------------| +| T1059.001 | PowerShell | Execution | +| T1197 | BITS Jobs | Defense Evasion, Persistence | | T1105 | Ingress Tool Transfer | Command and Control | +| T1003 | OS Credential Dumping | Credential Access | +| T1021 | Remote Services | Lateral Movement | +| T1113 | Screen Capture | Collection | +| T1123 | Audio Capture | Collection | +| T1563 | Remote Service Session Hijacking | Lateral Movement | +| T1053 | Scheduled Task/Job | Execution, Persistence, Privilege Escalation | +| T1134 | Access Token Manipulation | Defense Evasion, Privilege Escalation | +| T1548 | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation | +| T1055 | Process Injection | Defense Evasion, Privilege Escalation | +| T1106 | Native API | Execution | +| T1569 | System Services | Execution | +| T1027 | Obfuscated Files or Information | Defense Evasion | #### Kill Chain Phase @@ -1189,6 +1295,8 @@ Attackers are finding stealthy ways "live off the land," leveraging utilities an | ID | Technique | Tactic | | ----------- | ----------- |--------------| | T1059.001 | PowerShell | Execution | +| T1197 | BITS Jobs | Defense Evasion, Persistence | +| T1105 | Ingress Tool Transfer | Command and Control | | T1003 | OS Credential Dumping | Credential Access | | T1021 | Remote Services | Lateral Movement | | T1113 | Screen Capture | Collection | @@ -2042,16 +2150,12 @@ Monitor and detect registry changes initiated from remote locations, which can b | ID | Technique | Tactic | | ----------- | ----------- |--------------| | T1548.002 | Bypass User Account Control | Defense Evasion, Privilege Escalation | -| T1112 | Modify Registry | Defense Evasion | -| T1222.001 | Windows File and Directory Permissions Modification | Defense Evasion | | T1547.010 | Port Monitors | Persistence, Privilege Escalation | | T1564.001 | Hidden Files and Directories | Defense Evasion | | T1547.001 | Registry Run Keys / Startup Folder | Persistence, Privilege Escalation | | T1546.012 | Image File Execution Options Injection | Persistence, Privilege Escalation | | T1546.011 | Application Shimming | Persistence, Privilege Escalation | | T1546.001 | Change Default File Association | Persistence, Privilege Escalation | -| T1036 | Masquerading | Defense Evasion | -| T1562.001 | Disable or Modify Tools | Defense Evasion | #### Kill Chain Phase @@ -2267,8 +2371,30 @@ Detect tactics used by malware to evade defenses on Windows endpoints. A few of #### Detection Profile +* [Disable Registry Tool](detections.md#disable-registry-tool) + +* [Disable Show Hidden Files](detections.md#disable-show-hidden-files) + +* [Disable Windows Behavior Monitoring](detections.md#disable-windows-behavior-monitoring) + +* [Disable Windows SmartScreen Protection](detections.md#disable-windows-smartscreen-protection) + +* [Disabling CMD Application](detections.md#disabling-cmd-application) + +* [Disabling ControlPanel](detections.md#disabling-controlpanel) + +* [Disabling Firewall with Netsh](detections.md#disabling-firewall-with-netsh) + +* [Disabling FolderOptions Windows Feature](detections.md#disabling-folderoptions-windows-feature) + +* [Disabling NoRun Windows App](detections.md#disabling-norun-windows-app) + * [Disabling Remote User Account Control](detections.md#disabling-remote-user-account-control) +* [Disabling SystemRestore In Registry](detections.md#disabling-systemrestore-in-registry) + +* [Disabling Task Manager](detections.md#disabling-task-manager) + * [Eventvwr UAC Bypass](detections.md#eventvwr-uac-bypass) * [FodHelper UAC Bypass](detections.md#fodhelper-uac-bypass) @@ -2290,17 +2416,12 @@ Detect tactics used by malware to evade defenses on Windows endpoints. A few of | ID | Technique | Tactic | | ----------- | ----------- |--------------| +| T1562.001 | Disable or Modify Tools | Defense Evasion | +| T1564.001 | Hidden Files and Directories | Defense Evasion | | T1548.002 | Bypass User Account Control | Defense Evasion, Privilege Escalation | | T1112 | Modify Registry | Defense Evasion | | T1222.001 | Windows File and Directory Permissions Modification | Defense Evasion | -| T1547.010 | Port Monitors | Persistence, Privilege Escalation | -| T1564.001 | Hidden Files and Directories | Defense Evasion | -| T1547.001 | Registry Run Keys / Startup Folder | Persistence, Privilege Escalation | -| T1546.012 | Image File Execution Options Injection | Persistence, Privilege Escalation | -| T1546.011 | Application Shimming | Persistence, Privilege Escalation | -| T1546.001 | Change Default File Association | Persistence, Privilege Escalation | | T1036 | Masquerading | Defense Evasion | -| T1562.001 | Disable or Modify Tools | Defense Evasion | #### Kill Chain Phase @@ -3222,7 +3343,7 @@ Detect and investigate dormant user accounts for your AWS environment that have - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: -- **ATT&CK**: [T1078.004](https://attack.mitre.org/techniques/T1078.004/) +- **ATT&CK**: [T1078.004](https://attack.mitre.org/techniques/T1078.004/), [T1526](https://attack.mitre.org/techniques/T1526/) - **Last Updated**: 2018-03-12
@@ -3230,6 +3351,8 @@ Detect and investigate dormant user accounts for your AWS environment that have #### Detection Profile +* [AWS Excessive Security Scanning](detections.md#aws-excessive-security-scanning) + * [Detect API activity from users without MFA](detections.md#detect-api-activity-from-users-without-mfa) * [Detect AWS API Activities From Unapproved Accounts](detections.md#detect-aws-api-activities-from-unapproved-accounts) @@ -3245,6 +3368,7 @@ Detect and investigate dormant user accounts for your AWS environment that have | ID | Technique | Tactic | | ----------- | ----------- |--------------| +| T1526 | Cloud Service Discovery | Discovery | | T1078.004 | Cloud Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation | #### Kill Chain Phase @@ -3990,7 +4114,7 @@ _version_: 1 ### Suspicious Cloud User Activities Detect and investigate suspicious activities by users and roles in your cloud environments. -- **Product**: Splunk Security Analytics for AWS, Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +- **Product**: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud - **Datamodel**: Change - **ATT&CK**: [T1078](https://attack.mitre.org/techniques/T1078/), [T1078.004](https://attack.mitre.org/techniques/T1078.004/) - **Last Updated**: 2020-09-04 diff --git a/docs/stories.wiki b/docs/stories.wiki index 6df32b70ff..f38a7080ba 100644 --- a/docs/stories.wiki +++ b/docs/stories.wiki @@ -346,6 +346,61 @@ Monitor your environment for activity consistent with common attack techniques b ==Adversary Tactics== +===Bits jobs=== +Adversaries may abuse BITS jobs to persistently execute or clean up after malicious payloads. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1197/ T1197], [https://attack.mitre.org/techniques/T1105/ T1105] +* '''Last Updated''': 2021-03-26 + +
+
+ +====Detection Profile==== + +* [[Documentation:ESSOC:detections:Detections#Bits_job_persistence|BITS Job Persistence]] + +* [[Documentation:ESSOC:detections:Detections#Bitsadmin_download_file|BITSAdmin Download File]] + +* [[Documentation:ESSOC:detections:Detections#Powershell_start-bitstransfer|PowerShell Start-BitsTransfer]] + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1197 +| BITS Jobs +| Defense Evasion, Persistence +|- +| T1105 +| Ingress Tool Transfer +| Command and Control +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Reference==== + +* https://attack.mitre.org/techniques/T1197/ + +* https://docs.microsoft.com/en-us/windows/win32/bits/bitsadmin-tool + + +''version'': 1 +
+
+ +---- + ===Baron samedit cve-2021-3156=== Uncover activity consistent with CVE-2021-3156. Discovered by the Qualys Research Team, this vulnerability has been found to affect sudo across multiple Linux distributions (Ubuntu 20.04 and prior, Debian 10 and prior, Fedora 33 and prior). As this vulnerability was committed to code in July 2011, there will be many distributions affected. Successful exploitation of this vulnerability allows any unprivileged user to gain root privileges on the vulnerable host. @@ -1203,6 +1258,59 @@ Looks for activities and techniques associated with the disabling of security to ---- +===Domain trust discovery=== +Adversaries may attempt to gather information on domain trust relationships that may be used to identify lateral movement opportunities in Windows multi-domain/forest environments. + +* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Datamodel''': Endpoint +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1482/ T1482], [https://attack.mitre.org/techniques/T1018/ T1018] +* '''Last Updated''': 2021-03-25 + +
+
+ +====Detection Profile==== + +* [[Documentation:ESSOC:detections:Detections#Dsquery_domain_discovery|DSQuery Domain Discovery]] + +* [[Documentation:ESSOC:detections:Detections#Nltest_domain_trust_discovery|NLTest Domain Trust Discovery]] + +* [[Documentation:ESSOC:detections:Detections#Windows_adfind_exe|Windows AdFind Exe]] + + + +====ATT&CK==== +{| +! style="text-align:left;"| ID +! Technique +! Tactic +|- +| T1482 +| Domain Trust Discovery +| Discovery +|- +| T1018 +| Remote System Discovery +| Discovery +|} + + +====Kill Chain Phase==== + +* Exploitation + + +====Reference==== + +* https://attack.mitre.org/techniques/T1482/ + + +''version'': 1 +
+
+ +---- + ===F5 tmui rce cve-2020-5902=== Uncover activity consistent with CVE-2020-5902. Discovered by Positive Technologies researchers, this vulnerability affects F5 BIG-IP, BIG-IQ. and Traffix SDC devices (vulnerable versions in F5 support link below). This vulnerability allows unauthenticated users, along with authenticated users, who have access to the configuration utility to execute system commands, create/delete files, disable services, and/or execute Java code. This vulnerability can result in full system compromise. @@ -1370,7 +1478,7 @@ Adversaries may transfer tools or other files from an external system into a com * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1105/ T1105] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1059.001/ T1059.001], [https://attack.mitre.org/techniques/T1197/ T1197], [https://attack.mitre.org/techniques/T1105/ T1105], [https://attack.mitre.org/techniques/T1003/ T1003], [https://attack.mitre.org/techniques/T1021/ T1021], [https://attack.mitre.org/techniques/T1113/ T1113], [https://attack.mitre.org/techniques/T1123/ T1123], [https://attack.mitre.org/techniques/T1563/ T1563], [https://attack.mitre.org/techniques/T1053/ T1053], [https://attack.mitre.org/techniques/T1134/ T1134], [https://attack.mitre.org/techniques/T1548/ T1548], [https://attack.mitre.org/techniques/T1055/ T1055], [https://attack.mitre.org/techniques/T1106/ T1106], [https://attack.mitre.org/techniques/T1569/ T1569], [https://attack.mitre.org/techniques/T1027/ T1027] * '''Last Updated''': 2021-03-24
@@ -1378,6 +1486,12 @@ Adversaries may transfer tools or other files from an external system into a com ====Detection Profile==== +* [[Documentation:ESSOC:detections:Detections#Any_powershell_downloadfile|Any Powershell DownloadFile]] + +* [[Documentation:ESSOC:detections:Detections#Any_powershell_downloadstring|Any Powershell DownloadString]] + +* [[Documentation:ESSOC:detections:Detections#Bitsadmin_download_file|BITSAdmin Download File]] + * [[Documentation:ESSOC:detections:Detections#Certutil_download_with_urlcache_and_split_arguments|CertUtil Download With URLCache and Split Arguments]] * [[Documentation:ESSOC:detections:Detections#Certutil_download_with_verifyctl_and_split_arguments|CertUtil Download With VerifyCtl and Split Arguments]] @@ -1392,9 +1506,65 @@ Adversaries may transfer tools or other files from an external system into a com ! Technique ! Tactic |- +| T1059.001 +| PowerShell +| Execution +|- +| T1197 +| BITS Jobs +| Defense Evasion, Persistence +|- | T1105 | Ingress Tool Transfer | Command and Control +|- +| T1003 +| OS Credential Dumping +| Credential Access +|- +| T1021 +| Remote Services +| Lateral Movement +|- +| T1113 +| Screen Capture +| Collection +|- +| T1123 +| Audio Capture +| Collection +|- +| T1563 +| Remote Service Session Hijacking +| Lateral Movement +|- +| T1053 +| Scheduled Task/Job +| Execution, Persistence, Privilege Escalation +|- +| T1134 +| Access Token Manipulation +| Defense Evasion, Privilege Escalation +|- +| T1548 +| Abuse Elevation Control Mechanism +| Defense Evasion, Privilege Escalation +|- +| T1055 +| Process Injection +| Defense Evasion, Privilege Escalation +|- +| T1106 +| Native API +| Execution +|- +| T1569 +| System Services +| Execution +|- +| T1027 +| Obfuscated Files or Information +| Defense Evasion |} @@ -1488,7 +1658,7 @@ Attackers are finding stealthy ways "live off the land," leveraging utilities an * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1059.001/ T1059.001], [https://attack.mitre.org/techniques/T1003/ T1003], [https://attack.mitre.org/techniques/T1021/ T1021], [https://attack.mitre.org/techniques/T1113/ T1113], [https://attack.mitre.org/techniques/T1123/ T1123], [https://attack.mitre.org/techniques/T1563/ T1563], [https://attack.mitre.org/techniques/T1053/ T1053], [https://attack.mitre.org/techniques/T1134/ T1134], [https://attack.mitre.org/techniques/T1548/ T1548], [https://attack.mitre.org/techniques/T1055/ T1055], [https://attack.mitre.org/techniques/T1106/ T1106], [https://attack.mitre.org/techniques/T1569/ T1569], [https://attack.mitre.org/techniques/T1027/ T1027] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1059.001/ T1059.001], [https://attack.mitre.org/techniques/T1197/ T1197], [https://attack.mitre.org/techniques/T1105/ T1105], [https://attack.mitre.org/techniques/T1003/ T1003], [https://attack.mitre.org/techniques/T1021/ T1021], [https://attack.mitre.org/techniques/T1113/ T1113], [https://attack.mitre.org/techniques/T1123/ T1123], [https://attack.mitre.org/techniques/T1563/ T1563], [https://attack.mitre.org/techniques/T1053/ T1053], [https://attack.mitre.org/techniques/T1134/ T1134], [https://attack.mitre.org/techniques/T1548/ T1548], [https://attack.mitre.org/techniques/T1055/ T1055], [https://attack.mitre.org/techniques/T1106/ T1106], [https://attack.mitre.org/techniques/T1569/ T1569], [https://attack.mitre.org/techniques/T1027/ T1027] * '''Last Updated''': 2017-08-23
@@ -1536,6 +1706,14 @@ Attackers are finding stealthy ways "live off the land," leveraging utilities an | PowerShell | Execution |- +| T1197 +| BITS Jobs +| Defense Evasion, Persistence +|- +| T1105 +| Ingress Tool Transfer +| Command and Control +|- | T1003 | OS Credential Dumping | Credential Access @@ -2610,7 +2788,7 @@ Monitor and detect registry changes initiated from remote locations, which can b * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1548.002/ T1548.002], [https://attack.mitre.org/techniques/T1112/ T1112], [https://attack.mitre.org/techniques/T1222.001/ T1222.001], [https://attack.mitre.org/techniques/T1547.010/ T1547.010], [https://attack.mitre.org/techniques/T1564.001/ T1564.001], [https://attack.mitre.org/techniques/T1547.001/ T1547.001], [https://attack.mitre.org/techniques/T1546.012/ T1546.012], [https://attack.mitre.org/techniques/T1546.011/ T1546.011], [https://attack.mitre.org/techniques/T1546.001/ T1546.001], [https://attack.mitre.org/techniques/T1036/ T1036], [https://attack.mitre.org/techniques/T1562.001/ T1562.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1548.002/ T1548.002], [https://attack.mitre.org/techniques/T1547.010/ T1547.010], [https://attack.mitre.org/techniques/T1564.001/ T1564.001], [https://attack.mitre.org/techniques/T1547.001/ T1547.001], [https://attack.mitre.org/techniques/T1546.012/ T1546.012], [https://attack.mitre.org/techniques/T1546.011/ T1546.011], [https://attack.mitre.org/techniques/T1546.001/ T1546.001] * '''Last Updated''': 2018-05-31
@@ -2646,14 +2824,6 @@ Monitor and detect registry changes initiated from remote locations, which can b | Bypass User Account Control | Defense Evasion, Privilege Escalation |- -| T1112 -| Modify Registry -| Defense Evasion -|- -| T1222.001 -| Windows File and Directory Permissions Modification -| Defense Evasion -|- | T1547.010 | Port Monitors | Persistence, Privilege Escalation @@ -2677,14 +2847,6 @@ Monitor and detect registry changes initiated from remote locations, which can b | T1546.001 | Change Default File Association | Persistence, Privilege Escalation -|- -| T1036 -| Masquerading -| Defense Evasion -|- -| T1562.001 -| Disable or Modify Tools -| Defense Evasion |} @@ -2945,7 +3107,7 @@ Detect tactics used by malware to evade defenses on Windows endpoints. A few of * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Endpoint -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1548.002/ T1548.002], [https://attack.mitre.org/techniques/T1112/ T1112], [https://attack.mitre.org/techniques/T1222.001/ T1222.001], [https://attack.mitre.org/techniques/T1547.010/ T1547.010], [https://attack.mitre.org/techniques/T1564.001/ T1564.001], [https://attack.mitre.org/techniques/T1547.001/ T1547.001], [https://attack.mitre.org/techniques/T1546.012/ T1546.012], [https://attack.mitre.org/techniques/T1546.011/ T1546.011], [https://attack.mitre.org/techniques/T1546.001/ T1546.001], [https://attack.mitre.org/techniques/T1036/ T1036], [https://attack.mitre.org/techniques/T1562.001/ T1562.001] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1562.001/ T1562.001], [https://attack.mitre.org/techniques/T1564.001/ T1564.001], [https://attack.mitre.org/techniques/T1548.002/ T1548.002], [https://attack.mitre.org/techniques/T1112/ T1112], [https://attack.mitre.org/techniques/T1222.001/ T1222.001], [https://attack.mitre.org/techniques/T1036/ T1036] * '''Last Updated''': 2018-05-31
@@ -2953,8 +3115,30 @@ Detect tactics used by malware to evade defenses on Windows endpoints. A few of ====Detection Profile==== +* [[Documentation:ESSOC:detections:Detections#Disable_registry_tool|Disable Registry Tool]] + +* [[Documentation:ESSOC:detections:Detections#Disable_show_hidden_files|Disable Show Hidden Files]] + +* [[Documentation:ESSOC:detections:Detections#Disable_windows_behavior_monitoring|Disable Windows Behavior Monitoring]] + +* [[Documentation:ESSOC:detections:Detections#Disable_windows_smartscreen_protection|Disable Windows SmartScreen Protection]] + +* [[Documentation:ESSOC:detections:Detections#Disabling_cmd_application|Disabling CMD Application]] + +* [[Documentation:ESSOC:detections:Detections#Disabling_controlpanel|Disabling ControlPanel]] + +* [[Documentation:ESSOC:detections:Detections#Disabling_firewall_with_netsh|Disabling Firewall with Netsh]] + +* [[Documentation:ESSOC:detections:Detections#Disabling_folderoptions_windows_feature|Disabling FolderOptions Windows Feature]] + +* [[Documentation:ESSOC:detections:Detections#Disabling_norun_windows_app|Disabling NoRun Windows App]] + * [[Documentation:ESSOC:detections:Detections#Disabling_remote_user_account_control|Disabling Remote User Account Control]] +* [[Documentation:ESSOC:detections:Detections#Disabling_systemrestore_in_registry|Disabling SystemRestore In Registry]] + +* [[Documentation:ESSOC:detections:Detections#Disabling_task_manager|Disabling Task Manager]] + * [[Documentation:ESSOC:detections:Detections#Eventvwr_uac_bypass|Eventvwr UAC Bypass]] * [[Documentation:ESSOC:detections:Detections#Fodhelper_uac_bypass|FodHelper UAC Bypass]] @@ -2979,6 +3163,14 @@ Detect tactics used by malware to evade defenses on Windows endpoints. A few of ! Technique ! Tactic |- +| T1562.001 +| Disable or Modify Tools +| Defense Evasion +|- +| T1564.001 +| Hidden Files and Directories +| Defense Evasion +|- | T1548.002 | Bypass User Account Control | Defense Evasion, Privilege Escalation @@ -2991,37 +3183,9 @@ Detect tactics used by malware to evade defenses on Windows endpoints. A few of | Windows File and Directory Permissions Modification | Defense Evasion |- -| T1547.010 -| Port Monitors -| Persistence, Privilege Escalation -|- -| T1564.001 -| Hidden Files and Directories -| Defense Evasion -|- -| T1547.001 -| Registry Run Keys / Startup Folder -| Persistence, Privilege Escalation -|- -| T1546.012 -| Image File Execution Options Injection -| Persistence, Privilege Escalation -|- -| T1546.011 -| Application Shimming -| Persistence, Privilege Escalation -|- -| T1546.001 -| Change Default File Association -| Persistence, Privilege Escalation -|- | T1036 | Masquerading | Defense Evasion -|- -| T1562.001 -| Disable or Modify Tools -| Defense Evasion |} @@ -4221,7 +4385,7 @@ Detect and investigate dormant user accounts for your AWS environment that have * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': -* '''ATT&CK''': [https://attack.mitre.org/techniques/T1078.004/ T1078.004] +* '''ATT&CK''': [https://attack.mitre.org/techniques/T1526/ T1526], [https://attack.mitre.org/techniques/T1078.004/ T1078.004] * '''Last Updated''': 2018-03-12
@@ -4229,6 +4393,8 @@ Detect and investigate dormant user accounts for your AWS environment that have ====Detection Profile==== +* [[Documentation:ESSOC:detections:Detections#Aws_excessive_security_scanning|AWS Excessive Security Scanning]] + * [[Documentation:ESSOC:detections:Detections#Detect_api_activity_from_users_without_mfa|Detect API activity from users without MFA]] * [[Documentation:ESSOC:detections:Detections#Detect_aws_api_activities_from_unapproved_accounts|Detect AWS API Activities From Unapproved Accounts]] @@ -4247,6 +4413,10 @@ Detect and investigate dormant user accounts for your AWS environment that have ! Technique ! Tactic |- +| T1526 +| Cloud Service Discovery +| Discovery +|- | T1078.004 | Cloud Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation @@ -5132,7 +5302,7 @@ Monitor your cloud infrastructure provisioning activities for behaviors originat ===Suspicious cloud user activities=== Detect and investigate suspicious activities by users and roles in your cloud environments. -* '''Product''': Splunk Security Analytics for AWS, Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud +* '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud * '''Datamodel''': Change * '''ATT&CK''': [https://attack.mitre.org/techniques/T1078.004/ T1078.004], [https://attack.mitre.org/techniques/T1078/ T1078] * '''Last Updated''': 2020-09-04 @@ -6827,7 +6997,7 @@ Reduce the risk of CVE-2018-11409, an information disclosure vulnerability withi '' ############# # Automatically generated by doc_gen.py in https://github.com/splunk/security_content -# On Date: 2021-04-02 17:10:21.639044 UTC +# On Date: 2021-04-15 19:33:38.229931 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/package/README.md b/package/README.md new file mode 100644 index 0000000000..d0a87c3f9b --- /dev/null +++ b/package/README.md @@ -0,0 +1,7 @@ +# Splunk ES Content Update + +This subscription service delivers pre-packaged Security Content for use with Splunk Enterprise Security. Subscribers get regular updates to help security practitioners more quickly address ongoing and time-sensitive customer problems and threats. + +Requires Splunk Enterprise Security version 4.5 or greater. + +For more information please visit the [Splunk ES Content Update user documentation](https://docs.splunk.com/Documentation/ESSOC). \ No newline at end of file diff --git a/package/README/essoc_story_detail.txt b/package/README/essoc_story_detail.txt new file mode 100644 index 0000000000..5333752842 --- /dev/null +++ b/package/README/essoc_story_detail.txt @@ -0,0 +1,15 @@ +The Analytic Story Details dashboard renders all the details of the content related to a specific analytic story which +can be chose via the drop down + +Each analytic story has attributes associated with it and the following: +______________________________________________________________________ + + + Analytic Story: name of the analytic story + Description ; description of the analytic story + Search Name : The name of the searches belonging to the chosen analytic story + Search : The search query which looks for an attack pattern corresponding to the analytic story + Search Description: The description of the search query + Asset Type: The analytic story specifies what asset in the infrastructure may be compromised + Category: The category that the search belongs to (malware, vulnerabilities, best practices, abuse) + Kill Chain Phase: The kill chain phase of the attack that the search is after. \ No newline at end of file diff --git a/package/README/essoc_summary.txt b/package/README/essoc_summary.txt new file mode 100644 index 0000000000..d7dde31ec6 --- /dev/null +++ b/package/README/essoc_summary.txt @@ -0,0 +1,24 @@ +The ES_SOC Summary Dashboard provides you a summarized view of the analytic story contents of the ES-SOC app. +The dashboard has the following panels gives you following details + +1) Analytic story Summary + - Total Analytic Stories : The total number of Analytic stories in the ES-SOC application + - Total Searches: The total number of searches in ES-SOC + - Searches added last week: Number of searches added to ES-SOC in the last week. + + 2) Analytic story Category: This dashboard panel summarizes the categories of the searches that the ES-SOC app contains. The categories of the analytic stories are as follow + -Malware: These searches detect specific malware behavior for a particular phase of the attack kill chain. E.g. a malware’s delivery method via email or a malware’s installation behavior via registry key changes + -Vulnerability: These searches detect behavior or a signature of a vulnerable software in use. These searches are not designed to replace vulnerability management or scanning systems. The purpose of these searches is to discover a vulnerability through side effects or behaviors. + -Abuse: Some actions can be deemed malicious because they are unexpected, violate corporate policy or are significantly different than the actions of other users. E.g. A USB disk that is seen on multiple systems or a user that uploads excessive files to a cloud service or a database query that dumps an entire table + -Best Practices: Searches that correspond to specific guidelines from organizations like SANS or OWASP + + 3) Kill Chain phases: Every analytic story has one or more searches which look for a certain kind of attack pattern/behavior. These searches have an attribute which essentially tells you what Kill chain phase does the search correspond to. + The numbers on the dashboard represents the number of searches correponding to each kill chain phase + + 4) Analytic story table: This table gives the user a comprehensive view of some of the details of the analytic story. Some of the listed attributes are: + - Analytic Story : The name of the analytic story + - Description: The description of the analyttic story + - Search names: The name of the searches in each analytic story + - Datamodels: The name of the datamodel that the search is querying against. + - Technology Examples: This field represent some examples related to the technologies required to populate the datamodels(Nessues, Cisco Firewall,etc) + - Kill chain phase: The name of the kill chain phase that the search belongs to \ No newline at end of file diff --git a/package/README/essoc_usage_dashboard.txt b/package/README/essoc_usage_dashboard.txt new file mode 100644 index 0000000000..fcbc842881 --- /dev/null +++ b/package/README/essoc_usage_dashboard.txt @@ -0,0 +1,51 @@ +###################### +ESSOC Usage Dashboard# +###################### + +The ESSOC Usage dashboard is designed to provide high-level insight into the usage of the ES-SOC app. It is suitable for display when providing feedback to the Splunk team or for identifying how the ES-SOC app is being used. This dashboard has two time selectors that work independently - the top time selector determines the search time range for all the single-value. And the lower time selector, determines the time range for the usage table. + +IMPORTANT: The user loading this dashboard must have permission to search the _audit index + +################## +#Dashboard panels# +################## + +Searches Ran + +The total number of searches in ES-SOC that were executed. This number includes scheduled searches and ad hoc searches run from the search bar using the '| savedsearch ‘ syntax + +Unique Searches + +The unique/distinct searches executed on the deployment. This is equivalent to the distinct count of searches run in the ES-SOC app. + +Most Run + +The total number of searches in ES-SOC that were executed. This number includes scheduled searches and ad hoc searches run from the search bar using the '| savedsearch ‘ syntax. + +Ad hoc Searches + +The total number of searches run from the search bar using the '| savedsearch ‘ syntax. + +Scheduled + +The total number of ESSOC searches run that were scheduled. + +Most Active User + +The user who executed the highest number/count of searches. This calculation includes scheduled searches and ad hoc searches run from the search bar using the '| savedsearch ‘ syntax. + +Search Run Time (seconds) + +Total run time of all searches executed in seconds. This calculation includes scheduled searches and ad hoc searches run from the search bar using the '| savedsearch ‘ syntax. + +Average Run Time (seconds) + +Average run time of all searches executed in seconds. This calculation includes scheduled searches and ad hoc searches run from the search bar using the '| savedsearch ‘ syntax. + +Max Run Time (seconds) + +The run time of the longest running search. This calculation includes scheduled searches and ad hoc searches run from the search bar using the '| savedsearch ‘ syntax. + +Search summary + +This table provides details on each search that was executed in the ESSOC app. \ No newline at end of file diff --git a/package/app.manifest b/package/app.manifest new file mode 100644 index 0000000000..4bc6dbc051 --- /dev/null +++ b/package/app.manifest @@ -0,0 +1,46 @@ +{ + "schemaVersion": "1.0.0", + "info": { + "title": "ES Content Updates", + "id": { + "group": null, + "name": "DA-ESS-ContentUpdate", + "version": "3.19.0" + }, + "author": [ + { + "name": "Splunk Security Research Team", + "email": "research@splunk.com", + "company": "Splunk" + } + ], + "releaseDate": null, + "description": "Explore the Analytic Stories included with ES Content Updates.", + "classification": { + "intendedAudience": null, + "categories": [], + "developmentStatus": null + }, + "commonInformationModels": null, + "license": { + "name": null, + "text": null, + "uri": null + }, + "privacyPolicy": { + "name": null, + "text": null, + "uri": null + }, + "releaseNotes": { + "name": null, + "text": "./README.md", + "uri": null + } + }, + "dependencies": null, + "tasks": null, + "inputGroups": null, + "incompatibleApps": null, + "platformRequirements": null +} \ No newline at end of file diff --git a/package/appserver/static/alert_escu_contextualize.png b/package/appserver/static/alert_escu_contextualize.png new file mode 100644 index 0000000000000000000000000000000000000000..23c161b5c2ee5d1007635a39d73cf5de8bbf4913 GIT binary patch literal 4530 zcmV;j5l!xiP)v)BFhgvbzQl9Si9-*-9x zC9_`pclKUu?X}h+9C^A#fR5nPH3CNf>Sl)=0q6)oeRCp5cF;fi4q|{B1OAgV!k}zh zT|yoxaz#I&5MK;O8(_8k-p8W(}_T&`sZjlbuqiT<{4OY9r>*A7s^^evH$I-$`L zW@=N*VP-d&R|=vP9?LfSw#2@14=6yfp#KIi61o+6G@qGq(|-?xuhuQQIGZMB8gT-i z^IG=R`FIK3>NDEK9_+}2N#h5V>1Na62z}~YNH#n z7q=&1RHOx8z>+3_Fa>~D{Z8Od7+4RcOF+zkSPbUXAQThv24-HQTN}6a7f}5M5CESk##5RuVaBB( zoC@Fo0T*~JyZ-Z=P90j{_JjbsUg6;l1R6 zc*QZRwzcM4P~w(p(`72XoEW1eVRe}mU7m|JZu)LyUddC(O`VV_J zG;v5GS+s_k=MZ6o*NVMT8Fgy|K4PJ*idWZXFUO}M*uYjD*uTfUWY(4NxB!B zY-UNf6Y;Ye1tm<*L83Bqd0 ze5HW)&-sp2`~8h;0mPXww=5jpei)b`zpE+54@t@27Xqe~BmiCjpu9lCnMF0xcbtOM zBY@(jv7W(G2=rF~6I7N4!aJ!roz?kRB}`)`6aNkn&v@KeK%vO~Tt>xAV>N(jw3jM) z2*=%^Q<8)k#2k_-t|-4XcQjN!XV9?X`-$aj60Y+-wHppgG`BCR7(8@v!DeMAII~;- z0>X&^-qtN!C7zBR#{e~&(`OP=>xuXm-f(o0%9`6Go5^I;g3b;(5u7qfvi2Hl+T~?6 z^|Krz#QB_JOn(El*eTs<6lHJ9Lc(5MIF6R&0e zpgYB14bi>dK^?NCLIg#$zvadVE0|8Lu!pS9~c+eXRdZ_d6h@1Wi41N{h z1A=IQCv2~CVxwb#G9a}Vw|=B)m|R+O$RWmm>i1v>e<%c9RazVQcPEMm0-*L6>ARST ze!ah-<@gbyt$RE4G*?d<*Oqp@L%<_l72!JD)kA=cj~LjmTlOj0f*J$9UlZYE-HJ}_ z4LFLYuRbVSZ`?FqXVB}q6}h3)|F<%@T(_dfIknRi;30xkDikMKXktO*#X?u= zy8bAa#;bj&a|*V%u(3S5x)?W&rx-X}x9m)fySpbZK$$vl(6~@YjAf#40`fX0TBV2W zV24muj&Qp@yJb2(YS^v)Qv>eKV5h&gnw7(oEIw_;zLCe)z24Zt7c-3jfS(D%{gAYs z1-&(bVX<$laM63Jiw8n8gT4^N*JhU?J_}S1D;g2l5Z(Rqfu8W?qTLnp7rBz0kd!>GJiO)aU;518lu694#~3&o%q1Wq(!>OB9;clb zpo58(x;88;3)?@-WyGFpqau~YOHQ|ISBuWv{((Oz8jbLsl0NphzVvBYYJ73cCgqsF z^2Do*g)DIw6IGOjBY(<8(=9+C3h3d;id@X9E+02uSBa)7b!0QU-GxUN zFJHf_R{{?*#e&8@m&7?Gb@s;G_WKur`Mv=IC|)(~VwUnA-Lf4;gnWxtRZ5qe53BSE z!6$lZqo4K#ptxzIgocXjtUp^`EZ7eK5pavwvTO3ZfvLnC@mRLIFI|L8KrsDv0B71Y z1iI5>MHcl*W@ubN{6N`$5~&ls;m!Y@%l-z_SSZlTBc^)jDdP8?IqBA7%DVSBdFwIL zcLkVk5-xF_r>1_Z@)?Pw|5Qjxo(Hv0*Dp?58QhfiT?R>~G2>WfzMKSBdc)D`>@Z(Y;Mpa~HKyF*0%E3rJds?% zpos+B=K1ibJ89jzoPDwQQvdM~SjFI3AT0A9D7=?et6xsNiF5e{w{2 z2SknAFsK%UwFLgV1a0%W?I(L2<~zToM$`D57=PC5?29^ns}K2Irybz!fVfPrYp)(Q zh9;Nr{y`^oE`PR|(~oYW)M947fkBV!1uZ{zy6c*j8sAP6)(|i<%~((tYk8q__oN{( zb#i&#tFLv~wkPO2D-C+yRNdDc!E6{!uQ$Q7}FL(I!E7w$vT@&wSxJ5%f=z zlA|EBg86E_F8Y!aU5)_COp|h^UGfEi=BTkZC&K^HXjJG=F+B1OmhP@61JXEDE+u9f+rcPFw#A2cH5`=*^#T7AnkIst+6^BM zBq$xS_b>C0+S?|#x`cK{Np1ZH`E>H4iox;0g`WX3?X{xi-GSL7C%rppT%@T_2AEgr zbNGtL$ot!-{iUi*z4!wZR}Q@u>$ZYDZUsP8u*YT79MAIW`U_weG~ zdpZw(tL9&GnO2g-kYPe#h5%PHvkOG8Xma26C0U({4!hK`@{GhiYUhAxOHU@r@~y4M zJ19R$#;+JW530V>&~ipsv&~Ia{`1n3>%bTdZ~@d25Y$YJFIcr1Adg~(`uZmYq9g$y zgXArq@W$uzMV@wtTx5g!Oc0*at>`6Ak5N~2{RU8`z?SmeEG4aAmJgKGZJgJgfokHb zrKPYaJqX2+g~x-qoEXGH?jm5j*q>@@MN4aUX+?YFth@^l3mK@5RGT=L? z-AE$3snVC;7Z zo>3BxZdMs`Vz7HLgKkv*j0v(0QM8f z8<@3+04@diHKA!g?n$209f`ETUss#cp5+| zQWXK%p?t_? z>ZE(4T=D$B{w&-HXz}2*?=Z{E7tvpN2v_J~d#w{W14T2SN6d-QD#2_`R*pYF+K_B| z!PxI9h&cZ6*NLv)(0uIx^~UJ`OP(VDb%XX1fQ|svw*z@(2OZf#ecM6*3$+w)!6oqw Q0{{R307*qoM6N<$f{TQtHvj+t literal 0 HcmV?d00001 diff --git a/package/appserver/static/alert_escu_investigate.png b/package/appserver/static/alert_escu_investigate.png new file mode 100644 index 0000000000000000000000000000000000000000..23c161b5c2ee5d1007635a39d73cf5de8bbf4913 GIT binary patch literal 4530 zcmV;j5l!xiP)v)BFhgvbzQl9Si9-*-9x zC9_`pclKUu?X}h+9C^A#fR5nPH3CNf>Sl)=0q6)oeRCp5cF;fi4q|{B1OAgV!k}zh zT|yoxaz#I&5MK;O8(_8k-p8W(}_T&`sZjlbuqiT<{4OY9r>*A7s^^evH$I-$`L zW@=N*VP-d&R|=vP9?LfSw#2@14=6yfp#KIi61o+6G@qGq(|-?xuhuQQIGZMB8gT-i z^IG=R`FIK3>NDEK9_+}2N#h5V>1Na62z}~YNH#n z7q=&1RHOx8z>+3_Fa>~D{Z8Od7+4RcOF+zkSPbUXAQThv24-HQTN}6a7f}5M5CESk##5RuVaBB( zoC@Fo0T*~JyZ-Z=P90j{_JjbsUg6;l1R6 zc*QZRwzcM4P~w(p(`72XoEW1eVRe}mU7m|JZu)LyUddC(O`VV_J zG;v5GS+s_k=MZ6o*NVMT8Fgy|K4PJ*idWZXFUO}M*uYjD*uTfUWY(4NxB!B zY-UNf6Y;Ye1tm<*L83Bqd0 ze5HW)&-sp2`~8h;0mPXww=5jpei)b`zpE+54@t@27Xqe~BmiCjpu9lCnMF0xcbtOM zBY@(jv7W(G2=rF~6I7N4!aJ!roz?kRB}`)`6aNkn&v@KeK%vO~Tt>xAV>N(jw3jM) z2*=%^Q<8)k#2k_-t|-4XcQjN!XV9?X`-$aj60Y+-wHppgG`BCR7(8@v!DeMAII~;- z0>X&^-qtN!C7zBR#{e~&(`OP=>xuXm-f(o0%9`6Go5^I;g3b;(5u7qfvi2Hl+T~?6 z^|Krz#QB_JOn(El*eTs<6lHJ9Lc(5MIF6R&0e zpgYB14bi>dK^?NCLIg#$zvadVE0|8Lu!pS9~c+eXRdZ_d6h@1Wi41N{h z1A=IQCv2~CVxwb#G9a}Vw|=B)m|R+O$RWmm>i1v>e<%c9RazVQcPEMm0-*L6>ARST ze!ah-<@gbyt$RE4G*?d<*Oqp@L%<_l72!JD)kA=cj~LjmTlOj0f*J$9UlZYE-HJ}_ z4LFLYuRbVSZ`?FqXVB}q6}h3)|F<%@T(_dfIknRi;30xkDikMKXktO*#X?u= zy8bAa#;bj&a|*V%u(3S5x)?W&rx-X}x9m)fySpbZK$$vl(6~@YjAf#40`fX0TBV2W zV24muj&Qp@yJb2(YS^v)Qv>eKV5h&gnw7(oEIw_;zLCe)z24Zt7c-3jfS(D%{gAYs z1-&(bVX<$laM63Jiw8n8gT4^N*JhU?J_}S1D;g2l5Z(Rqfu8W?qTLnp7rBz0kd!>GJiO)aU;518lu694#~3&o%q1Wq(!>OB9;clb zpo58(x;88;3)?@-WyGFpqau~YOHQ|ISBuWv{((Oz8jbLsl0NphzVvBYYJ73cCgqsF z^2Do*g)DIw6IGOjBY(<8(=9+C3h3d;id@X9E+02uSBa)7b!0QU-GxUN zFJHf_R{{?*#e&8@m&7?Gb@s;G_WKur`Mv=IC|)(~VwUnA-Lf4;gnWxtRZ5qe53BSE z!6$lZqo4K#ptxzIgocXjtUp^`EZ7eK5pavwvTO3ZfvLnC@mRLIFI|L8KrsDv0B71Y z1iI5>MHcl*W@ubN{6N`$5~&ls;m!Y@%l-z_SSZlTBc^)jDdP8?IqBA7%DVSBdFwIL zcLkVk5-xF_r>1_Z@)?Pw|5Qjxo(Hv0*Dp?58QhfiT?R>~G2>WfzMKSBdc)D`>@Z(Y;Mpa~HKyF*0%E3rJds?% zpos+B=K1ibJ89jzoPDwQQvdM~SjFI3AT0A9D7=?et6xsNiF5e{w{2 z2SknAFsK%UwFLgV1a0%W?I(L2<~zToM$`D57=PC5?29^ns}K2Irybz!fVfPrYp)(Q zh9;Nr{y`^oE`PR|(~oYW)M947fkBV!1uZ{zy6c*j8sAP6)(|i<%~((tYk8q__oN{( zb#i&#tFLv~wkPO2D-C+yRNdDc!E6{!uQ$Q7}FL(I!E7w$vT@&wSxJ5%f=z zlA|EBg86E_F8Y!aU5)_COp|h^UGfEi=BTkZC&K^HXjJG=F+B1OmhP@61JXEDE+u9f+rcPFw#A2cH5`=*^#T7AnkIst+6^BM zBq$xS_b>C0+S?|#x`cK{Np1ZH`E>H4iox;0g`WX3?X{xi-GSL7C%rppT%@T_2AEgr zbNGtL$ot!-{iUi*z4!wZR}Q@u>$ZYDZUsP8u*YT79MAIW`U_weG~ zdpZw(tL9&GnO2g-kYPe#h5%PHvkOG8Xma26C0U({4!hK`@{GhiYUhAxOHU@r@~y4M zJ19R$#;+JW530V>&~ipsv&~Ia{`1n3>%bTdZ~@d25Y$YJFIcr1Adg~(`uZmYq9g$y zgXArq@W$uzMV@wtTx5g!Oc0*at>`6Ak5N~2{RU8`z?SmeEG4aAmJgKGZJgJgfokHb zrKPYaJqX2+g~x-qoEXGH?jm5j*q>@@MN4aUX+?YFth@^l3mK@5RGT=L? z-AE$3snVC;7Z zo>3BxZdMs`Vz7HLgKkv*j0v(0QM8f z8<@3+04@diHKA!g?n$209f`ETUss#cp5+| zQWXK%p?t_? z>ZE(4T=D$B{w&-HXz}2*?=Z{E7tvpN2v_J~d#w{W14T2SN6d-QD#2_`R*pYF+K_B| z!PxI9h&cZ6*NLv)(0uIx^~UJ`OP(VDb%XX1fQ|svw*z@(2OZf#ecM6*3$+w)!6oqw Q0{{R307*qoM6N<$f{TQtHvj+t literal 0 HcmV?d00001 diff --git a/package/appserver/static/alerticon.png b/package/appserver/static/alerticon.png new file mode 100644 index 0000000000000000000000000000000000000000..c7f9d26890d80e8b61811ebcfbf1a08089e9eed9 GIT binary patch literal 8991 zcmV+)BjDVLP)Dg|00001b5ch_0Itp) z=>PyC*-1n}RCodHT?w2N#ntcX=~-ZRXJ!c|h$oUnMCCAXcexZq5YMPFXbdW1ypwn( zMr9W=!tSCmhqv*FiHRoi8G=WYfCNDi*u@J)5l!Uq06bu4_5h}5y1xIbo|^5Q>F()S zX4qY&f4|+TspHkF_v(1{>Q$AZ?EShe1z5Mm+=4g{pH|!y`}Bug`oj?L%T!=D^{Cwx@AhbOWnBA! zEWdJ1p9NfJMSm%J9^*=XE-9$8TQL{xls~15_@0WvZ=m0lUWRvPx7*KoJUq5E5^HH9 zCNRc!25ahz;ih;gnZr3}(dx=pxIHN>R8$gR;UzB{^|+Vdje5nto+#El^JP^Pe1 z!P@#|xe~EiiS;!rH>Y!^tY(_;mQZ-b zwp{Y(Gi|5zJpO-^e9<>IU9NCG6FuQ;W`$T2Q`vVzHTCbiRgm(wzVYEuT}@Ont{w&$ zhH+=QQ!wy`{&VC}{l$XLI)s^4o z27eX8Q9!_8Y#U(A2o5>u583j%!R=_=9%o)-_3-hG8@GdqM`R$)*y@nKcsPc$c5_zq z^bv#OiNyC52El~$O5`ia$cq5<-upsz4OiO5Q5bsOy=sL?#28r&kP37<@kG zNDgE;e4zxJm@U0160d>=hFE|WO9=s{X@eCM~hVhl74WgwV76b)n~7;~^wo^*Ur=B0se?DLn% zmM^YBo+>$vQhwmIi>vJRP{3cyZg^P;QciGpH@u+C1EI>I7-}$72_Yd_Ij%7E5ue|< zsWiN5i>v_VqesE8$?~_=1(G_N`vMT@alfK1DXv}du{Ay){?@7y`|C=4EXe;uFmfUo z>bHXnTpkV8tvX-EHHXXhP3Y=uG`=awlcFbv@b`j6#g%AKjWTV%-Be-u22Ajps>+W| zaAm24jaI%KoVyys;wv&ty8N~iN}`R8tH8iP6o#}0r2D0+%Ky$aZSJ0w>PQM^@%UMW z!On${ItD#lC^OIl*9ObV%Gvb`TO{7n#jtubQ}`W7J5q+JK6Y$yR>Mp3cfQ?%GLMHV zgAtv7jFwzVi2GFEaeXbXE1mkagh%ZckLzcFG5u6c zxzjpYq$Ac;J$!7!NW37z8EX#t+5RkCA5Bk}uiph_9w8a2D!&J<(Ubt0GPkUD)erK8 zd{=|hSXKTHNULWNUKly<4b`stNg;6*!$Cm{V7|L0e9QxMg_a?G~JQ7$(=E87?NoF`sFAoL`>rN^}KyR4=NZzyAJq%%#xVi{SB^rx>rwxc1L692Iu6x6 zXTb!P<{9P3$K%Re6dxiKK%6+pb49SO;URaF>|;qig~j#BhGCq8)zo+}FsT!T6kFu) z3oXc}_Bk^{NrKd4vD8`-!o}wbXA2oq9}gTfT9CSlSHTJpC5 z`Q=b%&k5Ev{LvCFyrjTZ-cfuk{6s80j($h0%P+w??i_frF5|u0(y;C5gnws#c1JMW z@LpTEH(z6QT$v^{-3?L@b-d3aJ$v%X=t!5J-K z&W1J!bF@&EplIb8XoF^lYU@{0nAgv2aPem`T^uO$sH%EVz8RQT<|PR}zpck9ulae; zQ%mYz+AJ%P%}pw#Z^O`YqD+e+cOkSDx0K$za!IziNidGxpU!sv3wV5o;DFG&Pg73H=Mb6`^GH|OlxQ6s z@UhkDngbF}5;0>r@Dy_#uzfA$FB#)?x0>I7sXwxD^=xP|u0iYfi3$sSCJTFQ`RR-! z81&`BKr;tad({==Ab^B{%P~n9H2lsA`cJ82;jkgoxw)WMX+&>XDjA5h5nquyGF^xv zO;l5Y4-NQ=-^xW7>X~`8I}nZNub?uAf*Q>r@?U5nO6wUCi%GgdYdu(0216x!T&33@ zm)tIT9KG#m$`4}C$Nt#Op;;@jf9CBohsyX8%wGopzJE8pUy-8 zT?QzJz zPVsA}@>pE#$oDAn9kNSL%%#@fQ3eto(W;6m(3IZ;ZwZL@8C2C5glbm(+Y63Kp=%lF zX9`?Qc^!n>j^E=l^230ttft|{jBuL(Ps}rWhW-wSY}t>?ga+crIb)}Ikt%5yA=0@0 zE)aDpK|J+ifdo|FcY$K$d2&v{<~rZH23@fVw}c%9#`DES2VJHdo$$<6{(>} z55G@o-nB?F5F^I19npY9t49qqxIPC&hs_QCtL!(S1BX>P2~Jk5NeacD=ChV%gf%+l zM;&6E`49Ipzk1TJm^(r89&w+O)bp zy6KI7(tMo_2GND+V@)UM2RafxiLMk!9fas@P3Pp#+VjZfL@^T269CcL7^{%`aiokD zIz6boNW&1US@ob(K{A~GZbYxh=kfXYJq8fB`!se|U}pUbGCo(=92F9ieZ|WCG>=ez z(W@;zPYPFJb2#2QwMbLv^$M@tkZW1i^q8-{pD>I^QCcr*$f2SA&+%e}WUeoj$ylE* z^K0x6#o_vo2(H)<Ql`8iebxDa`XE;}q7U`ITvQg?b62#c*`%7jp&U6r}}=){_gtI4`*5 zD-A5w7BJ?UgdU(n3ja|=f9^rdX|5f@t!$IN!nTK!9hs!RV-`o|ktqNM;F*@3wQjq} zmUOn>h`y0*R8B$n-GMRw)Zna@FWV;UW`V()l}|%Rn+!2O0eW2&t*-c8N2`#eZ*3|+ z=r8z?3TW?fWFA>EgV<8}`vF;bwa@DPS7TM>rKs2>Ov*7uWoJOrTjD);*G~x<;0a6v zQ-w^xm1{7ZqLFs&OVarR%1!hqJ~%;gWF91=p)wPsqWzja{rm#?I~TVxJbD1o5YiJ& z^s2l_qq)HEDrunw`YU9DI|M#Vc_>;}(WfK05uJ(NGOv{nGEBP8%){9M3~|El5G|l5 zR7DR6^E|B2Waexx4~JEz#~wiwDn-kDG2lO`!$V58vbsWi&|h*B2u~WFeR;ETZ!S0q zAq(b@L}#M6nHNU@1Rv}nIWmt9ebCtf5Itpq44{+AJddor?7_7UZPK6n1@d6$oHg}e z%7wcliM5B^HGe@bxf22z^_(~an6pWHeB;PG0z!vAXi*9V zrZ!N)j6r0cmny`;L%Rb=JCmYO$aTGH8rC}`{Za*sH84|z(19hyJ*3;rRzYFzn6y_F zX+dwId$vP2uFNAq)S7_MC1_1=OC-pyQu>`-L)U+eR@ejip6%%FxfATJ9v;++YcT)4 zhPl2swuQpk@U_yD=q%`+cG$)aMpougrerTVg8Zb;B7<1+JAKir5hKy+P9o_G2Q?g} zC8zw|Jsb@lCLc_!i6L-IHH9|kS`j^ou9O0!)e%H*=hSU6o|s3cbz~MYLC(kxpPV^+Y$~0Db%P>3F6Z3$;nKCn-9gu!Iw`qDg zdMH1h;+U%3YM17#5{5m`+eBTtac)!HF<*D9x0S9|db{Rvi=;T(i$Y&Mg!~u=bvpDx zey0zjt}t!K*uAolhb)}R?@HlVI?O@u+emYNqIuUvZnzO$iM}EY=q>2(mH}~Dd!9Iv zDuFQN-)^UM=rS90|MMw1#_+FnuM;$&xliHAwJpC?lF`l;bOn87TsykUz%(~2^U&SK zS@O)W_%poC@y}p1B+hGZ3e2j1DkH&HFd$gg`;VYuE2=)AaeC!Ua{-PIbp(FzhZk$10bpLr6HZfZ4{mip`bTAZj;XEZf*ioh(eL;6Yf4hXq zFjwZ$tqVwJs>3jLyGfZ;5S9n05?s}%%}c`H>wp4i#=<5C=NV3SBZ#0c=$uSblBB<5 z7FXucbr~`zdXw0um%r29mNzyG#*oE*0)Y2Yg zIY8f$Zd*K*z)EK;{V6W}b7h{m=Omc}Kxs$a@r$dsIW**3)em zx_^fSvoJ);Blw&_1*X0985GR_6&d5ka5n%Ly;jS3EB$4d)wMk(M8=|YLy!@Rm!}dl z<-L^O#siJQ2q_kMY**4QX zCv8R8`UX&_>SzD6js1!TVnq4?Ln0+ zj?R=uuXgsS%z5_Ep^a#q-xZBU&If1)mq)5A{uu*mev*%%#fkZH&jJPM3DNWEY9? zN3fo{04)zy5z_$fspA(=IQ{OlZ$R%9ZJJw}&9$>fWQZTcm-OTr%u7$;<+tiH1TrY2 z#Y_4^rD>Ty;wZ37Xn8Wr;AfcenK64JgqBZWf?$9akLScZC;allJczcvr~oV!GFpdI z!G#DX2#)GEw(l-H0Vf|oaGsmA<}}OflMi?ug%Q-0Wsr`y+U2Kkinoi~6JgEo zeB6iTVa#2;MDO)QKFZAKc_^SKNjJFwSN%S7GUiG#E%tl^BxpAW~UTyBts z`sO3j0?@Zp*-l7q5OUkLmM0{?YIO#5@M z+T|N1Iy=In4~psf&5*Shgl5%0F2f7z>V{w*TE|8D~S{y3F;F!E%~ zlY)8lL<{L9AJp-^pOY1c!9*9(1&bIi2~vIoBF4~gPB3)78V&AFrv^zlLbG%n=<~fuV!o}0 z2bZMNR6=!GjygE*&X};;=@SDR1E8!Mb@b1aOIH3X%&kh`s0=& zeh3J$S!L`(^n&4D?;Nwj%a>mqZ>w!M4dci}FmWyL?}J_Nd+2ryx*)H8ImtS4Hokqh z`3p3G{SW(y75V1a#mg{VHI9>h46*guY=K;vCjjAXofJTNFv8`ddqaXnYFV(h;nz0F zk`+^*r?_Z%>^?LHCSqhZ!H+`)cfo#RHcZ41MgB)XFm%+;|L7QY&|f?Rjp}MJfOL{a z;u6?JXmIo7=^s@!M4gak6x}nEjy2JvtghieSVjLgJ+9qvgP)W7-Hz_5&~_fs%>5Jh zW+mcpQYs|Yl_G6lH(}q>j@wMrk6g*pUcO&Zq5aqZI9}$%dud+T`&&wAJ%KfLxTK%S7#j6 zH#n`~3oI?J^!a>8VOU!Xdi223;>KuHe-F!1(^SDQr-xkVLurYwl5v2&J{#jGPgdp$ zz%XAYmp*!;#q{O$UksUOt$iT?3=-M`Rk;#ZJ{=XPX|N2-Il=6-#6(y$xZ^Q5e;-J| zu!!%Arrlp4#JTOfmkn7fUD2ac^mfbViFx!4nFNBVXbi2x|D(*Fg=V``B<=u zXVGXKM{nyO&0Xo~oPHzA-HaL6A@4pkS3s()jwg(2z}$j7|3OQ8KH%^BM0a?*975Ja z;5-qVG~?qjWw4k`k`<>p5c;nsdD zKQsxOTE<#c<9Ev6UfrbV|2ops-><1rv=}X;;s%=l_?3{_7I=l#S?M4xzX68PwTf?J zS7H%PLoGrt`E+;jq1VB<&dxw%9wcDlg-p=B9Q2>$cAW=svH$2*Vzjd7(6|CJ1sL!c z-jBP?&E`<1-RtH?0owAyMLPF`fs@;EvL*;cCp%rFjZV8D60ioL2r;G+c3LMr1b(p#8oWSrHigS8+9l9r=!b zN%~f$ATTz=O%>_LJOU6La?l^(tTBP{fOwVI{L$h6kdXQ!^O0OvUTU6JKCHulx_8E8VDMC&@8{8;NO z$DV+11u|Y=G@+x^`j)?7cfs7HVC;!d(EsDkKHq1pPr9EDYDS|`Jcz-6 zL~*F^--G_X7kkmFcz)3YDmGk|c!ZZ1O*}D=5N)ikxF!8?ABCd^*cI4~w}h%It_9p% z(J-)G*auqf&=Ly(d=pUJBpm*Gj-qDX5DTc~lhH4sq?*+v|y(Q!-uvifb1^l%b zCf^fb^okdrWWg2thtt-GR;-=`CTV=|pE9_CU@H#jBp4W=znhrbL-%|8MHHP)`FiiRg zA846w3uq-Xvnh;aS)f|Wc68nFq1@^-*Q(sibJwUPy z!z&^av1Xf!9zlv?A&kL4-{)6vEDhHSa}YNg$T;e8UFzjZiI|(4uQy|((D~K%w;c~UJJ_1|d|=#29EM5YF!XNR+QeWW-1b^C;E_u3Z@2~TkEM01V6vCn*R5Y` zmQ|%8G{5hp<5lJOho?f~g9-{3%ACUj+vYQ$L~X(bX%m#XJ20siBUJ$DX=|&*CI=18 zTM_;rq<=Ehx6jiZ?a^O~chV(+#3R5u_5|CkfH4XwmwI_;Pr|Ts!3frT^Qa?m{r@;H z@;gW~5RxDc!gx6ok9W`&UW_NYTh#<_iWlL% zzM{l-FDk5T<=DkHPAgx6@G&9|>M~jm$j2D%(&r;ArP|5|FgqAj0oY`0N3RgkFdtZE zmo6V+NycQ=FXp4HbQn}GNU0|CU|C&g#!>m67wPH9di@Q}#2^ft7~U|zVXZ_@ZF7QLMZ#M}^hAr>o!0p#gcCe6h$Xv9GS4F`FSpk_X`2XYv=;;{ zNWCFH+rN<4hZK}~O;zQ`;$Y!YNf<1$ac-Sm4ZYqgGEBNj>#0?cB!&4K(n8J2meNZf z^k9VBj>kH8%>0o2> z{NXu}txkk^B~I(KVPX2fz{f(h4d=;l8ZE>QI5(ysPl}$TWDXV;S3(ckDAVTKO%;}J zz!Dz6byOhIq*vkIt!vRLi)1+J*#v(ry^$K(x^0TWjr(OB2qaAFf>5TwkddJ+01ZkL*JaSH3%F+n1RsXKk=C_nTWZsnjt{L>$;vBfECidA zl<5M5G8~6y?Dt|9=7yK4js^P)&OC{^`51ltx9DABM_z`*{Q$(-58<#=#D|CfFsxoe z7h}_FRv_$|AnYL`&gCD7wwZ2-b-N`(+$?19`DjGh&Gi{u58}+DLmzZ@fK1SV$HgX! zY$x#j1pWb5lu(bSIMaUaWh2#^ucQ7w#yp82*~H-X(%Vt_)Y%6a2ga?Y7aP;JT+9QW ziSMD8jROHIk={wobswFdOTkO?&`Dej;a8*u%bzVMzaG7DvF7tVovw93kEJskD^dPX znZe?&!Al_5(#c>;Si!w}oOx8EKFlWY2% zfbY4)Uy7bbZ|l$#E%K!gH}cU%qX7-~i|+mQQlK*_@c+a`bwh*$pV9yT002ovPDHLk FV1kDzasL1S literal 0 HcmV?d00001 diff --git a/package/appserver/static/analytic_story_details.css b/package/appserver/static/analytic_story_details.css new file mode 100644 index 0000000000..ce54b7882b --- /dev/null +++ b/package/appserver/static/analytic_story_details.css @@ -0,0 +1,187 @@ +/* .rTable { + display: table; + width: 100%; +} + +.rTableRow { + display: table-row; +} + +.rTableHeading { + display: table-header-group; + background-color: #ddd; +} + +.rTableCell, .rTableHead { + display: table-cell; + padding: 3px 10px; + //border: 1px solid #999999; +} + +.rTableLeftCell { + display: table-cell; + padding: 3px 10px; + //border: 1px solid #999999; + width: 200px; +} + +.rTableHeading { + display: table-header-group; + background-color: #ddd; + font-weight: bold; +} + +.rTableFoot { + display: table-footer-group; + font-weight: bold; + background-color: #ddd; +} + +.rTableBody { + display: table-row-group; +} */ + +h1 { + font-size: 24px; + font-weight: 200; + margin: 0; +} + +h3 { + padding-left: 10px; +} + +.as_title_attr_bar { + padding-left: 15%; + background-color: #eee; + height: 40px; + line-height: 40px; + margin-bottom: 7px; +} + +.as_title_attr { + float: left; + margin-right: 5%; + padding-right: 20px; + font-size: 14px; +} + +.as_search_accordion { + width: 100%; + margin-top: 10px; +} + +.as_story_details { + display: flex; + max-height: 500px; + clear: both; +} + +.as_story_details_left_col { + float: right; + width: 34%; + display: block; + overflow: scroll; + padding: 10px; + margin: 10px; + border: 1px solid #ddd; +} + +.as_story_details_right_col { + float: left; + width: 60%; + overflow: scroll; + padding: 10px; + margin: 10px; + border: 1px solid #ddd; +} + +.as_left_attr{ + display: inline-block; + width: 100%; +} + +.as_story_detail_left_attr_label { + float: left; + width: 30%; + padding-top: 2%; +} + +.as_story_detail_left_attr { + margin-top: 5px; + float: left; + width: 70%; +} + +.value_label { + float: left; + margin-right: 5px; + background-color: #eee; + padding: 4px; + border-radius: 6px; + margin-bottom: 5px; +} + +.as_story_detail_right_attr_label { + margin-bottom: 7px; +} + +.search_content { + display: flex; + clear: both; +} + +.search_left_panel { + float: left; + width: 70%; + margin: 10px; + padding: 10px; + border: 1px solid #ddd; +} + +.search_right_panel { + float: left; + width: 25%; + margin: 10px; + padding: 10px; + border: 1px solid #ddd; +} + +.search_left_attr { + margin: 10px; +} + +.search_right_attr { + margin: 10px; + display: table; +} + +.search_string{ + padding: 10px; + background-color: #ddd; + border: 1px solid #aaa; + border-radius: 2px; +} + +.data_model_tag { + background-color: #11a88b; +} + +.kill_chain_tag { + background-color: #ed8440; + color: #303841; +} + +.attack_tag { + background-color: #3863a0; + color: #eee; +} + +.heading-story { + width: 80%; + float: left; +} + +.run_story_btn { + float: right; +} \ No newline at end of file diff --git a/package/appserver/static/analytic_story_details.js b/package/appserver/static/analytic_story_details.js new file mode 100644 index 0000000000..932b4426f0 --- /dev/null +++ b/package/appserver/static/analytic_story_details.js @@ -0,0 +1,575 @@ +require([ + 'underscore', + 'jquery', + 'splunkjs/mvc', + 'splunkjs/mvc/searchmanager', + 'splunkjs/mvc/searchbarview', + 'splunkjs/mvc/tableview', + 'splunk.util', + '../app/DA-ESS-ContentUpdate/js/lib/showdown.min', + '../app/DA-ESS-ContentUpdate/js/lib/jquery-ui/jquery-ui', + 'css!../app/DA-ESS-ContentUpdate/js/lib/jquery-ui/jquery-ui.css', + 'css!../app/DA-ESS-ContentUpdate/analytic_story_details.css', + 'splunkjs/mvc/simplexml/ready!' +], function(_, $, mvc, SearchManager, SearchBarView, TableView, splunkUtil, showdown) { + + let tokenModel = mvc.Components.get("default"); + let renderedComponents = []; + + let templ = ` +
+
+ Category: +
+
+ Version: +
+
+ Created: +
+
+ Modified: +
+
+
+
+

+
+
+ +
+
+
+
+
+ Description: +
+
+ +
+
+ Narrative: +
+
+ +
+
+
+
+
+ ATT&CK: +
+
+
+
+
+
+ Kill Chain Phases: +
+
+
+
+
+
+ CIS Controls: +
+
+
+
+
+
+ Data Model: +
+
+
+
+
+
+ References: +
+
+
+
+
+
+
+

+ Analytic Story Searches +

+
+

Detection

+
+
+
+
+

Investigative

+
+
+
+
+

Support

+
+
+
+
+
+
+ `; + + $('#analytic_story_details').html(_.template(templ)); + + if (tokenModel.get('analytic_story_name')) { + fetchAnalyticStoryDetails(tokenModel.get('analytic_story_name')); + } + + tokenModel.on("change:analytic_story_name", function(model, value, options) { + fetchAnalyticStoryDetails(value); + }); + + function fetchAnalyticStoryDetails(asName) { + let epoch = (new Date).getTime(); + let searchGetAnalyticStoryData = new SearchManager({ + id: epoch, + earliest_time: "-1h@h", + latest_time: "now", + cache: false, + search: "| rest /services/configs/conf-analytic_stories splunk_server=local count=0 | search title=\"" + asName + "\" | spath input=reference path={} output=ref | spath input=data_models path={} output=dm | table title, category, description, version, mappings, creation_date, modification_date, dm, narrative, ref" + }); + + $('.run-story').unbind('click'); + + $('.run-story').on('click', function(evt) { + window.open('/en-US/app/Splunk_ASX/execute?form.mode=now&form.cron=*%2F15%20*%20*%20*%20*&form.earliest_time=-15m&form.latest_time=now&form.time.earliest=-24h%40h&form.time.latest=now&form.story=' + asName); + }); + + let asSearch = splunkjs.mvc.Components.getInstance(epoch); + let asResults = asSearch.data("results", { + count: 0 + }); + asResults.on("data", function() { + let as_attributes = {}; + let fields = asResults.data().fields; + let rows = asResults.data().rows; + + for (let i = 0; i < fields.length; i++) { + as_attributes[fields[i]] = rows[0][i]; + } + renderStoryAttributes(as_attributes); + }); + + var searchGetSearchesData = new SearchManager({ + id: "s" + epoch, + earliest_time: "-1h@h", + latest_time: "now", + cache: false, + search: "| rest /services/saved/searches splunk_server=local count=0 | spath input=action.escu.analytic_story path={} output=uc | search uc = \"" + asName + "\" | spath input=action.escu.data_models path={} output=dm | table action.escu.full_search_name, search, description, action.escu.search_type, action.escu.how_to_implement, action.escu.eli5, action.escu.version, action.escu.mappings, dm, tex, action.escu.asset_at_risk, action.escu.confidence, action.escu.known_false_positives, updated, action.escu.modification_date, action.escu.creation_date " + + }); + var searchesSearch = splunkjs.mvc.Components.getInstance("s" + epoch); + var searchesResults = searchesSearch.data("results", { + count: 0 + }); + + + searchesResults.on("data", function() { + let asSearchAttr = []; + var fields = searchesResults.data().fields; + var rows = searchesResults.data().rows; + + for (let i = 0; i < rows.length; i++) { + let searchObj = {}; + for (let j = 0; j < fields.length; j++) { + searchObj[fields[j]] = rows[i][j]; + } + asSearchAttr.push(searchObj); + } + renderSearches(asSearchAttr); + }); + } + + function renderStoryAttributes(asAttributes) { + let converter = new showdown.Converter(); + let mappings = JSON.parse(asAttributes.mappings); + $('#as_label_category').html(asAttributes.category); + $('#as_label_version').html(asAttributes.version); + $('#as_label_created').html(asAttributes.creation_date); + $('#as_label_modified').html(asAttributes.modification_date); + $('#story_heading').html(asAttributes.title); + $('#attack').html(mappings.mitre_attack); + $('#narrative').html(converter.makeHtml(asAttributes.narrative)); + $('#description').html(converter.makeHtml(asAttributes.description)); + $('#mitre_attack').html(getValueLabels(mappings.mitre_attack, 'attack_tag')); + $('#data_model').html(getValueLabels(asAttributes.dm, 'data_model_tag')); + $('#kill_chain_phases').html(getValueLabels(mappings.kill_chain_phases, 'kill_chain_tag')); + $('#cis_20').html(getValueLabels(mappings.cis20)); + $('#references').html(getReferenceURLS(asAttributes.ref)); + } + + function getReferenceURLS(refs) { + if (refs === null) { + return " "; + } else { + let refsResult = ``; + if (Array.isArray(refs)) { + refs.map(ref => { + refsResult = refsResult + `${ ref }
`; + }); + } else { + refsResult = refsResult + `${ refs }
` + } + + return refsResult; + } + } + + function renderSearches(asSearches) { + clearSearchView(); + let i = 0; + let converter = new showdown.Converter(); + asSearches.forEach(search => { + i++; + let epoch = (new Date).getTime(); + let searchID = `#search${ i }`; + let resultID = `#result${ i }`; + let searchSelector = `search${ i }`; + let controlID = `as_search${ i }` + let resultsControlID = `as_results_search${ i }`; + let btnID = `btn_es_${i}`; + + let searchPanel = ` +

${ search['action.escu.full_search_name'] }

+
+
+ +
+
+ Description +
+
+ ${ converter.makeHtml(search['description']) } +
+
+
+
+
+
+ Search +
+
+
+
+
+
+
+
+ How to Implement +
+
+ ${ converter.makeHtml(search['action.escu.how_to_implement']) } +
+
+
+
+ Known False Positives +
+
+ ${ converter.makeHtml(search['action.escu.known_false_positives']) } +
+
+
+
+
+
+ Data Models +
+
+ ${ getValueLabels(search['dm'], 'data_model_tag') } +
+
+
+
`; + + if (search['action.escu.search_type'] === "support") { + //Process Support Search Accordion + + let mappings = JSON.parse(search['action.escu.mappings']); + $('#search_support').append(searchPanel); + + // Adding extra params to support search + let supportLeftAttr = `
+
+ Explain It Like I'm 5 +
+
+ ${ converter.makeHtml(search['action.escu.eli5']) } +
+
`; + + + $(`#${searchSelector}-eli5`).append(supportLeftAttr); + + } else if (search['action.escu.search_type'] === "detection") { + let mappings = JSON.parse(search['action.escu.mappings']); + $('#search_detection').append(searchPanel); + // Adding extra params to detection search + let detectionAttrTop = ` +
+
+ ATT&CK +
+
+ ${ getValueLabels(mappings.mitre_attack, 'attack_tag') } +
+
+
+
+ Kill Chain Phases +
+
+ ${ getValueLabels(mappings.kill_chain_phases, 'kill_chain_tag') } +
+
+
+
+ CIS Controls +
+
+ ${ getValueLabels(mappings.cis20) } +
+
+ `; + + let detectionAttrBottom = ` +
+
+ Asset at Risk +
+
+ ${ search['action.escu.asset_at_risk'] } +
+
+
+
+ Confidence +
+
+ ${ search['action.escu.confidence'] } +
+
+
+
+ Creation Date +
+
+ ${ search['action.escu.creation_date'] } +
+
+
+
+ Modification Date +
+
+ ${ search['action.escu.modification_date'] } +
+
`; + + let detectionLeftAttr = `
+
+ Explain It Like I'm 5 +
+
+ ${ converter.makeHtml(search['action.escu.eli5']) } +
+
`; + $(detectionAttrTop).insertBefore($(`#${searchSelector}-content`).find('.data_model_srch_attr')); + $(`#${searchSelector}-content`).find('.search_right_panel').append(detectionAttrBottom); + $(`#${searchSelector}-eli5`).append(detectionLeftAttr); + } else if (search['action.escu.search_type'] === "contextual") { + //Process contextual Search Accordion + + let mappings = JSON.parse(search['action.escu.mappings']); + $('#search_contextual').append(searchPanel); + + + // Adding extra params to contextual search + let contextualLeftAttr = `
+
+ Explain It Like I'm 5 +
+
+ ${ converter.makeHtml(search['action.escu.eli5']) } +
+
`; + $(`#${searchSelector}-eli5`).append(contextualLeftAttr); + + } else if (search['action.escu.search_type'] === "investigative") { + //Process Investigative Search Accordion + let mappings = JSON.parse(search['action.escu.mappings']); + $('#search_investigative').append(searchPanel); + + // Adding extra params to investigative search + let investigativeLeftAttr = `
+
+ Explain It Like I'm 5 +
+
+ ${ converter.makeHtml(search['action.escu.eli5']) } +
+
`; + + + $(`#${searchSelector}-eli5`).append(investigativeLeftAttr); + } + + /* + let updatedAttr = ` +
+
+ Last Updated +
+
+ ${ search['updated'] } +
+
+ `; + $(`#${searchSelector}-content`).find('.search_right_panel').append(updatedAttr); + */ + + $(`#${ btnID }`).on('click', (evt) => { + console.log($(evt.target).data("searchType")); + if ($(evt.target).data("searchType") === "detection") { + splunkUtil.redirect_to('app/SplunkEnterpriseSecuritySuite/correlation_search_edit', { + search: `${$(evt.target).data("searchName")}` + }, window.open(), true); + } else { + splunkUtil.redirect_to(`manager/DA-ESS-ContentUpdate/saved/searches`, { + search: `${$(evt.target).data("searchName")}` + }, window.open(), true); + } + }) + + let searchManagerID = search['action.escu.full_search_name'].split(' ').join(''); + + let searchManager = new SearchManager({ + id: searchManagerID, + earliest_time: "-24h@h", + latest_time: "now", + status_buckets: 300, + required_field_list: "*", + preview: true, + cache: true, + autostart: false, // Prevent the search from running automatically + search: search['search'], + }); + + let searchBar = new SearchBarView({ + id: searchID, + managerId: searchManagerID, + timerange: true, + el: $('.' + controlID), + value: search['search'], + timerange_preset: "Last 24 hours" + }).render(); + + let tableviewer = new TableView({ + id: resultsControlID, + managerid: searchManagerID, + pageSize: 5, + el: $("." + resultsControlID) + }).render(); + + searchBar.on("change", function() { + searchManager.settings.unset("search"); + + // Update the search query + searchManager.settings.set("search", searchBar.val()); + + // Run the search (because autostart=false) + searchManager.startSearch(); + }); + + searchBar.timerange.on("change", function() { + // Update the time range of the search + searchManager.search.set(searchBar.timerange.val()); + + // Run the search (because autostart=false) + searchManager.startSearch(); + }) + + + renderedComponents.push(searchID, searchManagerID, resultsControlID); + + }); + + $('#accordion').accordion({ + heightStyle: "content" + }); + $('#search_support').accordion({ + heightStyle: "content" + }); + $('#search_detection').accordion({ + heightStyle: "content" + }); + $('#search_contextual').accordion({ + heightStyle: "content" + }); + $('#search_investigative').accordion({ + heightStyle: "content" + }); + } + + function clearSearchView() { + if ($('#accordion').hasClass('ui-accordion')) { + $('#accordion').accordion('destroy'); + } + + if ($('#search_support').hasClass('ui-accordion')) { + $('#search_support').accordion('destroy'); + $('#search_support').empty(); + } + + if ($('#search_detection').hasClass('ui-accordion')) { + $('#search_detection').accordion('destroy'); + $('#search_detection').empty(); + } + + if ($('#search_contextual').hasClass('ui-accordion')) { + $('#search_contextual').accordion('destroy'); + $('#search_contextual').empty(); + } + + if ($('#search_investigative').hasClass('ui-accordion')) { + $('#search_investigative').accordion('destroy'); + $('#search_investigative').empty(); + } + + $('.configure_in_es').unbind("click"); + + let len = renderedComponents.length; + while (len--) { + let id = renderedComponents.pop(); + mvc.Components.getInstance(id).dispose(); + } + } + + function getValueLabels(values, className) { + let cls = ""; + if (className !== undefined || className) { + cls = className; + } + let valueArray = []; + if (values) { + if (typeof values === "string") { + valueArray.push(values) + } else { + valueArray = values; + } + } + let htmlTmpl = ""; + valueArray.forEach(val => { + htmlTmpl += `
${ val }
 ` + }); + + return htmlTmpl; + } +}); diff --git a/package/appserver/static/escu_summary.css b/package/appserver/static/escu_summary.css new file mode 100644 index 0000000000..48fe5b72c3 --- /dev/null +++ b/package/appserver/static/escu_summary.css @@ -0,0 +1,66 @@ +.btn-pill { + display: inline; +} + +.killchain-phases { + width: 100%; + margin-left: 6%; +} + +.killchain_card { + width: 14%; + float:left; +} + +.killchain { + height: 55px; + line-height: 55px; + -webkit-clip-path: polygon(75% 0%, 100% 50%, 75% 100%, 0% 100%, 25% 50%, 0% 0%); + clip-path: polygon(75% 0%, 100% 50%, 75% 100%, 0% 100%, 25% 50%, 0% 0%); +} + +.killchain-text { + font-size: 300%; + font-weight: 600; + color: #fff; + text-align: center; + white-space: wrap; +} + + +.killchain-label { + margin-top: 7px; + text-align: center; + color: #666; + font-size: 14px; + font-weight: 700; + margin-left: 10%; + width: 60%; +} + +.killchain-text-one-line { + font-size: 16px; + color: #fff; + font-family: system-ui; + white-space: wrap; + width: 100%; + padding-top: 7%; + padding-left: 26%; +} + +.killchain-text-second { + font-size: 16px; + color: #fff; + font-family: system-ui; + margin-top: -10px; + padding-left: 26%; +} + +.killchain-phases { + display: inline-block; + width: 100%; +} + +.notfirst { + margin-left: -2%; +} diff --git a/package/appserver/static/escu_summary.js b/package/appserver/static/escu_summary.js new file mode 100644 index 0000000000..572eef9abb --- /dev/null +++ b/package/appserver/static/escu_summary.js @@ -0,0 +1,76 @@ +require([ + 'underscore', + 'jquery', + 'splunkjs/mvc', + 'splunkjs/mvc/searchmanager', + '../app/DA-ESS-ContentUpdate/js/lib/tabs', + 'css!../app/DA-ESS-ContentUpdate/js/lib/tabs.css', + 'css!../app/DA-ESS-ContentUpdate/escu_summary.css', + 'splunkjs/mvc/simplexml/ready!' + ], function(_, $, mvc, SearchManager) { + $('.es-soc-analytic-story-stats').html(_.template('<%- _("Analytic Story Summary").t() %>')); + $('.es-soc-search-stats').html(_.template('<%- _("Search Summary").t() %>')); + + const tokenModel = mvc.Components.get('default'); + const submittedTokens = mvc.Components.get('submitted'); + + $.ajax({ + url: Splunk.util.make_url('/splunkd/__raw/servicesNS/nobody/DA-ESS-ContentUpdate/apps/local'), + type: 'GET', + async: true, + data: { + output_mode: 'json', + count: -1, + }, + }).done(result => { + if (result.entry) { + const foundEss = result.entry.find(app => app.name === 'SplunkEnterpriseSecuritySuite'); + if (foundEss.content.version === "5.2.0") { + submittedTokens.set('explore-use-case-es-show', 'true'); + const use_case_library_link = Splunk.util.make_url('app/SplunkEnterpriseSecuritySuite/ess_use_case_library'); + const template = `
+ ${ _('Εxplore ESCU content updates directly from the Use Case Library within ES. To explore it, click').t() } + ${ _('here').t() }. +
`; + $('#explore-use-case-es-info').html(_.template(template, { use_case_library_link: use_case_library_link })); + } + } + }).fail(err => { + }); + + + + // searchQuery - + let kcpSearch = new SearchManager({ + id: "kcpSearch", + preview: true, + cache: true, + status_buckets: 300, + earliest_time: '-24h@h', + latest_time: 'now', + search: '| rest /services/configs/conf-analytic_stories splunk_server=local count=0 | spath input=mappings path=kill_chain_phases{} output=kcp | stats count by kcp', + }); + + let results = kcpSearch.data("preview"); + + results.on("data", function() { + results.data().rows.forEach(row => { + let killchainID = '#' + row[0].toLowerCase().replace(/ /g,''); + $(killchainID).html(row[1]); + }); + }); + + $('#analytic_filter_clear').on('click', function() { + tokenModel.set('form.as_cis', '*'); + tokenModel.set('form.as_category', '*'); + tokenModel.set('form.as_kill_chain_phase', '*'); + tokenModel.set('form.as_data_models', '*'); + }); + + $('#search_filter_clear').on('click', function() { + tokenModel.set('form.cis', '*'); + tokenModel.set('form.searchtype', '*'); + tokenModel.set('form.kill_chain_phase', '*'); + tokenModel.set('form.data_models', '*'); + }); + }); diff --git a/package/appserver/static/feedback.js b/package/appserver/static/feedback.js new file mode 100644 index 0000000000..48c3f4cb74 --- /dev/null +++ b/package/appserver/static/feedback.js @@ -0,0 +1,19 @@ + + require([ + 'underscore', + 'jquery', + 'splunkjs/mvc', + 'splunkjs/mvc/simplexml/ready!' + ], function(_, $, mvc, TableView) { + + var defaultTokenSpace = mvc.Components.getInstance('default'); + + // This will take every textarea that has a data-token attribute and will make the given token with the value of the textarea + $('textarea[data-token]').each(function (textarea) { + $(this).on('input', function(input) { + var token_to_set = $(this).data('token'); + defaultTokenSpace.set(token_to_set, $(this).val()); + }) + }) + }); + diff --git a/package/appserver/static/img/escu/Slide1.PNG b/package/appserver/static/img/escu/Slide1.PNG new file mode 100644 index 0000000000000000000000000000000000000000..4e5f7311ac42f1ba7224163d974d69aa271eb2df GIT binary patch literal 127927 zcmb5VWl&sE*EQHUX*|%-XrL2#|Z)7w`A&JiN>X>n)Ugza^yat8dA8p?f zc55XeF)0!$q>^OC^|J^HkrfGgSh@04)>ihCnE-yS5AVH~&G=NOr#~*~KHmLR)zw|f zQD@!w6!rX(xXJ%FNyRE#2p#9x8d%Qh|MQxrj>La8Ypl?Ee|41GE)OGiEq_>^A4gEH z8z~=et6#61I%u`!x&bptzZ)y{mzI{!_UFGpWSzecR8-fWVM>{+q$esJy}9<`&%4ab z{i1r>;&PDX-}!JZJ?~jaSaYsZKW|i%Z}*TS6`8)R+MUjB;}3qiJE*ic$rLW8Fe_V> z&mVwOw{I(|{|3tS34hfgG7znV!CwB?h(F~Ubjq>B_`HKaFOj)6kiM5G@r6G-~>DQTZ)rl-4^6!i6D z{Dea=qlh^$;fdL;eOG`d%b{0P-@$6pHKYMV<@7C^?f#5CS(a}~G?9X*Bg00_bn?oe zQ|9R~!%}}1I>aosDn4eD*($@73UVrZ2&B6*DYMJDNzMp_vlsS$8)(N)Iw`l(G zds^t>6v1}_m&mK155E%}=_4CPzwNR?)tJ#!MB$n${q$uBKYR{Nnh9+ZG0w`#fzJ(l z-vBgFR`16%?9$M(`{C5MTBX9E3it6z;LG;JPEaO>{MaYu%|`ZlKBx8ep>q-zl`2OW zhBCKFCRz(O?}i#Y*1_KK#7e+a~|=o26**mU-ITcRy=Qt!h- z&ZpZsb~-3VM9_JnbNdwjL6vql%r~^k5R|40Eh;Yd1F0a3vC!`zu8xx+_)5HCGsi~W z)Nk^$(;+cBoUJ~kOPc@bjdV@dIGugty^Jwa-^vkF(P%D(#NXyRRzzm@u#!-kSRc5i z<@xXJ&6(ZviQfFNeNL%Cvzw5`PADzTpdxzA8-BgOtsG|2aje7;xJMZJ#-*@a<4|d3 z2N?2jyYr*BWrkXOa*|Br>uWXNZ_)2pSp3@gnvJis)gv2t zGG^)AN0J!uz!WtUjw*o^d`RAq+HRT4S8N1Z_y+00?w~?u#PJ<189=E16T){8yA?Jou6j{7l=W~+1SuqfJeyQ^`k{S$Ld z%{4H%MxuUarzJWY&Hx5dI~o#n5#}t*UX``~)0GZd(PAH!FG14P4h>QY34mCq6m^>C z9*rD;rK|l}sOr8a@|yFb>24-E^N8JJ!&=hmSp)BgUOQZF8Y>R)d(dQ&d}wdyyrkv4 ztAw~F;GSq&dWbJ!@2A4Y(?Q3oUa8o149=T#2>o;qTW)g5eQ+1B_yDKC_OL$29DEsS z7V668wZl6BMDBRj~ zZ^l)AtgnuWsDV~PC*w?$0%T>Bi_cPOaAA%9_T1~H%CMI?YthA6qr#i8`6Gn&Or3cq z9yHG$eCZdK;w`tbLDML9EET|8(_XCFIcKuiV=m7Id{0i?&wbizsDJ+a5fJ#&6~aKM zL91SJ%6mKNyN$sZ1jaW6eK3Z4XS4BIY~tM@W%<41ca4m4r)~PjG(8SxmMDgL-EI#V z5*#g?$hysIWfJ*vu`K8&YF;uHE{|Qm5tO=VJ>fN8BoeF=Nx2SeF zuaEs=cT<}?=QJMjGqrXi9``NLQCRR2I0^Fiy^vAd?89_iLn;M}ihUNZaU0SD;BDW&f$0*>4A2GOBq@H}i2lst5y+#16Q$XjK6;D12UmTmo$3d9c)CC7 z4IZLKL1QTV@Q<@;vZ2mVze;hUtboXg=*CSLO{F9q{4%*dN+L()!6GF%ube}lSZdqi zRRV26=to{if<9s;7>X}_d40;>&E5YCakyJ(r1(R-v=sJmaW2OwGI4=5E%Yc%EE0kq z%JVrA9#)10GBxaC4(~i~ubUIq(_G@aqSI(ts9WAHM>1Seb*DHYU2YBy)4-iE@c!xn zm%MdY=oQm(nxT|i^Xcxv3BR|*LY~d2(f~xvpJPEswiJQ)MTY^|K29m&S6yPV5!B~0 zm-B*3Q^f#@?j(Q?McQt5Q}z2&$EQ6HiLVaxs*dZvztmi5Z%V{JF!O&#?q$xSOQa>H z@3RhmnP(8PIGUcjv4%R?Mx1$7biJ@3HOk23W|{zNE3rQwC#24UO>~@I3gkt~?$e=E zX)bJvm&v+{Se>*C*w~>*)mL?s_>2q^u;?r6q#Ic_In^qO!(vZF#4tPALz%>4;m-#+ zc_9)oq@?c)&9zFcW^QfAfof{Uo+tYwKm$2VB88MU+-W)k{EthZt=K(`g)$~tj8^hz z<_l_dIgx{67YoCv;lVHVONBe%8K`XUZe0>SA}&sh5MGG2;`CI5gKMbqJ~h$cy)slZ z7;PL2riP$Xhm205AH2qW#^VzcXDOqiJnNstenYv$JT-6rMo6T>z>65UvK`x3e@ZSW zAeu(%NeKhp7#TgZ>LC#Nn?D1}={6{?C?z6k&whF;&d@T<@_~LiA*Qxl*|58?YKIMejwoe1zT39bgDsiAAO8$ zwN*9Io(diA%ihBr0d;A>8jNykzN4`L7jW;oSOu}4a>kfKzx3TG(n1w5e`J5s`8A&N z-n;2kMF;$m+jJJWN(cl~z#<*l$^Jmn&wKr@$;5Tu8v`t3~jIma#rRsp{rlNTZ zU$IrAnUQtl;z|G`Cj^+AW@Twm-dTNwsubz~rKQLW zFWHxkS=r`|NQ=)5Zj8ar==st5OSNiT(WdVgE57zq4#UzR^kObt8m$7rDquh(!$tDj z5qEpnO+E;Vc%z3FU1p7n_(C4WI99rTz=pHys#ZonN&ks$f=BUBwUOgtFhYvp=;#he z6va8}Fk>vV`3M7JRTLHZLM|o_H>o^AN&49n;jgSmMAvA~>q+I_TjQ;rN;QuL`UBsd zN&&N|-f-d7Q6kM>f$$)d6(UQv+)q`rb)G+a%;{u9bNsVi5JSyws%l8E6$K>Y2q^AU zv1JI^%wreXUe}ZTlU`BugP?bHq9qtx+MLUf8U#b=%|H=`M3ig*BvZ=mW)#=&_I3Px zG&{c+RqMKm#r3=`{)VN@py>l$W~L&cO)BN9N`ri>dEBSXpB?`=g$$1pMeJ4iuPQS!`lk1HNaF+yKHd8ej}F|2rNu7TdwF9 zk+|IhkoxzExUe%MGR6Uf+Iz%?jBWjEkj4U}b}IhHEAOZ--0{Lj%Nml=`hf=5zZdK% zAmUe7W&k>XUX7sVzlUj|Lu8)ua1~cR54Gct!DYA(wM4_^OJ!6;9u%YVd?DzQEUY`g z=TWDld0#rmo-P$hTw$PXfaG)9jp95DJ1cBI$my7?7`~bK8>I}-jiz3u3rwa;bYlCF z>G3p(FMw`huy~N9<^17CTY~oUPW8$`;>1U!+d^ez`0 zSF9Fg6J1G=Iw1|fPgfD_r_gbV6$R_+59oAP3x7O3=H3QJqm>vE{AB@%i2_DzeRQ)w zsjua1qRS}c5M8DBxYW49U?7XgRTF4}=hgJ7=ZVcqM<%9y$r{)d$`ZpMFu<8_k3@wC zwDAXMBPWY!CMzHl+~kitSf*K96s)WcboDC4l2g=8Pp5mx*HR+@^J~p2SdL7km&o}B z7fan7TF1)&ZS}!DHo2?RDQCb=>|9DtCVSbVh2hg(g^m}-n zZVSx+DPfOP$OSZO@N9P3xoAJ2OUE==Zn@N1bM#nRsd0KY(fM%aq?I8745!DpWKiEr z;cz)k+QLK}82z`Vf=RGuR*!fe7o2((0=lM4w31}>Z0!kS7Jn#0#cI=FdH8xdNA+A! z=VQhb{re_=<4vqqtAw;FlkQQy2pcc35X;@)-8FDD($?-m<5MXSm5}o5BQ2TvQDF54 zqDhrwJlXKok*vfP4ATc8=&7p&onr5E&T7B>GX+z|anju!r=cbGl9q2-LeO>Y-`-I> zqhGDqb>v~x2yTKIX=(lSZ+lIl*oqI>X&`bGGX$)S{wO*|#$ZVN!yEvMI29n$ zi5Cq2BCu+FkJ2(O2k%_4rpr7wn=ci{P{N4_j>adB^Y8bo>Jx2KCDI{b)QnRKP8!K| zmPKk8e)IEM=o>ruVv$g|&L}!_wr$k0FElwr6x(3rM`g_F`b*3^w?MvvcMHb~ND;*= zjq;XSEp+^)F%{IT>6d>8EH>z?Rl8&5F+-{S-%NrwD+5Qkwqi8Fo9M$iKXJ5?c2vaI z^oG^Zvd3GH(slS1;%ESb=rEDx<3r}fhatP!*l;Htw==wvUWTgD{z;ds4F5f!AF}Jt zuZCeI=3cO^7HuYp57XhhUks5AzcRKpy3gGzVL2oUXt*w{riv&gam-#wG2X5=a;h5N z1@p^A6dhYqr-IWa+i2ZayZkf;>aODyF!NKxVtB>NUV9<&-}U?p{;{=!a~Dc6*jyuF zSJx~CoV!iLJ!N=UhR>|3!!`~6hHEoFS!tRd!Q;BcWa7fLnyrr?J5_9Jx)>kEG2r6G z@tn*uWBRTbBNPVScs2iE*AjOoi)RYR z=(M6GwyDExh0r%zo~r-wpM8Y@)6&o=`W&AN&!zZv`3-+zsA2kSnZed+Dj}H{GbJf~ zRhy(#_tmx;f6Z>f_e8#C|B0saaKc{3*I&@Jdt>OWW26(E`;N6-;A}iNiPoaxYOXZH`m_gC7Na$HS z_$b~Y*k#+%PGF~Yic!?C)1$KOk-9fa1s)TxpwD!Uva#a@tGt0>Vo6->WhZso0ld zl4j}ob%j@nej52|B+9kak=ULp&qI!riM#*@&R19uTkF*GzBMUY1#}CGR=Y^YRdft1 zqdz%U!F#5Oh>*qI`fUXMGW8hqI)vBb>Q(pEuIoo34bSFo_6BqmDwH}b`ddJi~wr`0EI1MT|*&fYHJ_&qDbgQZ$D8#u!{{j1^8 zaXt5s1MM(Xc~f+{doGkPf+G?{cmTi%b3_t;4-V?N)31FWzkY3mgS=_iyYZMj=!;<$ zx&BWIC9Kx}3}Iz>;3``Wqx5s+AI#viB&I3HKK0Qi6+JX`+jI&qK;-yFHub{)l)7g> zbTdBLE3+oHK(uBLpjC)I= zs86UN>|~~&rCJ0xOFTa&(spfebXd5ZS)8X$d?bl##>UCMdP0-nJWAW7|0NI{tQA+P z#;);h=McwnCDN6lex40kyZ0u;!SlxCO+83PF4EkI<2le(>}?_>Lr8{B!>#RetIq2}G(grA#|qdiQR^$_=>m``}<1DE8B5 z#o`Y}qKG;6_fZol#Lu@r&%IYzhzTn=Z^c$&MJi|LINmJ2*B;P*XLJ#16^M*DcNleH zv{3?$&gE22hlucdbZP>bI9o9X2bQ3BoAnol`7(1>Tj@@{qf@U@5ieXw&fcTR_{^~# zHvcpeQNc)dbnv@JbOC&~1OH2Lv8yE5g#JVswuTnbVXJ$~8uKJ9DsWqE10o%K1E!|v|k}5^3 z?-ovH4oxrg>xIe)i`O9}V0O-IxX^b^%+xn@)O>&lQ8Nkm;AsEpE z#|&knthTf{$|de{8z9oNMFM=9OImb%Lo(sqPp=FQ-lLr>4zjb9!6bIaYW+K+6F2f3 zziV~=j6P*Q@clKTG2jT(aAT-dOGF-YlWgMFnPo}Kb+M#XMMDlVf(Yj>p#r@7cM6mi zI$Fh89Gqu(+;g>Qwv_2rqE;w-QE4%3!2Z>@2COAkq{}=Xg*~oP)z>THEPg{3x!;}b zVc#g@fDr+onBm|LK{prA#o2NvoR=$)^0d0??SRWZ8+FVvGMxx;=u;I<9tuN{BL027 z?UsmJZga!>7w`gAp7E64EaZCXf~!wx$5kR^XFTSU6%nI(D3{`G}bbM+G^dD*|*R>E5$mj*MR4KgDh|v zxXxUR~XD-mvzYyk^eT$RiI~vlE{pT%Mc zmwI?|ANc~BTJTpGd59=60aN)o3>|cNd3g>Kkz+wOZVXnU2kp5B*x9%GBeSct!$7~OFv|B97os{eq>s;>*s20s2%H|>kF&@-3vgKF}Rn$P}2z2 z`tK~%0sp@_-v{<~^qXe=N`KlKA*c4MJc?Z_BtH5ETa>ggkGIIdrJ_Pzx|I77Y$g`N(n{SH+tW2R2`rMFdmXI z8D49UGCs|*m16g0_UruuqRs(R!x!k`79Yg%OH@=e=irUq7wk9;K#ZxD81Q}ii*9~y zqzq-I|LI^%5zLx?0O$ede7%^+Y!!hg?$;!^|&S{Q>D{{Q` z`p89|6CL1!zJ-=RgAbc8jjzO+zWS^0+U7JPlkcDCcVbUF`z1=>&XXTwK~DI!cRbRw zAVmy7eOBRw;1d-u2y&K4E{=YA6ys4P(QyVRD+e;%EieIKQqmpC6UPe(S6BuNh&0F$ zpEIggrBQfjH@hI)sJ(0Q$6!t`HMvPEO+c_&$+b>ZpwOX%SwTlsBkyZepM>^>s zm8}m9K9y$Eq{<)eh&m{n#P%MadZO+4l}9PRX>L?i6a!Z9SE%p3A-dH8I}&2buaxQg z6jeZ`aK7LEwHHY7<_VS(8ucb}{jD~M8dYQDr?J7fw+#C?m)Aa(YQ7i|&Hj7(xm4j` z_KXHpg0+*MVYqARyg%d-s{H->g-t|kMe$<(br}_{LhNJ<_#?uK>}u?7%eE2Jm@&m! zHl98v)77ts+RUoT`e36ds@t<79;9HVP@2l)E4v={? zpp_p|>vT7CfsuEsM2E7UN$3}ECIhT0kj9QXbB=ahI1-+7Pt$YNlD!I7!3}8B_GK;^ zv`zlGAUgMz4ln1^Hjui#vjORwPaX-;KMnw@g4vraw}h^4|0f|S$)gA$d&Y)9H9AFXB#NdLoC6_yYI&J;Q)3&&ki z;YT;i0+32Ifa%EzeLO4xNTn;Z#PF}PnIjSp)^rsz>Gq#)NCq{)26bQ9V4&qq`?c%w zqT~S29>5)w%C#GnC<_M@oBiYAUP|A521>uv^E~=kvbMQw;Dkg4DKW$-@k4y!gp+f5 zf-d8EIEP&pn70+k(_HalRS1QwF`urWx3*HPS}8xfF*C+vPb?LJSoe^4?74+IN(CX~ zc?5@Dd+0y~RnB<5mkOJ$L@H}C9{=yc^Bz!eLr_rAW{0iU8VecU zgV9PLhVY$wBW79X)>~9VwL}Nc>C}T|Z4psVugp&+iXy$-w8quc4ud~xz7nlNzmc@$+UX8J3HlpWiu@2w^bw2;m;YHq z^r^1CMkUOH^jsHXwtjQ65=K+Lxb=jgT(PVei==01xZ4#|rccFJ6yy3_lfOH3Lg1pR z=J(;*Zg~2Wf7pCPu@9NB`0y(dr&R#L`7#NH;r-1J3{#R2dbgh}6#lgmP4SNn7Zqo- zy}`pVFXC!rRTVbw<)6QQN2IrYfhhM~2Hidy{CzE(MeA3wz_W`r-sJAtR7>MZUU@*L zTzPxEe#MbwCg43eEg-tVP`B(iMW&;ODJ_5gM!%9y3i_~dPDpU+dUw^jf3)ZPXT5hw zj-EPNh{$*#T9xm}dv}uJK^>$l0-|PQ>=y+U{F#|i(ituY3_`G5Y*M5j9vZUHp+bBQ zX2t<0=L(35A{FFe0DGe@K5VTb4J`rp4-Ik0&1d04q-1Sv=Udq=oV)%qQmFOlolET6 z`n?=pX_wax(@ti!bSr{7y6p%`Lc?pW4G!+F4y$9>uB&5&zGr}4bnEm?o-%LuqddF>)t;3;npxwAo-7;#yLJ>1 zk_NqS|M3YQOI7dugqH$6oE~JgRWs}tK$&Z_6*XaEVi8cd%A<2nC z-xpQ)TTExDcAt0h4z^^M6k{PiZ<~Eot+;EZRwEIxh}i*cL*g9}WlwBy0CTyYlC!1I zd^1q0*#K5dW9#f+_u8l7A%YmcmSgl2nWv2es{~%0qisih`~E)9e}5QFYW2+L$Pp&R z)lEe_tqoCbJG-K?AImnw#{CufSzKlOvdfe(C^%n2@FM64FzYjN@jwb@!yZI*1gY-; z(G6op#*P$PTerZ6zwN`N8O%lB^u-f+;yFYBA}A46sHmHGTctZ_dI2$pN_XnTn^?z&K5KF{$LkM^%yfjKhfDrd z3+jfe?lJWHS>{=N3>WnQD7n{9*4>2n&c85_)2}z%ST}#sTlXJ2^@TIZwkv58l~1iT z__1Q5?@%UC_7w4F^}}$m*C>RELOhJ2=H}+UMbPx1K|)Yyj}|NvPT&WIcTjvNv8T$P z^>rheR#{m|V8~J@jYmxdi~Rt=aMVE_I{45~S{}?U+4^taPyr)ZJu%vD zK9WxSM{i23`%5q5*Z?6(+?$=%xmd9CVg<}|)zD_8N^-MSZ&lIy$bPXf${MZwA;1Oe zE};`t%Cu`#`;p8iR~JfpA>p2ji^iTHwATk0N$} zr^un<)0zM8%?E>Yv`Xdk6hiK*)y>lAkz%!fDRT?)+;q>L1HWdZzW>zhT1K_BJ)M;n^Lpzde9p2^m*T-tUN3NAn|Op(#I#OZI@gI}&d=C0mBQ>x zK@Eo2FiE_oRcrk@8~5F|d#_(AC&kK3?chaAv*0&^@k&kI#}ZM?3_*tQH~(%6=?Kd( z0^8M7pOY!gV(%Nw&pZqVb_(@xcYBm!(JQ~Sv*<^o+#sK62w#8J_aQc9d^bP>P49Mb zal!UAWylvpSd=H@b&rK9!u!Zlyz%43S{kyz@CkR>a6uag&9Ip)QeFwY4Ho{8eR{%RS(spKy3lh!L1KNDHXn|< zQJ3LhKs|VBL5peEPsIXyFO=2ML8go?gSQ&tePf?rSBFRS`L`Oz2=Xp23zA}vuY{j3 zFSGV>S`Xe~0{o`PPZ$!Tz>OoUV3o1!u~R~lVzYy&>eH3OzV5>kl5B27xxCjGlJn?? z!DY{Z8g^KxHP63VS82?L!5n4$i5Ap^mBY2)!V&Xylm{3px_Xqa8h^JwJ+e;+;zV;X z2fdS$lG=1W6HwjrfEYe*P)hjeBeoO4H{pTa0GT4h!CTILe2RIyjc~06iK?5_*2FD2 z=CO2?t4eV1j5yp!8zJLD9i=$a^tHpcc=?zR;g8v9nMn*5IEh5uXgH#28W2bx!>zTYbD`_-Q)qYE2+f z)h>w@lh^VOHFX4xVsi}}6nG{Wor+)woR(jTgehKeRW~%uOeQ0qx4mo%;Ql+6V{x zZrzjs;+xH&q*EZQY|~+l=9P-fs;Xi+uw?nygThpOY@ZaOw@Qw!!=iQfmo4#jH%D0{ z)gXq6SC#(PLQ$V=OwC(8tM$6hW2=n%VeB2!SzH6$WZ2j%M|})lgfhkPyj^+;xqNpE z5l{CcA{|8r=Fj|EvlpM6sySMD#ZD--*dK8gRU*E1ceKuy_>>B^gd!$Uor>L6s1hi7 z?V1;0E?O5?RJ^~g=crNQiqEOiXjg|;RN$8qvN;FsTuO%+VhR#KYTEy2Jg!Ko(Hi4*-)H)pGwoeyQoi? z6VYAGyesAK-omsw5X?N&IF|ZtS_L>*B-sqkIGC2o3TB`PSTeN20?8}qn^68KQPoE{=y(tsU~-+4NUbzKbkS zA-|sX#i$bCiZ5d*lxj~Tt@YNey9%w^nNg~&Ick**ntq~L+$_oVZg@1d1& zIQ6rQSF+ia*5==ZB`3MG`>sB7`Dot4jhGMUMI7k3BLP<;+-r~pz3(pS8wqe9|g1xQV11uBz+fw^LHuo#xuLSMbf74 zQ_@>%H)(kj&qU2J2O5v;$CxqY{!N;xrJJRMA^UAXh}ZsJt0cD5(ScW7uh^k3f=Sk#W~N1RXHi zc)Ptm1hODx1;X7{v-^hmlJsG8CA<>`U^a2C*~5vgqFlkO4B2-F<>q3u<=VWxt((j^ zF^AAwjt(aW?J*Q%ahm2vwnfY2I>K2obEo;@aI^X9QCF(o7Or2tX7^%=hJnVJ8VX6- zhwtETn7~0HxFSGu(PFi-$lF&wX^1bx4cIudG{On-H0<%>Mvu8&CE61BYd#`rOG1&A z%lze~+hK|uRx3(0xYl-hzu6z0yDf&5bk3eABOnAHYwwfjgC7POKis_K!7q|~kSN;* z>3o-xmc|JA>Pc{}8#TfIoFNx(4?jH~8I;6h-I^Z3oWk3>L>xq#nD22wda)5Yi10ht ze#7bhM^-{W!)LYM^!x>GaM>ZByD+e#p}Fa28*!HhHOH+4tQk`yH!;>)y@e+Vvd}d~ zlzy8W37MbG9wJ5yJ+m`Xn81&+^BFnILCn22t`AziAdbahX-jVXQ zkK+>|E7kWCp8Dzq$?fwHxzYN=8!zwq#C4x;`uD`XqA6z27Zn_Oi&sBgWuKAOO5gCX z{Ee$jqS~=}R|pCVu*nIv*;F;sAg$`ex6al)X+)|@(o9Y#e%Ud?*@Zs!tgMPMnNHEC zQK9h$G(UL0z=p5=rVcwNu`rw8J}^*H1{m?2r#p_Pd3~?>Lvw#M%b|kuo^vIPvL`qU zK$5X5_(}gj_UW`r>~_o6x_Hch3aNwS4JYAOHJH^F5(+1P`8MhRN@*nEO(*Q_{H_w# zgB{Dd%4&8aiV}>+a+Kr=<#K%2T#0O*N4E7de6B%e|K0d~`z?+b(^6h~+(scX=dV-qHmYX7rZ@%wI&y~Qn>#E;sW$+}@cIM<595cIqpn1f z-r6(htMtz(`rJjWhxXaNn5U@u*Q#X^yfN-&n697%bU*9jVoBo;VeKa09nop!ygsb{0UItvOe_ z?0==9P&62EoN z|3u{2&B3amPJUE_GK!)g6F&dmw6bg1sWZ=782&5fNqP8h#o#}1AD(p&?$#ESTlpQ| z)4A7HM#O*z%Cz0vc6P4wTK&06en?>=2CK%k5HV3*NFtXT{`Q zEx3H{kVP!(&aXDwX<2_%V&{Eg;Lew@-9eB)@l1RO97!wZNG}+9XZwm%e*1AXos3OH)CiWPi>8x}V*Ih?0FR2r|eS zp;*BX1Ok;lg`HUF4HoD1;XA&@+HIB*b!@SnK;MUBIBRAdPHH2SrrASo z3>if7!pqjlyBwX7nR4wR040rJD2|JYmtifchpe>b0L+ul$t2r}maG)I&Ejlez7nnN zUIKeE$Kh|=3`Hu@xeD?=vt@Vyue}z4ea;FEe%M9DHsr!#mPR4(8|MkbryN{WQc;w_ z>4HeL6=S7Gd6(+=3Ru8}2gXL!Jh?Se$af=j^%Fa;u;LULMa_92J^ExgMy+f0G!Qs* zt#KZG)Ez12pY&@@zDG`O&{KB4_0AoT=t-JrLT%HUi$o+O?clWU_j5>q7m}p-Szi2r zN`M;G90Z%Kd?ffE@Sn=9N$JWj7YJUrYUn&jVs$U-l|Hm_((5uX086$YX-W~Uf; ze~#HQ*fzqjF~nV6Xo87tF(@_+KcbUzCjjT-^$0dL?iQlUi~!coScib3^r_*6e4m9$ zFM4oHT$jMKcygV5+V7llPdgUU`Wt&azxc3I;c(Vh0gLLw$4ryID?e1*(rf?7dQSSK zwk68OG|)Ryp{hfGk?fy)JUXGpcF@CT;@u>w9xjzO=5S=Q!2}>_OcY_3z)85dKViBKq@q4n~pnS^B%E2PHFEhKd0oxX8sfeM>d}a#%e8U}9@;Q<~VH_m*>a zmEZJCCmCexraKmHzElN%qecNzJHD-?#}iP%MD-92vzP1Z>vQZhJGtYv2EBv@kmlYg zWU9!^g(1k_ZCnGQoqP_71}0i~ePxu9#v2eO887Phm^FuAt=*AmfHlJ@8>C zsx^O+a4HJjqm3vnf`4Ne|y3KSp*R5!yN zZHC}Y6*ezOx2AL%0tzd^^P_ql7EO;NifJ0vW(URYXn5j&x#*)>UO~6@fMdyr&QC;! zY3ZMPFh@DNfDB+@z>~LIh*-Q%CY_L1Z+@AZbJ0CcJUB7hgwPqHn34p1<@i}`Jg`eI z4f^48DY@1k*Q{EO06DvLWoA`KWU;=ad~R&rdnCl_1{y?fwnOEfO8MCZJWmwJrUT1p zbi8N;13G&L20k0-2Gs`rVV8^%#WjZD4(SFq@Z6&)rVsCY#p2Kl6beh$_fB2pK+Ft~ zA*n)Ol?3Du|8bG`?`Qo|@dP^P1b5!zQUY~`$yXAyYQI%u@G!?4C4}^Msq1@*7E*Hx3-)sUpI2*c3uNb#`97CUIbsAtjObw8{j_c}!c*mpV=-tUhY4~5`w_4Bp zGjxsPSw1eG0R0{9CFIb6qItaxYr;_bN-v2&I?7;o52S5n$vObW^*;sN+<}_|8B(45 zip6zm1JTV6Y{Y={4lIaZ{Sgv8q~d(Rp6*)y>z4Ptf?F46M#D?E!lpIl?~2ddbOo_3 z*H*bjt1`xat4OKYrDK%K_6fHcsuI>=75{e)T?v_Hl0BzgDA82z&3%;M{#%2H?{R;_ zo9=5kmHWJ-dR@MkG~<5<$0M7a-{&OR99I%Jt4yEoVAcQpxL3Or zz(H)}Ee;!E;TQWK0eylpzyPp#(}>ptO%5B>3CF-9bvekrdZbm}VDB09(ynV-YouBD z_KNs8uQv{q;jkJW4i4XShV%dd8@yMAb#)i3-2r%#_~#Az9KhJLGT#wz@yc~vCXzt8 zI#frxz#p|=(<`hM2CTD;}2!m;1=KC4c2q#*{VPk;;tC?(c9VBz)tUq2k9?U#+UB$ z5v|^EDaEiV0TUsQLQ+=)bP{f7iK2=c)S}8t@y;OL9zR1GPO9Lzx8l*h(#FuFbsH`n za`KG$c!V{;+X^-1|Mq5Z6JobUy5p2zV#}6M7Xj}*ftbUc% z(At)+>b_<=2%(dd|M^1qcCH6uOy;D^Aosgw6yI0ddvr?v+2e=9AM~8%^8UQdi))@1 zW+YJGnpO211hF#$1aK_sb@gsnRs|q;{Qki1_XY7keNm7HsAI$BDNysG3#c@sow5PF zMWMjX9vrTTF2B0W-zD6xVQM;Xp|Ls})J3Y58|*0uOem}2Tn#5!c_dMGMFq&+RmEeX zGspvWr>d?_#Su)AbutW(f{YQ^75EBQM9%LUj35ZEi@B_L0kvl>PuYVcaQMJ>-Otaxx%xocae6{WQr4tJ7p7&E6cpUTTRSc z`I?$Y7ggx2vNd^5b0^9}(2sb?{x+WJKlptAdgQ8mYmV~IcK2vkwqDsw3y>_y>6k(J z$`S~~E$|ZEwcup<6iigryryFoNYH3+2qvkej%>g;p-3o;klcW+4Wja|U?7kde{VS{ z_a1rc(0RDaY?=D7=;k$1(OKrmJnikJ=~0)#Q-ckKynsh(wOOj&@6CgRPGQgXDr39i zQ_itCGif<)<_-3jbD;+p#I~QH{2Ry9;7l_7IZN>O#kONBmN$(1G?$4N>x&1Yid(ik z^S{0I+KbEu@~PgW?|Gl2=e#eBd@+s6{u|Dfi&s8syS}0sK`dA1MLEnbRu}brLpPR0y)4k0 zqv45tocQqtX9EFEMRxlQe%TJSxjf+RUbW4)f1;}BCJy8pUk7u9 znN5WM4f)&N8j4wM^Ln={meXNfDAq>RP ze-34;Mum4|=ORUb@3kJ>9!sYXl}yNmp~E$i8A9V~qkikD1p3yTVPIewg%)LC&e@Z2 zk{9y4WHvk~K3q82e&r8M`QUtJy0E-ZzSzh!(-;@H)R?E}ZFe*)sAn=Xigwgmz1?fb zol&bZhMO4m^~!^L^2%PrZ|m=w2uwjy(N73*aL*CiMcveL>M9UQ48I11s0~2M*f>GH zZK!G-7e0hKqHQ>oJATaJ4H=<>G(CQaQOUVduV5uibArIGSdCf#eBK|Dh|5T}fP3u6 z-cIm!`y{CZO?D-RYX`Ybors>qUFN7ZYQ1!*(ufCK<6XC^vgI>YCO_HPnq?ure!^8~ zY!mZySx8yJ^GxD`d1wziSXtlI6ZBz(FYCuTg1%!cE*ux_0qp}*)RvCHaz=7=BZ_G_zPzyIZd!n!4x?9g$=?7VgB++-7Lgc7_Ukv$5}#hT@2K(e*Ar`M`5lZBX*OY(_`JJSW!g8sVz?>)4!RNfpOhgZVyoz zgShsTHq;3M+qt)hwodjpZ0E$RoEP7&MIun)X%hdA+&m-zwzAq@_39t=iAkLV(p=78 zHz@Y$OKWZoS+Ps7+csv$IqXdDB%CS^_&W8}d11`*#m{&4kJ%i1liKTWC~6+rzY&`L z`euHkqLm;4e5_XffWM-?7KRvL^4Q<8`aFGoS>E1`3v)%e zvJ_d@0KcSjPp3&Lvt>=}%XYd1`@c2uF97;RaeNMtg~osjbLfmVxV?u*!&N(rTh*O8 z)+>%Bu!yQ&OdV})w8qxq!}wyMW?51eBM}vj3VY`SD#_&_K*XV2=3{+6Z*ny1Gj)@& zTNAZ@q{WJAnfs22=E%o?B*jwZzt|`m@n$E3K?-3Z@khP&wy5Hlb4-gOMR z4bHAet{oa_lU5teS+vHO z982bILX=?t{%BI^I1N7`YCOuU(%@c-1o%W8U7YH1>#M@!KpijFoxnU-DoJDH}B zyo{~W@yJOD{l~hXT1LFmL9t`2<1X_V0zAV`4g27>|BI`$46CDQ!Zc2BcXtR7+}(l( z5AH#O6C}6=w_w3NxF)!}I|L`VI|SEl-fw^Gwg1k6IWs*yJ>At+cRi&s!os{%4~avk z#+AI53@`~|nN^TpmVSu--4Hrqk}e$kJMW`tj*Ln$rBN;f{P#EHLE;pW;Xhgt6kr_G z*72kRjdFhkbr|DgPj-m(LZ($wn)>AZa#4rGv)A0L`yDrAM zaU9^fR8$}V*9C>S%_d73lTM)Mb{;CD$ny5BszFbX;dYE9{v&Ze_uGLKj95yRI75hp z>8ny`N|igcZX6VO8HDZ-G`iOiUiIJ~5s}-_wuLtZLtCnS8I|99+I zWlSk`MfgE>&oDGDWr(o*8$>qrLTG4wsk>fm(ZRqZwAdmyBbiQQh#~giUiryl;4y&a z8A0VMO>dM>Fr3}Li>&N#8L{?Fb{s|HxMvzWGMxUChg3gHNu(ut_qXt2YsgzZ)m(qP z__NbmL~us3?%x{9#rZh3#F=_LQz;wFcD~~Hfp&p&O0Uc089f<}G` zhTTxW!;Za}cV3H&ivwAM$cz!JC3;~XD1MQKk6)#1M6fOYj^TCW@C>3prGJG&4u{{p z@64?@*2xfk{+ahw+rO=0_AYhiGMZu;pK+W1`mu&l%A6J5z#}QUWzhag&%<{f+E`1f z5jup(o-c5vDa6pMZ0X|>qR@#{XjVQR`mUmH7es&4OyRdp!$*Uetfyyv z1^JXCaQQ@D?&k3hNwwQiZ7vtN^h3}JVVQN1PyQJ2_MtHeWHkq^4v8b-Vv2n#&XzHK z;T}1x+vUN5y;c;%b1z;w$bSUb`&;>p+GiX(6*GJ=6+>$gf6d!-757E2wg|N-X~2fu zg=7F+67+@U9V9)vAH>h(T7Sq92A(v?BiG<#$l`B)>@4uE(w(ae+Yl4Z(v`SwT@#9Z zL^cp#pwMxB!(U)UxqnHc`$a^r_tM|>%pz+j7T`0XPe~Xq)qR?s2~TpuA=15pGKW5( z&nA>y!{RxHpi0|=W8pFG3VFLRp>+NCRi}UEK2~>4oes{`aNKdC$ zgZm~fMSPTlB&$_d`RXnRo^{2|7rZkHj-w!Pp=AYZG!!<1KP+2FAzq3G!~B z3jaE^&}$HsoaY5;+?=_nrRl73N!1xBMlTczM;gJ~y|?+>l(;;%Lf2mSa;LJb5I$7l z!2~V1wIW3m9`U{g$^H?wtcX+1EPhoLktyb{Cq^UDBg<5hzt|_Krj;gHH%M;jv>qFE zviF>7@OE{89GGA*8jCrA8cM+q3bM<@*{!i^sL&}e4_CZ4z^sIZ&OOUqXA#svKHejG zwtFug@?OmwzY}%21prOiY8~nD8@CWsTroUDr&Qx2gesQaZVm_hFVPXIM;P3*|f67M*Y`T2@^9=#Ty?`W)hCra`?H@i;*C8pH0m)m+cVx z%PXaevD+k7Xrww(;D4V<%T2tu5-0uREhk z+Z8r3(NAr5-?lYpv*N(_SFi67vYCnu(y($#LWLkFuAyeRZ zJ*Mj3Qi8jx`iLu8+R=Zf^9K4Pg-7Xpu;}P=m}OdUm}8*XemVi#(){&oI~~|l%DE5? zMS>Y6qFGoF@No3GkPBNOgG0%3uzE1!%))Zien{{?)u=h=%95#OQ{&<=m*KQvU!Z)~ zE5zPmbvVO%Q$|0r5=;D021BpRV&2`z#o5+~KUN~rKvTf{si_D##3Dyu$blRup^YAX zVgw8>hYtU%lb@0pGJmqlg84eh64*X||3H9Z(m)9np#+AJU#68b^Ur#UL`2LX7UjshXYGQ7hqHoZ$P0x_EEkg{Or}hqKH{QvFtUb) zL)Mhsl0xsx%~rU>g~(m2$DaI+aMO(q@fQ=yDK|$G`ht6SABsjLT73TOn%eQz&DEa9 z<~^;ot?;|ffacjC0@>!-J88sw&7|hA&&>HT_SdL)HiPcVY5m6^L)h|!G_L*jujAGaT7p523Rjih z^xJiN6hQ|a%9jHYqFlM8%JuNjmZF9R{5%{S9682RaYFRo)3*crV1K3LKZFlH1L zuPtz`+a^En<{pohr`aQ$m2bSwlJ4zK-_C#edot{pFe_51Wrv`b*>-WyVy^387sbZI zz-$gv2$#?Hty<;lGSx7yrCpf{`OjH6M8&YDI&xvZvjbm3 zxaC0o@_Yz&hvc~{X+Rj%kx+2QdUwc`d@a`-$0g*Ie0xpk@2Kq;m%oxx2i$IxDbd65 zA+jA*gzXYrusa@1V?$%w&R2WWsRzM|-)$lp;>6x-e#6Wsd)w_g4B2;Kfqr7>@f$p) zbB(8pLG4tuzA>}z8NStRSzGvb_8yh!|3og9`Fr`O7O8+k4rfX4k1Dp=YTUUnE4F0L zPx2Ri%x9fDq|imLi!Jj^uM64#VKn#U4r@}4CsTW7hXgru@`j2~Q6GQ2y%x88A8m*x zjHb`XonX?rl|<7dJAHpy8TN}N(t6>sBGqKLe(Qfr^JWhlwk&I|A)?G!*4r1T-zkp* zE0Vxb4f$XxGbU%T6A`=H^Lwvf)w~pPT$7!i7MnXU@#J>1@5EBn zQ3a{{al%eB{I^yAv&B`}3IRM^LUamDj`KWie{8f2NAKGx3nkzX`(-gsI?p1+@yZW) zg^zB9t&!Gyjca5Qe3~{bbwikV)^-pwe=ib-sH~pPStX)m_ZfmHI!M@lBCO#)FV3RLpZvk(}?V&PlsySP28_BRw z?iAop%Sdp^{Z{>J;Xj?c?)lC$q^BYIfWQy5v-{k`O8GUGYzF{{TMdZP(U*u=ALF}^ zE~S<4YMF?10}&}!B8_5T*QR(GBEFxNPStAtlUPf~A})`QLTo=-hO{2-_HsF(6wKl| zaVZ~k0Zq*cATpu1-gFk+qkk+0%vK|w;zKR#)$0nuPD39RnMg7xxnrD4nVPLf!zZ`? zt@&%Z^6T?d6jJmilFgLy?t0`%%>NywgH79Y!}9AOTBA(2@wAiXcu4Nu34akzqe`fT zMeR|mzLAu?AFF!xCQj`

l}4Ujj`OEP7I!_ z@EUD15G56+-#5DD{5+VgcWugjVm_mrC-kKYa0c98OKOD z-r@nlB^lIo#?dZFxcf>|Wt(`;o4?HnX?RUXqfjLfUx*!y+y$x9XL)aBedJHFF9X`% zK%mc}<@SZGu|pOJMQ2TBC;cq2k)cfMu!Z@caC0K4-%l$NJSG?z#;;OFih5<}8Ni~ectfD0B9{*DJDIz?E%#mSPrt$?0$23A8Y6X59^}L-dmYyyz73Y1 zVo7$B3S`o+dsd|}w1+L0`ByKrJ9a5UlY(imbvU5Kkkl5g8~!a`R+!(pZ_Z%1etes{Tq>dL!#s6h9t*83*4i$(bx z5*_#07$Wxq0NI2-?}^ckw~@?oMY)OXU?Ckn(KZ-(a->AR_1-KSxk*xzcR7iE`wIu$ z6n2H;B1D z@7dpUBPn0n;yNeb66=1fV#T4@RnIB5dpXDwUCiM!dk9|R`@~xTXD+&T*-OgM4SbN8 zz--eTB1(n8MZ0~Pb8B3u*sBM#pIGa1fi_e!sS+aOJ-x#}Ffl-nqrq+qM)a?I_o(i$ zab*d_Yvpd-A2$CTb>PU~bP~uov~4`N*C8^-r#l#hJLa|1K~r&TxAm(=R1!zva}p%XfRx(=t84? z#)PibcP9La{uBi(1i&dW3%h~n>zH_If`p?!XRrUO!(Yqkt)6hg6w?tMQfgZV#P#*h zF*!K+V}Kq^`PaQ>m??Pt#|2@9i5%+}rhhq~Cy`HUQ-^yUbk(*bxWOydw>o6_{AbY6 zN+eo~Lv34#p1hBv;Tf=Os0TGx&Iz^vSt$ZW>Vy@hV)j&uMVBRP@4;yKlc!acqKK`R zhV$+SLHH`71biKSn3=H>6R-XXYeO4##Xi!tsy82r$r4E5hzJkgGR9efie?WIgaXi> zpbB;Z2Z-eeN_)Tc99M150?9sx!w7aJu10LTKUgEsGJ5U(-sTTMoU7`y5GVW8nkbY1B(K0h;adAzX6AYDNG&pF@B& z(_^E|#fKn|+~i^X#im9N(SARedyW^|9lD^(CJvoV%?vH>$N)Q07|KIT5lPhw5gQOW zC(MNk$)_^B0SPuenEXr8HjVkll~*~h{^ReGG<1s}sfc!yh^kjU=bAsDF6S*53Le2) zd%?c#TqG(AXFX4ZRa_Bg#7Y1GrJq&lq4W!9>nJb@&WQV68&l+kRFwH`Z3f79ajS@! zp9HTCNkMSlheOtff&imbRFrfQMaAqyKn6o9Of2an1oVJSU1siwu@P+s-Bb4Vm52`W zF+Ri9C(lljs65(D%{5Z77qY0}&uwhQ@o^j&@1;3t(~o+(FemdwWv-~uf9Z!aK!JR2 z-Z7QIf~}nIoWo3(89rW=Oqj}XvV%o~$pHf@^LS>l9c8SuN1~DZE$A#!MCF6 z%Z1&yZQttb?r|=v`Wf5tDxp@1FI$C*t1noLfU6`@i?~-$k8PxOdBbk!bt5{#rziJr{_q7d>_5Bx1 zicsEkxQacFAkQ?yc!qp)o&x@E+f^VJy9frI22pZk%^W=P5%UqKgnv_F&2Hzi8v^DY zp1wmUYw1bX2gSVQHhUd-E1s0R$D2q>-qxxXclz|b*E=pB_IObipcqZu?S8IRK@YQ> ztdkjO*%gONPWA^12MQa4NLpAFpZI`^8Ai4eq-iY7RwFw(xgCu1Cn+KvFCwzQ_1gC> zMWN+-GM%MHb-q^uH&-BB#%EEx@;Sqq0rEeir^00goS1IZk z^6YZL)|YR&ffr2>$8_MZS9#NR1HT5>{Si8ENQmQ>qabe;3OzU&0_F@)`5Cr@8K$Rg zz@%dQ)M>y?Vy$A|>h@B9o7iRL$3s1C(eX^-DKFXMzvp~;>~Qo9- zkGO1wec<&)%J7Q2!)|g11QVom+87B*<>^bSM*(feJ`S4U6#pjk{(% z+F=VGGRbY>(->r-zP9teki4SYWf3xC_2aS+^4BH*?Lp_{Z{YI3Kt3VAcjVXIyt$cb z?(^%6{mWXmUeC@6|LQEcjA_I#Cu7>*QNiqtnapL43$XPJVOp=}8M=eUw6D#^C1~DS z?j>88@X;0xiLe0M(+B-AL0}r~1V`6Bw7*SlG!RKioU;uFKc+nyjv77<9z*{733fV} z>dFfbLNG5@+XoEua-}(|&z@UQ_p&oMugUrn%Z5-vf+N?AHvH*eAS}`fz@%#4{S#Lp zi|S*8b!|BT9ZCIi$;ctlWMOeGA--LGc?w09G;z4VB@EB|o+tWiOpYH54ba;))$~xO zUdaJ=%>Thr4vFRVc|EeZ#P}f}{WsS?NhsJncB9`;1>pZN4%L#6%rjbsxT^^6y_E|R zbwT9(zRa_aDtM<9#R5z1FUeP>twoMWRbke^A1}^r`x+d9#4(MZc}dSp-wWe*S~cZ& zkYfL)`CSwqcM~1*PC#NJyH_$Y9Kr}+v4>blA^rPluw|Lz(w0WOs?z;8f=2t_#0?k6 z#WnGRlmv)Oev*^EOHFx&4(7~RaHmCV_hfNI%qW+ z#I$mnu3I0>P41G?(n0WouH4qIDWM$R!+un9m<7qb`yB{`ImYpz(aG&4H8tujzDSd) zsi{DRdV?}H6tFkQkUsjI8K6misp0;3ZZH}5CpjzNhg%&CF8V#P@Z2zD7)S~9n;@53 zV!{eX=;d**R@980w$q`0HZsb_sV4py6fwy=r;QH8TyD4 z9iRfl^6SEHGZ66Yd(EMz(m}})hJG)e> zUZ%V548bbtLoj!5A^O-F9>*4(Xp>1e*TE z*IU<(lD;(Sg6P!d-_mynhCZr_Qs#D2hq{bPM9(8LB42anenzb>HPm0{v7k-xuY`a$ zV}dr5c_+*#?c)P9)fn_pvNwK|BMkWB{@PuQebf-HMzj>5ceAIX90^}PM-uTwgS9Ke zF)|O_RoDjD+0cMy(~)cfC{_WAqCYYFU$o;JaOkh^o53;{-Rm{rQnI{Y5W5~PN?DL$ z@qpvlUtf5#1hb9T|6zjvZSkR{Bm*)y4jx!5*Xy^h9})li$ou*c<<2hj=|Sj@G)vwH z-dq*HvEZQB<5i)-N1r-uqW_QIl^bxR+3PVqdSzwto%9g+c?gI=dy7MeH3JltXfeSn z&PWd0%8~Hv8|Vq7tp-f#7}ETI32d(q69asGPC6oY7n)ocUoRS6$OXEC--y?h zQ0Bp+7ks{-K+aDFUClFK?J~iT1%xg*tOi~Ok#)ChyAs*+{eYmfPN_%OpuV}M*=(qRs zJR({oq-}g{V1Kf(H@~bMFPZNnTO-#dq3DvqLhHRI(MeP7#h>)gzU_!v9I2_wy6b4_ z7RY6mH@8UM21SNGw*z!F9Ff!iok8oD2`o56miIM~=Z;6LBla@u3Z{TAS-dVCI`bRq zGshtSUm~?{GDMDaq?$*2AYVH-(&cbAb}P7h+K46!%s6$Q56e0eEnrF>tx9XJ%ct<( z)TO@MkGJt&Fp!YHRz80z484@|wmkx!)$hr)Jhzu#7A4`65ISFAuyTo?Y|kCdR9ekBP!M<>R-b^3P8{ei zEXOy(F9-2UB}z&Ubj`s~=}+n&br;Zy&u$|3L?0cR{u@}`3VtGY-wKf*SE~puPfO-b zoNLW#I=Y+~7ricfeM;BO$HjeM^wwU%IW9A z=44wyEumkniSKL}$lfIK+}wmB!`}9AGqZS~^^A%9yFxMF(I_eX`Rnh;FOV6;E1k^x z6Cj)Qz@10 zPoG6U5^WEqt<2UlRa;D~Qtbgr7uX*U_PVnkm$}#OU&b>94j+U5v5?P1^|;q(d>1Ib z`rBFOo%G;ol@Hj#9MkRgsSYR2dqUx>NUDZC0#-Y~zG3uo0m>RG48IQ1$$ma?W>`fQN@a19>^YHv1@IYxFfr+ zl~GaVNfhiYEj#?Wf>DU*u~Ey(x^@%?*Hne70uv+xRjH2OY`z5(j?v$I8Uf)u>CJv; z7rf=mDq%6-n{0bgtI{kM-cJD50|h8%cHI`@vszoThdp=dtetQVtO4Xsrrmy$1E6bC zce|%<>&(XUoY-Wsg1t;6H>JT`%!}$Z!vml_fNjd0>b?#gp@hmb{*8G*Z%I5xJIH>t z`QQE@N468fZ$V3vvEL8;-WoYCH#njvHm6EQ5yCS34$WPgnVVD7gPMX2PkzH%Ldew4d#QVDm}#+VdQvC>=@j%Z*yteTyQ z6yg3;5PvD&jJ22z{lntfX6lM1Y8`C9yal?cmh_uQt70oZtnt+l|p<>tVQinpkX;9pfL(y=DodxvONc`;y(Xd+MJUUb-Fp`+`=1Wdy;E6r%T0 zU0pd21~sKmSk?Ps#AmfQXW0a?rkcU-TW_~!x1zo`V!-~reuv{QMDOMydY{FJGE^^3 z?q7^Pp^+?+ENUKNXJREFWE1RzLvS!NjWkQ&lwU6De6yqLa-2%Aw*aupN<3GlOz+M! znqxcE`x=X18WQT#$13NP)AOK0yL2yyC&?^0oVJP zRc1@#fmWkgSfSzNqMrIn!Fa{CKe5kXJ+%6t33Xa^xT*`CnCZTZRNgd{D{ph~ZeaZ1 zbj67N3Zl-S9A9)Y71SdjKo>K0tJ_-mNmQ!JU%$*i)~g`-4dg#OKD!hG5?)I5?Ik#q(va9 zihjd7UloK@MQj-IgD!8gouBKuT-$B=CkQ=lJSXWZ^E16BQQ&sl;0b(xhNX+wN1 zH531(In7PvIgQSM4UuUaM(m@yr2Pc#yA&6d`iq~aWMAa``e$4Hwjub=M-32cmoXv~ z7fEEp4w0H#*or?H-Z+0qviQ-eEm~-f`JZ`daxEMDx7iJxHThI%Nu?F4X(U_r#%OTR z^B-lTh26j@zxCMN-yyXxbn6Kaud>iusOW_dNY-9PEw?{ITc;l`npWCxsgo31X4*?o zGO`B)UX4sduvj_SX*wPGN`KL4YFb}vW~#QlZWLg)D1_24PV+E}TWa?BQU?2ILh=Ke z7p&_bi8#Lq7_Am>Q<;D6jPJdO|^kd_07zuh5AbWByZiLao82ei9S~OA7S7`|y_dy)vI<1MlzGg=4-`Fzec9Z^{HVUnw zS*Y<_xmF?2!OSrtq{D;vAG+MC+*q+tYkM!}l#zO?$3xO6%zCMpNEpWpuy|q{N|6Zb z!zh1%t*4?_7MZ$f#QWmGp5E`My@X?>G=8phiiEJDD#54EU0EhZ1K%lbV;pk&u|;h# znaWE`yOHlxXfeKPom)x05mlTQl9z&1m=2shdX&M2_6eOf z!Q08kyP^o>9CobAYHFV{7N8EP&<+HE)>gRXeDOKwS{Pj>`5;RF(X=kZR`f>;20Y%I zc_I156Am&?n4x+g?||Svv~=qs};SIhwVoWVA5!d5ZBi6!hZdeYGHa6G_}>`hRr!P^O60qtIg~g1|<$E zs@+poHzL;V;i7q^wx;~IhHClL&1=r&KVHZN6~C*A4fOf8$wFv)z9HyOHW-9;4ClY? zZU_DQM7}>my*o$eIx2^Cc$V4r#h}+?WU#SjlUk;yUsDbL#yNOYiD8BV>9ai1#G%nh z0de`yctJ$@HfB~AiQXC^J2gRSR+=;kR5?@8>(1@#9fj=Waxih|ZvDasY?^2if#Bv8 zC#RCXw-b1&8XOi`7U#yfU^?R$?nA73oRlIFbvz!?Gd9m&K)G9(P!2A*iyqWh7Wjm| zCT;ljxdBVDW5(ZmnzE+lX4~ayyM@Cek&inniIx7$#}XxN_zXyQ-N+cLHFVu{uD3dK z3q;ZBcI5t&cSQJOK1nLh^sZlrO(XONRt*zHiQXQp$HMncsf#NTHTqnMcJ)b_{4XE9 zw7Q^%2oWYBU`6E^xKg2mRFHLzethtyE{_phxu3@~616gwD8=g<;@iX-X&Z7_>wsMD z|FfZZbzCp_k1SrH{iT|Rr8y+8e8q0NZDRrND5}7o09mq$g5{xhki=K$w2b(e>aNxK zZ`ZG=0H3eNsn+mleK`J#g|!O;T;aBXM4?yH75E@{rA>1}a;cR0C3@l0ZIhK|fs?~5 z;_Avc=2YpHEF`XeGj>ww2ft&%G)^XM2pS_5Y&3Yh!IuCA>`CKRb+3B-4(tSa3>TPu z(a1$UF&SrJ=~Eh2JT73vpg4;^yx;9 zihxTbArc6e(~mn@LJwYPYVrYMb&FO>XnH3&bMdA;qsw84kPd75s>9^wQK|nmb{?CwOFLi#CWB| zOChjhi1Ilf;N`YzNTGt=6S|@HVCU}#K5Y+WeT8EBtOt>c}8O)Fd`W)9myOo5j5ML0> zK2}RlxShtuuhJixPRg?&>m0y-89Uk5tA|`h8A<=LVjVQsYVh?h8gBYVoI4|QB0)&Z zW7?Q~h(j#Ia9$BI2DHUlII@vCT$=Ei{5d+kCe(Hl3moHq4snh})O{QVMMv;n$h8r_ zlrz1&<47!Neh^)z-N9rGpSa~OjNk*aT~P{iKC54FG(myPI)3a@{1*-C?X|O9(QB09 zUw_~*YJA@c{)XTU%TRL*{!@d4r!p4_P`#v!QAhl&?Z?HwnvUlEkG5~SgLC7sVshW)8G>cp z<^~ym3v26&%IULvcs!W)iVwI z+PkiG6>-;$mbBSSo3VO<)PS+&-Pq(<>+s{Oq4j*y>eY#4Ti<8;4v?Ed`KBt4L(CPF zu)~eF^7EIu(LHJU_4Qnbb-K9nO*I6E0>5ZnX&|u>!)2xGTt{i!@Y90=%*8f?Waw0@I7&;*iO2hYVxV!2XmQVu!gxJt;yHs+N#x>6 zp&1!-j$XVhjDjLkc_&sDbsSoAAuV-jUBU}@?*{KIl3Pt+KD4flM0nEdFhY3`v4e6I zUx5KwYOZ%Z`*X|zzKTl3+RgHP|4>@vOnf^3-OUuC0F+XP|L zI|4~{wR;H_X&(9VD-2E@>3gBB#Smot&Y|4O;?Ejlxdc3RdOdgsB>m4>8<4+}aV1{3 z%d2~|zsjN7FG_fnZXQ;)_ub18*K1^y7-XtiWPhwS&!Ur*sr!4U&C_4fmQ6hVp;?td z8J|9Pv$ZU{LB!zeV)J6W`u6EWkKP3PZwOs{PFX{iBVH#*&wl9;;OYQOjY%EKcj2Nx zF80N}=8cS-Pdb6kFj@)?$>}lYDgN;s^zn=|sYTD~0x}x+7QPzs^Pz=j3B)TquLVS9 zLFXMZiaollM#%c?S=#2|)$-WHpwsF%6Hxouwl!jEMCqCG5QMH==@Y1*aB9X2Jl;MmqFA^Y~9^9a-48qi_@ zZ_B*REK+(h!Y(;By{~48{}+J{miLg}x@sxAkjlcc5n*G`#Sp_ep$PYa$*OvKOujG( zDm$t_CM|+(yCJqGIu6v7!+W2cw$7lGC+}?rk7yk!z>>YUM;#1_BkQqc)!ziqfh3eAe2>(t{7%sPyvO~wR!&tLyR*=$7*`RQsWunoy3}jEk zOC@j0V^Tc@N;7%5@` zf}`5CAHutpa5FV{j)y>k^7ZaOx~f++)#$y|m$8qC(o3;fT<&8FvZM?@-lVnONpB%f zZsJ1XRx_(EV>TG*n&QTjtLoi*K=#s{EnS4a7stjF!>50jgY!x7_6?p&&!osq9*#}R z1C%%EGBq&6x+O}KFtnKB{AZa>1N+|fauM^j;KMQ(@?r&m{Vpk6f1~eJ;?Na+&@8X; zg5?%RsD^0LLbSi&Nb;9VRYF4gg-yrO(?BY0 zou<;_`Tb$uzU1R`=4s;UVVk@CpdASp7cSs4cvUr_+9oz66T&QV{`y8~WVVp$%l=5jR)5w*q1%(i z%GD-(`j^gqIA*CJRFatS`&yPleh%do^&OzwkT&YXWjp3hsf+BY);O;7Vzj@QJ8X}L z*Z#~^-h^{E-mrhW$!=LaI$$|>(eg}pske68zIfoWWhZ8Me91^TYLy6EKF^z0(w$Vp z@rXzNSpQ{QmECh>=t=jbHcXFFPVW*qxo%)9oaNJG1I(qoR3%F<4RS5IfS?rKuSku^ z{dyEr;zu>1+aomwF*uGlTvC!r?7iJ8xC~^YAC+;}N%xoXlHd7i;yY}ey$x-C7x8Jz zi+pg#KV(3xWF_?^^LaPZ?78)B;i1rMyyb>cl>#eze1KPYvjVWZurCNIF-3&sfyx(8CmXKfXFwuIX;e6qn-TS0!*S0u*N3HSt+5M*LjLM&4euN<^S$%Ft~SF0~RBKsb3aZ&Diq4ds9lk9%Pge&nm?!O?Ed`jV})e#Z&B7S6Mwj=xhQlprq*Wz9)GdSMtPXm-p2~}YRpAe z=p!vOEek|ypgKM}GOymc%+D8jyD#wc-mi;KRK;oI4doBkF^W7q(EKS!G1(VrrLp~% zm+snqZZ7BbW#Y!5t?A=$=5%-C5q4z8opB*u26S5hU;2c(`||V6ip;WbHpu(M0{>z4 zn1cI6)K?pZFTmgKE{SGxekX3jaA2lDa9>)p&Q$l^iF!@xs>9q!1(A!3D}jobqQ>L0 zy9|BucR~vA%DYkp?x+a=m9ft*Dw4UxR4YI~Co>2SiC?Ur(}M-x34T@7ShbA%=Uq@0 zd1e*u@cS{h`6b}YHEFozh^i~ zf6H3qmh$G6d{c~^G=XAco#6CFy!1=*AA))gIH0T8&c02UFIv-%@;b zvrOmy>@vF6C3^`^==&tqpJtMnWjG=t;Umec>##%PJ@l9zddV}m0Rjyuy4~3cuc>B4 z3^vjL5%Y!s1#2fJG!bEzfKzz_81Uw33q$1`gKW9}unhzlwk$lGR$%`?EaZW$6v*qo zllA2xzhW>>EoEV+tAKQo?Qo7^asOv|#s0r|vT2c8%gOteA0R#KTC#3C#XL*#ZJML( zYW7QRtiH+YnlxU9$!+Sz>)tNXv&W_6sE`GPygw8U zcg_5pR3&e`kKolGHR?wGGtSU>!xpbJClt9%*fgE+Ib=fYJB&)KYoLicX$aL{TScm0 zrnUNeq{*s}1*=_cB40YO@|dPyWsqT`i-L}RDU$oEwsp0=&Li8by^i0IUB(}629)Ds zt>zmwJHAftE&R#XsFKyIHL4_h_w5~oBddqL<~CshF_O%|(rFkSc8Wrgm_YLk1Ibxs z%&_I;>JdT7m`B3hH4&Gu+qMOY{z_f93xkH?)=)^KZp{so(BK(L?lG+X#ZG3qX`R)o z{xa&dJ_Gs@SyYq}C_R2+xbTCRig1~+W1mg)3`9z9d+}*MQeR@p)@$~DJ&)>lddsex zAulwZanhoOF+e>JRDX49exmT!4m)zMc6k8%D_Bh#*nWoB@mN)yJQLQjzivmHv6~V8Pi-}rf3>aL{IY%a0wSd%9a(qQRP@$FrpKD ziUpy_N?WmD-iqn(XdDg`cbsy2?VS<6T}CPYPL;Rx*ISPXPnvz~3^l;#UwZ&*e_$td zjB*9CTj955eoJnhr=peB$nGV)-H3`S@*_YNvGI#Q?dR0Rs*sPZfiS$SW9i`aS=yPL zj>Z+)wF66`bb8(|Oy-Wpk0mHYgCm0R9@d_M*U7mNvejVM!=c2Fz_aqf#S= zP@!Jiz+Tm!w6%8-_`L$m4;lYJqtC|P$6Sjrb$l2}<%)P+!%OEI^6rVZ3AeIAjrp$> zyPh8t!{5=4Ys~4T#7iu7e#PYl9NRn6e_nW;cIZ;hYpUG{pk!;|hhn(34Mj(JQD*XL zmpl|CP7syg*egW*1vf{?^%)z^^l~Y1ABcG1#q&{JWQF4e;9SC^Ofyg#-@eBxiw^Th zuqtr;UYUd>}umdIA6_F#g-2$CZoF*s{ zSvP%7(p5Ok^=)&HK~+$m8vphuX4?=1RHUjxcw^(NpS@D(Jb3R$$?c&U0uBpBU|2a! zxOsA}zD;>3`;`;fYLVOE_qwdvy%%Uhj+iOU`&usZgNH5T4~UV`GZ5>Qv?FvlgUS{6 z*pecJ@IK!@Z}fy=qxtuLu)4{EAX3zw)hep^6~S-3dyUkANso!Dm{QzsjbT`?kQNK? z@j4d?xFX*O>G(W9z_bPTK&8Vu6A9@Y3(DlWkUT?xW{x2`C{7GB8!Z!Zj6$#mdLaZ` z^GIGXQxI&gR|v-EC%dI?#EMeZm>peF9g{WA^#3J=k14h9wWwgMiC;vjz zpDlu{+X^=HwOAWv)ZnjWL*XzYAj-|`RGQ{W;RrworvH0iH6&E#p`jB-;qp;N z5kKmY&AA`sV)pueHelRdP9A+iFxSG4h}fF^8w^F;@o299)Q~_)n4D|RMufV;j&uJA4-2+knTr>$8WmhUiUoZO4>VMpP()$z}m_vCpE;kvYPwy)+H^d6Qu{# zm+Z>}eg?@wukE6O@lS#vRZofp%a*FNbgx~vW{*vTA%ioD?9**>3nk$)Wd|0WVh>6# zfD20AubVJ~5a zj7Ybw>L)z6^V+{^8q;<_ROBOLuo_^G1AWY#6e985-o!lrOkX2dzU2{uJVfX!_O4(2I3lb}lp4K^H z1^RgxN>`u~nb`=x6M*c`;-dWIw4F1NSid;lhP<#&+Eilv3KU0${7&Cp$D4qblIS~` z7a7aFq$cT%(-9S5+1Bm&Lw9Aq6N1^Og-jeMFEhafK_+}Gr5zDD)iU&@PCs#U)ITp^!n^g9WcX<$UUX zQvWqI{&69aqS^_LtCH+?_u7ws-CFO-;CHr2I*j%li9yEJxQdpRK* zbMz+rWgzV>-etA*(wAAsSxIq8vzlxMc7P_gM+ypgjXU3rha9nvl5hUG&hFU*%B#S7 zG9K+W3IXK`F6*E_7?z*_GR%x=mVLAjNs+S(%O%qL)(HTSGiAB|id!hK%7SKBCZYd# z9(1|=IRBc-mJx8c&3^M?Shzhf<_}d^dc3E2w%%XCUJsZj-xRNmmfEga#rBq%JJ$LY z`L6fXbQKJOEzSf_(h<1jV*>Ar^RR}VPQ5M(U-t*{evp&%aneklgw>My0n?m{K}(sB%zt>hxle_nx(8ib=Ao>mG*VH4!Nx7_Q6f zCQd8!-SDjb+&~43f`QxRx$tHT~`7=Hvcbj2LUL567$enHy>y_0=) z!sp`BQmVlju^ICiU!R%QOdh6?OkO{1-(28aad@3N>k z5xBtFv((&SGny4PzS4c&egyJ=&dpOufQp%R5Y$oEN1C8+-JrM%>=*Jqdzz=c46gNf zUV~Q;?>kRn_Fz$a;pEe3xubjC+^d4HE$!t0;p(g7s%o~sX{13q1O=tLyF&#*LApUo zy1S$s>25?NrMpAv?(Xic^Um?PpZnb3`={H@oY^z8XRlf78_|m-Vu{G^03ueP6{Bb> z^raczm4{Xlwwg+0uOZBEelXQfxMM|IPXM((oQY5B4@CvoUVyoUjqY|wfcv*kEJU^_ zbm3H$7Pe;=-kq2xGg%SL)iS@F4R5Kv4}1GD(^I-lP}t|H_BerZVoU&)s!9|uy#n485!7_pRa?&O=i1oa? z9Kml#Dy49l5sJ_&>mkfAxUQ$?TocWR@8=#6_iF)3i(=p=u^QbAgrX zZX#2A?qpu2GP|1Zmv&zv`5)8!&#`EO^>p4O??3{GvGrRprgCV(mv!q_;M>AuFs?su<{tQVqy+kWX(G*CYY!#3=OZEsxAQ2T^ z0}1YYQGNH*a)ZBb#7Wd4jJ|-F$vELf8wN6_@%4i=yyuMF~F>0?W`|QAaTQuR%VNvq9Ean`jPs*RVn~z!yf><0!X*_IlUePzTS%&Z4za$Hj z!u*mOhkJ5K$eESBz8*~ZNLV>bH#ofsJkqHDOpLfZ&a9cVv?w=;=Z}j%xk`1&Oc<=? z%^+XXe5=W|PRxVR224An!Y}mgD-)i;HoKe6HEp^h^AIl>r28Z6XLlW7=u!uI_cOiQ z-^zbhBNksU{DT773I{|}52^IP%CJ=mZ%Wh*0cdLlEAi{$y{9f|Pi8=;`QCn?(^i1I zWEoF0AN@fR5!cd6gi=RgRDw^uD^#@t@0>&OOYmyWKq^m%J}lSM554+u#$n&%45aCO zPwUV&uGiQ&1y%6Aw)US=hKHt)O5AYTI7<1jX?7C#5{+t79TUxFdpnwMP{wOCII1&r z{NQU%=&xtpl>f+TS_tJK{mreLh*W;}6!g~bNyA?jRsYr%f%y8Uafa|bBG)ssLU8Oj zYM~^ z%camIVjpBFX)o!s!o0$4da+4*MUd5I)jcCJU(j#Oo#M6=j+XwcJ;4U;Hq+AtHvRl$ zrG(jZo;uWjUCHWW2-ZFTb9vg2ROJ@?fQpTPDvC%37A zk0_L^?4U;V;W7&D;&c3GcN<%QiZ)42RDmwYyzO*MY|#W7x<&$!l0=})D1a#zVZG0y!F&qC+gE-jS$uE2dBe2t{AXry0cRXTK`cjIBn zh*03Z&05ilO5!j;n=ZO~s;cT%MrGCV;*=isl5izMdS4=v;GXb?89@o%TI(DxJcp

!CvwmWDmlVSEL-%F z0MNitxEu|CIy)?n`(?3cd^||kaW^92pR>djTNv6BU%Fe(*zX#x)2oSyL=ai;QkcAf z%5QIAtct;T$K$vS*+G=*Yel;@mS0=eh1s_@V4Xxh;XOn{y{Ea!x2Ct|E~DOZTEz$9Rn)*eheOABU;8JC^NI{xTp$&h=aq<-%TKC>c0~Ij?z^5P zg%h1Qp7)-V>8qG4{IE!-V{-m7rmW9PE^-d?TgDCeZ9qT(w1D%22ufz-6oR%#{qa9o zFPBQ;&KpSe!@L)KY7mZpkFy=hIG1GgouW3F@`WfJ+cTeP0WyMLePsf1Z;&yO{k((j zqcJ{Vc}abUmcQX-#qklG#v~Aez-;0K=f1PWuvJA6MVdA;!j$bbxj`p7@?95z$J5KN zifBNhb#GIHF%fuE0?o@HM43q5mf9_3O@b0*YC!i9wQrNk^vI7uv#6{V0HUfm(G9E? zDP`C`xxO(uXFj`naw}=#2vJT>#85S{!K)P5nh&dY?DJaowaTUVmPf$E+<4WQs`3d` zs1Ek|wjdSDx4}%>`dM+-?{@dc8$^c(7Y$CSiS9>Yk_j(D%<|Mwncl~rY)nPOV(&#vJkuUN3UczWb&yEaEv>cftQgbnaP?Lwul+@@y9;WvzkZlp3ELMySsT4m2})Q8=aR6@qG)NhV+Fpo@2=V`qQrZaxb)Hv;n zYW%calc1ttd#XKSfV~XrB~@dk+sd2HDrnZsH7P6>py&nPCp395Z_40tyP(cq|{YR!58+e_kL%~35DZk1b%R{LK7YvI*LRaNkeWua~%d(J7yH*S;Ncst&Bq-q@)eum&!}Ysl zq@|?+i9dC8GQ-u*uTICM5LUUm*18_I#2d7&G(&C^0uoMI+>yxs;z7Yhnb{rlF{l1| z4JoaIB*s=Y1u5eAiznQdE1G1#oJo-rbhqjVBmDmY&TB(D9pQ=^sr`Lo#|#MJ*?lz4 zd5?npf@=&fI5lzF7Yd%l!Z319KQ_Gap1BflvAfdwnw`zQ*c54}LTzonB>0S2xJ*WXUVLz5E^s~ZJi-E+%gX=F4| z3eTTi&mVRco`7;4Il$~&ysNBuCF-ZpPxwJmQTzwBToNm6%GB$AfIJmB0cvSEz_k52 zjuOnnvEIC3D6hYIG697y90=Q~pZYTOm~o!B9$<2ozn~fH)8}5E8Egx3%tknf=8><3 z?Hc`J)2Z94YiQh&R`!s?InC{QXUoCLSS~h^WGRSCNVT{2NvUtLN%mEdi(H%Z63V(#5t zEcaEW8AC~7)Eb9Fy6Cbj=SZg9^k-n~lF%hbpd}X%M$n2|iNV0b$NzKosx6)*fu4i* zMQu)P@S64)7!`kZeW{OV9`Ho1{bdBw7kWq)H;lIASbOd`9r&2(H0nDkt-cBs)}4fbh6xW;!EWxgB6F5Kzas~;{l^|Yzk!tIJli{4q$)l z8bzP8`EF~TEoW573J(_#ml~lNNf#L3*BRJF_Uy7{24?^Es#-L^Ftr^-`pvsJvc(iw zxm@c;ESavhS6M@wsa3vun}{`;K0jwRE61d#gbRQF^t4y;SutL%HYx^|wtx21DQEOb zk2F1EdW22#YEJu==Zr^wBui>tp%azFSDKO7Xal4o_$WQ)6)E$gm)Rq?Nb7z&{$=%P zZT);`J6;8xEuEA&5jCaDP_`Vg_4UB!WcNKDTMuPw7bUeZ z5*E3fn>hlxeJX%|$Yk}xztgW=6oWL$&OREIGrf}bn>?F~ErCola=6Fe#D8c@@8M~> zOI>H)PVMCYN%J2`wtp5IOD?aBfZ70{V?2YD81xp+w>&nza-jSMr;5hZseO;j z=L4F>rX(zPf8fq70jrb)5i^%u91d~Wl*VBOmqby{b1QXd5LDhft3RA2wn~Zu6uOg4 zAZ)pC;VRj~MZ8}5&CouL1l^a1M${cvnYxfAq1~>Lg-K)$`92OF zdG4g)-dWLu%MC}*;Bde2dZbFM@dC*`3tM3NHbcfiN{KDpnnd&`c zyw)&$S3aswUhdVI@N-|zJxfR4=V!7j7}j znG{x-AKlafM{YlJNc)nPW;%5}HkKGGd5|S7#&=doq3P~TvQ_#4L@5AigP3^ttl=K; zYKHqS4&#)aisxHai~l&d)q(2bxZke%^(I4yOMrTX@z-?{-^5hYo3q6&!IPgco_+~N zS6N4wMwVXn%aveP0sfUJ%!(2P;o(x8zbul}FSa&}s(WwZHZ~4pA{JEs!A2SpBApk;UeN zs!j#^*_^HunvCo1vmrWhbK`QDE3&2QwzUi~3R=%2<5!h#3|CB^Ydj7lbx)yTMVkNl zWUzwBLmacvpztao=KP8c}#g9egz58)4^7dQ~%(Ky3BJ=X1u=C4i8r)i_5X{sp2T zEI~p;FQk;^a%5-K4bb!gZOOw*X0||@;u)Xv4oin=opSPm@!b%qL;K0Q%=heBbtpDjy;t51Dq|=sTw1em-4VILgsm6} zOGL&*NY9(N46Y6rws}uD)>xLTF%^RG_jC=PcMVAS^gZNGIp*(PG3wy!x%L`JCZCoK zuNPkQx)`Rhkoc69hbBFusARvyxHjKtfzir?5V3Z!g39NMKU{F0J#^$+?w0o3Dbjl_ zKlxCPfhUg0U8wP&3;so1J*_;COXMxlNZ#1E>+z>u9W;(HCSh?cg0u=>p187pFxxkv zlp+d5F#+5$FxVcCH(T3c@+T8KkUIAZ#D`H&yAZ%u^u;eG5%x@^=hZ$=f-$ULk-4(L zk?J2Y87p}HeeyIsK6phg+67q@Cs02e`iuZev#m0CdN5+$tm&=|boIvb&Iy;Zyjw$K zAs1abKL;y2V&N=&=R353tHuw0+MqyT#I|hxTP&hrg&CzZeWJPXi3zaSPX>6Fvg}`d zF-s*!$(yoYb--V4X7E_@&X(!tr~w!q)UtGSQnrGb4vkRLZKY_c*{RbDCcS&ptQC6n z4#`h{8NJfHyzG79LJ%+K_ZM_#$KQDe5Nf?03nMT%X$z8PK#X-`z5|&uZFO6 zah=mW`L>6s1`(n-!PmK|@I>zbIR$e#{*O;xel!afgciAo;zHi{wJu& zAJ~*SqyOZc^d3&sZCDD8vt!1YINhsD7i0#hN4Xv@K4ys&^y)q)oM_SyU?ie~`5r(R z)x_Nvk9UB&{A50Oy_c^NIS5juX%n@j(8;UGFJhamtWv_b*LWjv9XZ@%kbjk!z}F!rchacU22^rx*pwk`GG|_+H4;;65Sc zOK(cKhxffs-Kd)h|5@)6{r#rtTB~xmFre{t)FSSc-iD1t9_Bp`rv{M9V1DPV({+@d z{b^^^?ejC%ODpm0);H0tCYcw?CF<6WUQ9V&f;=Xc=#Z}*A#($tbO{O7^r>sfy3s8s zOH5-V`g`Bq@VTGzkgmQO>v>K0^*P9J2CF=j9vi;r0u0t(TffUfOS-x_?tAcdhio90 zLICm5ibTc!jg@j?nsT#fJWBy(g|6#b(uxZrsY;M|FGqH(Xg-TcK8v%_W;(-=`+D7x z+}#o|fM8{1Hrksk2CIL6rXq;h5Pj|4-`#`74;hQPiL1?CXcV35 z?=u`g?Y+(?5$ZG8!VCUhA&s6+DKnp9uK&pvF7x*ahvfd($KwvHo!Rbxcr7?6( z>p62cCIlzpBv23FbTC7hGLl z+^O`3E(q#)JOYB4{#l=R-gM|p1==Ehpkwp?LWl9szX&Ug2Pl)PkQMk3K0ueMzEnAuC{_r4jTi}&>@|sb>fgD!3J2eN(B{cYu;{5Gs(J>~ z1#SeeOQ3W&qV73#3gI-)N$z=>10>LNcVQBjkMPYp?*A2j(Dl5)zu^Hd4phmZ5f!i; z?5qOy=P|%a`2U0<=t0T;UttJks5*l^_^<=KJ8^exIJr>DId@vRfOE{h7ok>s08DnZ z6cUpv{|r=AlcdI~FSbFa)-q3os}^ zVFQRiWB~DpJ?Q)&;XFb3KR3H4H6ipbB^eT7L1%OkFvFw4?|~g4=D+Q^|HJyX2b27- zZbcMy*@HV-nyX1ySwNIdN!r&{qEo2`#)k6(EmsNuc$;LGIadR1N9qWpyP)H zRl=A=?{I+yOZ{H*_Q(du_ zGcx43zCzU<>_s;fU8>k!o$-Elb?dw2eR1GzYM+eoj}pW`V?lj+@2=T3r*x?6+2!-I zdKkviVv7FhHoN(JdvEyTL~+o^OaVyMiKfWBq&qm`K-UTpbgdL5e^m0`9;hpQ__Q2~ z34A#pRIc#@&XVHq;3t}aX@$tcF1)ul1gkPAT;hM`CGQJM%VXne@ekmxI8;1%-ngBj zUMEs8JLN4khvuji*R zQ8d2o`4aM1%;i7b>V$TSMz^`x+i}l}!Q&@87Z1bLmF^7iTqNZ_@(zi_H2ff+u{2i%Sn1sfYy)?bO?wUZn3H`A- zRPU@&k)5ceyP>Ij&;BR>^N_qfkqVD&Zk|pcaO$$&a~l&43@Q@58gic+8~Nn$zc-2v zOsey3Sl-4L?6_=x(imPUZ5II{yNKJqCV#Emlm8iQ-s{cnsTR+T$L<#c^XrbYaLUax znR}OiyoIw2p@*38t$!ANXQzqoGq?Sl!{<*!Ez0=JeNiE06N&qeSKR!E1ONNrw0!58 zSkk3OB;P;nyvsmTxwbCl-%F3uDd0CP`JXOMZ;q7;lUFf^^>7#TiUwL2@}D(DEoI%B zdj0QB%Z1i09_MwbDGTSyC7jVKFBpbAA;(rfQ#TQydks2tuNjkjN!@HGBC_Y0u6#}I zc6kf&x_hOpc=lKD2E5gnr)J%0_>d&B@0&bfS{CudH{Kr6p9_iqXDt|Zx>G=e3Uatw zwANAjiU&P@3BTq_ocy1j_}lMKkBkf%6>PjNY|c+^BDm|Y_)uSYe?+ z>*?hn-4goV=R?#4<(DS1Z@x3(H^%e-1BIppo;(3t!f~9H%KiD(L#k#?g~foj4;N|q zDH%VhU@(J5Yb_nrH51EZtve#gca`79Ok4X|*MYA&1~I$;>JD1X=@@j0fM3T2QIT6; z=w)wJZC!FU%vI?h3o8z*&5uUS-Y!__#2M}Qa2|j*IgNLn@4{P~?UNk6tZ4d1X`Z~6 zKx#D6xIA?L6*QzaHQ?(PZ4+M`YeR!MN^;Kv2dAsdqwobOLUI7*gZT zl}@qPh7Tv`b?-7y5*h@*1GGSn=Z1$x-#n#~9+ou1t9fT(?i%@T!)8O>ff|oVdb$H8 z581vjJR{{@#6porRlFQEirPXO4rb_fUR%w+ET+y1^CPv-NhMQKDljmi@$*q zrH0E@6ov#E%C6G@A)JDD{pF~JEc#>G&m{m!YhD_fAcCM)Dc*6ks}C?&1W6{q3??p5pF5?0P#&don7cnj-`~!^tPbd5 z{O9WpLX=Gk4#-BJz?j!>{9uElEDBC`6W7h?d`sg2Ve658v?ZqPQ~9kZwzvE2kqYPnqc3;r;6-- z0qP}-%|-88%DY?qMBb4KHE$({?S$J30Zc|k#;4a}$p97QSC%uJg**FJ-yBHO7*cYE ziCLG0gn#JG_6@=Nie1=8+m7WHzC+4mmBy+McaJ6wi*4PT=NnRc;s!K(fc}mJ{9gqg zlt2uQXXy%jocmCX6_p}2F(AnWRqu;WjP!tXk?-(VKZ(O4sTJ~T7D%Y3OLknbA1j&G z8AkMXa(-=&@s41*S>)l51XrQIP@~fT)!x(shjocg$dFm$FL%2H+Pn`VXXPtLI!SID zz;J4zxe~+T4N36HLE&K5S@!~%IN15;bxfKcKO)dglW>e{;IX>ip8>$oiw!7r94ou{ zt<;Mo@vqpxu(ZP=jCvW=R@tz+B*+9^-e*SA`LMqxt;QaUe}}IK3d(l^uY5Xq<>Alt zh_cB(9D>K$9LiLPA&ngEijfyAyF}eUO+}idNpiIxMjp_5-&{lO2xN7PifcpFpOmq_ zUk#cn;$ta9Gsd-WJLS*k(&;1Y&R)YL)1z!=iGtX< zKz@&fHVom+JP?fePlOINdt_i9s4d*|*qGflgI_oxKgZCtQ&b*#HQgV8^qtb*sXr1X z7kEV^0e8X9y+4G@j9LZ6@OJvYp1C@j#e28uhXUP>Z17RI_hBjlbd zH(?FV9rv$`^O4Z}-UVQk(AS@Xl8xsjmRd5y>W%RS+meJYiVN z*+8ciIX!1ML~RWW&Gm zG$1|Jp&?6ZrRy4KCv=em*q!!?Ci2Pln4GlE-Ng;8KCi$UNPV8lz52&ou-%V7m+*eVw(D+!J3Kh$%ET_ovOH-Y0K;g(;D$u@= zBg*3rKV8kLT^kO)m3zgM>d7`T{F+T3Kw~_SSRT%nNQ%_6ACvot_nbx)2Se_|>^$mf z{EN^aszu!#mr|XwAJ`ExKDo1WLT}B!K$WNP0n`8}Px&;cxZc&VRN_!D?HqUK$qTGn zovyA;19Q@vEoaxv>h6o4zK4Q^nG%m(>Prt$Of%_lB&S+}|>i z*71nk#nY)qX^mqZa>Ok-XK$#~t=tN$0upD~0mO#)a?kA3N&ktdmZ=wuo ztI}#$^Sg-}zYAiNvhsRnNG+k*i zhSh)~OIrb7+oWDX|_#g-%c!W@4JUUylpr02e&NV1wMl7?n<%CH%*&k(kSfqf=?RrYw6v)PBrAt}ob3ca=3OOzrjb zbO=aQPXhz#q6k}pc}{1^hEUZ7+P$`v z5p{?O<13C68?R+^gROS?9lFz-?mLh^N|kaU6G;Xf!WV!~EmN?a43R20*~0G)=8jvW zAJipNi?JZHm_Llh73PpEqW`RBDcvhnDse4Zk2`GZjx@?w6Ch}TiBeZhbv^x~);?25 z^E*@iOM-J$76r+wl>H#$tH{rR(M>nnz>spr+STwyj;QL)kdDgM(mQ-BJUu+pP$J({ zc^s;&wjfu$b(8KS$|3XsA4cLqTFEf3PdiV2+Qs-cp7@4=eG(ED1_gZG{?c=D>cuv) zVa)$Ly@b=P49>w>^ykkZ*LsF6_~duJ;-y*ElSOA)D224q0RW+V+XK9;Q@o8!YnRqT zbbZ@HgU>2y2hrDoIgy0*5%O>us)HM6s^!ZVy@naNV~k@8mrb`LDY+~`(>ZV5MDoRIMv z8prCJXwt|bAd|LKU!+VyD6I1RxTzZQiXWmVlL8Jqd9REqByaESujFqH#j@G~V-3n4 z_@=F|=AXgf9!C$PEFWfmG!l}Bw-2Ra#c z`1^_F6;SlnUYhz=hsN6vKWcizhgxp^<=gQ7Ngn+}hl~<=OcIbOMRfXcKq;WN+7bhK>wS`v$^8dIdAcZe!7j z4P`uhcw(p-Bs zeCXNaiipqdB}nfyI2}+9UBX$D-y61|S_|F|XlLAjYUx2^Yz0`xpk8hLHt#%#?^Ube z=S-oUevUG-y`ENMUsZC=G4o>J_hk3 z^-ps|A~}KQkH8hTqS^BY%WsXX44HN@Z*5QF^xVJtWKb2|zgai? zhWJN(%W?C}z9Q9R@3Zy2q6uebuS)<2eATkT(EkS3%LOlCEe>VF!k4UtWz#8~me#;BmbYv_5~h_R!IwwRnTROL~%hRQ+bEL0^Za0O5M2%3L1wg>kDK zSzfNQ;zq})`R^zc`{vip5+*BJY$We3YD#XIuY#Cyj38MwIR(~$UpJJ7{QhUmmzk~S z+5y)|o!JsWv_EE!J8>0&R!s#IXG_hT=Pjjq;kHHXSFO=$l3-q-yU28MbiIp_5(D;w z=l2myD9mR|RYeEi^PiR9Rf(^J%lJ^l3!~4QzsX6-2D3^rAaWtPh|&8Z-cr@;Qk1Yi zAztYKK(yWr*`@@*^yrGS<7fxtDZCVKJ$K1LVXme)d_nsL9+xiW8#G-DIF^Uab4gdT zxV`a%+SP*MLuZHgMLDZyF*mN6!m~WEVn;{1qs-oiGu}yV7l568(AT#JjN7;!d;U3% z1#pnVl0WQgFy=}15#VfniR=+ox7MAVy_LW$(|yn$#`Ll|sB)O3CYnMid*tvq@q4Az zi3VU*uL>0Kqrz7bPLvoCeitk9bgP?tywoDe zPHn>=AyZrNzSB+Jo`3g}v2}oiml1p)vtN^p$bC)&>AJ(_!dmMK{9dj>A%JFt0NqVI z;%G~6uPOJ0jJ%?aTHnJ(vhxRvHsaEEhqXK`b8g41K)q1#+vN;*K}Kjmn)eloP+#nL zvo4^=h3TsUJf+g3m7=^6b$SC76i9Y*b_!F8iH3$IRhyGz0MLs0`T53s27mC_^Z|Pl zl*T&KKq4WI9+rveD<xd>#I&;|6KG&=SKPmdBRcCn-wu~}gI^^Oj@_7&(PZZ@2 z;I?4SdtQ}Ybi8{|ysD3^0!+mz%}`j=6`&WvV9sYcOuG*hF)P>O-o=&%I8|Sm>d&No zhBZWK4bLWg0Kt_EK{fJ;?781GP?Ig*FrO4aD_`z@tUMl_HLb%!RWmORcd4kKlMJMM+GH2FOOBxsGwl30F-qVDxoHw)uH zy^XV1!hphjABc5Cz-ch7VJZ9-%n_kufPwP{k5{V;z+_pgPts>&HHzsnaT1O0ebbp> z$j=?H|LM6z_K+gK+PN$Qi^NI;XDL?e)~+$k+KxAphg<(0nd5m9Tm*fn>|5!R_l6%} zAczn&dP;{c1oubYj*gDCXdrt6chVs#g(yXN|0Noz=zV!9s-}bL?fU_y3;i@#9R5A; zO9P@d!LlPttV*1!7!qqVR;j33zYlLY5bQN5XeGB9CNbZC{P=Q7QP1cP9h}yOG^9xx zoq1fn&0sF(&j`72({!)Ht2v%;BzY!4fB;h0f&=`}y?sVSX#&3yV10S>LpZ~R(8S$2 z#dgu!CtE5f>UUHn(~M@@R|%It6q?&OE>{me+ePcJf`fkdlD%dC-(v4;*&-S*rg?#; z`Ek6E(rx*Lf-cGHEn5SdbQnLMHhdKrLM>Bj#YpTV+*xTntQR#2pU`n}Of%XkJyq#T z;L62L-lK}1*x2CEVsuFazk6E$1RP2ON2iB}VZzo`NQ}P)!0O|ewlkY~qpD%rSVx#?{73LcZ9#)UdSAELom~o?@dn5&-M6?2CRDG`i0oQ#U z$*yoBEJb!7Xl5}^18Y`Mj-0##5_mLO$b^STzvCT^KFv+1_C(iOy*kC=-2BUz-UQ+ z#SRP!o}o027q4f0oiw(e%*>qsnz#0~6@ua2P*GEWtXK{$IlY+I?hhY~29PELY?gW; zy~C-75Xrd5|y*9kz$ zOfRtsBGl&P)n9q-;XvsX1O?~f9e6>emYL%lzPt#vQ&`@?dvLjKX_$5;_g^iZcUa5s zqC39~85XCtFLu@CBr5@-$~_i z(tJsL#sq__@}2hfx_#9W`_${oOqj6LD}-31Q1eMiyJyifna$3Uqulm*HEp-NBara!#v zX7`vp7%9H1a@d#Ze!1A#9aJ+KNdl zkg%l%KZ1i~RanUkNa$13$P_1}MGxn56%%OrnZ+|~P_gcxHfJk5E z$ro7+o;NJ5v?9iE7S$h#4T`;A%iU#(p&5u*;&iz%+##ddlT^nW9TRjKV5^8D*5>6Q zB!tSqU~|tuRRG6W2?3ZN>mc>#OV7jY4Gw`#63!unm%DN1S)MutU45oUDeWWS| z?|qA=%|j*M7I2gHXY!px%$L*ug>u|s-adX6`hjLqdA8bOvuk*;TI4CIU9--#t&N$v zNospmd7v)NVrr()^L)7Z()OCG3jgak0K^q3{7T+W+yXO4%>1%!Fa$gVN)HV@&_{y6 z)_#QiL}v%J1-3w0bkFwhD=j@p+^zwVKs%G$epQ&nxWhqx4d@8~v?U33Z!r3?40d$T zZ&x(lFyOQBwLwm?eOx3$rPP4A46s^M&ak?s2px6^9QMCut0qH=-+bU?&i&PA;CBvzpw)G3prnIt#|LSCm9%<|3mB z2wRs4cS4x9p!>2gF8BJoh}+-SYfNj8dl0fJ_LB$J4`4$~7(pwV&>4=~eML7go zD};@*{xvT+Ul^cuG28SJdzhbF+X%q*RcUl{X@klLpQRjUyVo5B?5Ixe^-htR&YgoJ zZ0K5F;3S+NFo-qOb@6&VQaM?W_Qe(9nfGqR%|z~@n66FtE2j+oqk$pvU)$@#gN}F- znq;3}{$%!*)C54!gAYMlN%rY5nxZ%2dG!K}OoBAd50Ef(aoFnMtV{!~j+#8yn(Y~T6}hXJ+{AkV8x zY&+`-1QDQdRfkjc;$0m1VeHKC482S)8{>Riu0uZ_=qlSo0#Ca#480aH?BIaNF@ zdvUAwijQU7*($XsFZlbOwF7YgRTFbsUD|@tK?%^Ims#q8gj%8^RRl1WTox**S?TmV zumf+UZSYOaLu&cUUyW%#Np6LmRiGAie@Pf)LucUwEo5v34FPC~A(VA7V2<)l=}3;lL=_96{$Z}&kT^_wi@+ux4Ml#;h7cnr1BEN?lgO-WLVv? zSCJ#oLyHvn)#bRxemnKOut)EC2XIo;w4T8WTu9^CYpk3AsA5@x-W@GxI08MB*4#gE z`!BMZ*J*|Uf9(F|@6SnZqmTyH7ej6mMpYW*#&J>{veMr^nigxi26h#`GmWs`XA~Tm zIaD`?6<%Cgou9{bWBIe+@>ZLT9E2(&Tt{+y1?@YC-4E?2jI4+wd%h{>a?;TJ@!&XEcfZhA%=AI+&eng|jZYlMvTZZ$d31UJaL$|dt z+`NgpG4Pl=e9P71#|@RFawp*&US3t-Dkwlw{p8`bj?2HW7Kk`ad~8|{(?GUC%$M&* z0Vb?6^UvzUg86OTev12C`K0kcl{bMF#nyD;q1aL%&^8QJ-oI#%9F|m3ap>$vP=h#G zQ|@otWnKhx)E*>p-8C-OSVJt0Uy;ej^&Y0uugoZ#}>#mn6gmyW>eMJE}=qZ zMP}t6Tw$9>peoXkP_29_WAxqysPzqyGx=GvY@d#f7p@(xa#xI_vJ&mjo{beP*1=&g zr^E(&jyx1CM+ z#;c!QMJbhpoOLZxFbhuPkP>_{Qy$3=QPM4oLt|9~Mjt0dVT_CKXJa#kjP-+>4^!h` zF>9`P1FO32#;Cu(G=k=nfar@M2BMK=KL{I#|$K zj@sVjA7ts}fJ!cyUuNMrRuZ~3^Qq<(JzunoEZKxAr%uwR%?;had$Od zwLtR|iUCe?@BtYBKDRIGRgMXTx0%_npC_g6d+4S*&x8*jWaX=`hv8l~`zcuxk-T1T z?uBaH3w^e|BXzHNF%ds4#I;u%Tk3AMt2~6K{Ww==vQTrr?$t-y!kuI)gfvl8%LVdd zDLi`~$StXHc6V)PO*{L4MPxsB#!7{9FoWOjQPuSfh>w4N_``PUdMiklf1h&~C!n(- zvHQ`o!Kw{C%vaU@tOA#Yb)nDmL00p@ZBgAj&Eo(tH*9dr>=hGNc+#bRGW>G>JoW%P zkL`2X76@EjTy1BS4Q1tbfFjSl!@%%)&>iW?QD|GXyUod;Ui!r<*a^#R(2*8*G6T%JowR8R(#yDC;asBywDwoUmX|}Kv6BA%VXoNi8si~v9s+mn@ z+2J=Bme#U9y&ReRGRSs?bw$^w#ePN!1SYbAa|xW^tAs2qD`azt*e9OCKG_X z%wg+w={aH_wa7Ie{)$n0I!=A4lA+J0x7t35@ zM~|?m7~*b)FelsUmpY6r2SA1vU0Y>7eDfBp+_&0Rc2mlmdYR!M?u3i|0S6y#8s^3B zv&W-#LCg!xiZ@SQRt}4!&3t^)^`1$OPhRj`UJ&u(36t0{qYGsgUK^z1OqiJZC@%e= zB6aJ|Rru!9qU%<=^I~$kiI?@m7UMmJOXvz&8L!{{OofTqZd)n|jLfQ?uNy@>yAP?a zIOL7rq0fw9WHiRS6K(>}{BsZFTTSAk)`uS5CD&+oHpG$EbVjvN`JZ@Fg|8z|EOy+> zRxr<&wk}tn#-(7TdaXQ_UQclzJkrSK+bHM3RO393JKkA7JLy#@{_G~6U-GE-_PnD| z$QqF~E`q5M#T!1ufDsuz2le!&HYyKoSx#GoXf`BI%(>NqTV}Ye_JEqvx>oEO^Sp+= zM7L$IcV1x{72_iWJx1Qr%wLtm>Ow7Vv8K9NV~HU;#@TJ8IHf|&^;>?JK$;@4=qs*F zUOnT27{g6Q%MA%0^ixlXZ>P^K%CN?6UHH&K#ro^BF&~ixyF@Xk??T_{wuK_`zy&5|J?JD?($GK+iG}ATv5^_xP}yiWYBn@F#46ElG5!wwI)v{7O}yZSt;rPw z)>a0B^$E*`Yt%C|fu5W8bf4oUs)9qp^7D!QAWWkD*S$UpN_VeHqE3|~I6dBw#is|T ztM~dOCRUxhPBZD|_&e2(akH~D5?ci{00

aZg-t^>RQ`zpJ-IfX*?B^ngahwFQj5<_1e-8J&)OPt&p#= zySTXEnhgO-n3tJRzW{AlKCictPFCq1yab<2c(Z^BQruUX<1l$AP9Ig<=vhwkEm8e zittl?DJU>M;5XAM9iw1IwJM@q+b zjP8}Mf>P<~?0~8XCHX97Yekr}E7_xid99@OQ8c^bU%~pP7rrsQaPy`P$=0N0(*#yO zr_3(Bs#OaXe+#D4uZ&f5Nj8A4Rey35S1)xWSP-HD? z1V)@tWMD`WB7CiElnBG@i9-w7Xe5)bO5Q+m1X4X`2RoYh=E9cqNhuF(nG1x74wWRv}ZR(cnB{4V>z6&Ocu!~S%OY! zb)Ngh?8^?A#V&szDh-9sOOt)c(H1Qzff!-^J>%%#y zu!B5K0kH!{6^{3M9z*w$96pG|ra9H&+jL@0sxaSMR9E=-TW8%D$?18ZUaS{+*dqf2 zo!{5G#Bgdw7n9*XBd_`udhq}IBiOn*Xo^?i1H!JOd1NStUtF#fLcF1>;aDGey|ixw z18d~=%cK#BzQZv^b6)gx; zeOppt@+xXM>!>ppSPf$JOM*tas%shRBcABJ2iYw))UqOUehv=2Mieb-2et62b-4n1 zUvpRY7nmY^Mh`tq0o_jZ7-92nr|(LMJT{llhZ;st_O+04BNzX)qu?Ua3mj)n<-SHDNMwcFdMy=BE5Xk5j2tGOZCavB_IEn9f-h zpLdm;n+{bEdN^F_f@Zlo*ui?7xuRfSS7EhURDSTcYpGsZgGaDJjRP@71XZF68elay zApqVu>F@{4MsSr(PDsLIR@Lfb6N=b?!NaJGi3}m@R?9qENX;EuHLCv z!{5nKWcS4N!OBU}WYtFyLy62j^>+{_F@TXA2w34gDbqQcz&m^caFg@5fj$=w$L9DS zbRCo1w&H(4ZrN!YF6WNVmdJ8#Rr(fNr23j|`^vfLlNV*2!n#^m^}WwyU3|+@Fd%KP zmI9B;QWxK$uzIW?Sk;G2xeJN>R{}HLex(z|(!*^W3Jve0xu~#H$o!B6YYKA*Ba9gS2BvY$&n)D zRc@kRNTYDIzMCXZ;#UEap%xKqrL==ohoCtBZNnm?0q$M`;ce1yv%YbSCQX(1L~s=H`a)t>ol0sM8b*L$SAR=i@&NYXSzz$;>DhWW zpaK@Gt$9ntS2y&lBdi_u=3Nwsu=zfS9!~A9^`SmWxtUCgJB{ggzA39A zA^f@;MtQ@Io*X+=57k+OsIj(8pt==Dk4S$`ueY6vDpO@*f7z(Mdv29QmC z!S+2;-i{E@RBV?0f6ccVyH2lD_h(LoJP!S}wZHKsy>4yrosT=3XmA8&w7K?8RJLDR zwQa=l1=>$Evi2q$#T7U0U<<_;o;&QpY8C5uh_Y+yVj~uj-!Z;%7;a2W_sa8`vRZ7` zSnnm{`$Eb)!#Ak&wqcSTbaU_4ps8|o!<5c6{VQd`RBGq+i}-KyWY)HSM31i*yG0?y z@DEMt-CBu*=gwWw%n5twAAQ5(*~0!en24}f{VrOZIhks4vt~?0SwjLyFy`R!K?=6g zrxcH1aCfz=d5t++H@fAbMib2uqNV|1CAkL>I~@UkGm_k7VjOv(7hYk2%<7m~F9uQJ zF9^LmJ6q2yYDf}pD%t$~HI}s3@4`Qth{t9Ej9sz0wvZ8+rd&YdGet8>Bmyqi&J`ZL zSetybYeI8s^$$FGpYJ>LJ$&FjH_MEmr8N^4h2ED#^}!pXoq8tTTiUl{l~Am$3N6TB z;b@}fsq5!zz?W3e5cH7xdH398h$~(Ar9}NyLw!tNol8j&R;&=Qqr4CW1Nfy0w{b}S z-3Z17dq}$_-(}%J{k7~?-DF&M)#13_W9Lo|?S;}cbY5y}>xfry3?S1Ompo`uL~Sg+30r%F_KAb4t@`}e1m*DD{}V>ToPiP&pMETq#bDYC;B8> zeo9C}HgP_qUFBpsd-qwr%VzjcCi%ad9^)z;+~ha^426w`2G_&8-^qmNm1ydoUtElB zX@oO*u>OABfgW?=le=o!OtmU2+B*C}*esL(U20FAZXf7_sES`DF@484u@|aH*XJd8 z?^)cXS3wgPUnC*YFh7^iY#dsk>^YN_*}Aj+!W};&tfSpwL`lCN?eZ-Dy|7TN@pv_2iI_xtpMHT)Zo}fH3)1U~D2=Xqu_#w-@Ybab+8{)hmy_=aJ z5w<0!d?jbxn7KumNh1(-G!7mxv^2|l5#?pr!czH*lpRpwyEU=Ta;)NI&+&!%VxcVC zkwNPZmQLH2r0G7cG=*LiQZ6KxXB=ojQ{5ya)XWr4J1R#Hj-3sE^h7VX#!1&@UHl5( zk!Psmj8#t6A6IlsQL=U(E0S%f>KigdxV2RPMJ7fE%{|u`V_xgQN+g~$Dnp} zo_D`MZ~V}jw~p^*Xz;}XnYupNf>yqq97)6&q}Rhu90I!jL40iX6U%jZ>GunQ1srGh zrTQu|GBP+c>o;n0C*aoA$|^1bN#p`U#tqxr{EHha0Ook-ny9}QsmHMyHAr8}?t6Kn z$-T3F(0Eza5as^|^5Y7!BpHGyKXhB_gy#aELh~5>ji`wVIP2|phU2X1s?h1wXln$L zb%US$K^U2dbN5NWPMLSIx6%o-^~?yES$ExF7b7pIl(7T4`TB?3`j13@k(Xs_1BPMvJA@wXc|)L8Z8d$=^T~5U61r zIgrv{6MKyo(_qgKoqt|Rc6g8a5_jxo*_YmNZiw$A)%>NtK*2`Dr*b#l;+`!XAn#k# zgK*%ai&Kn{z}T*WRErE^!?64!I>1|!lpobAB86?@AD0F!^!&2GzZoH+!s+XwJFXLx)-h@`s9GdQzk6#Tqqck~?uBK9pk`4$E3E?5_Qrk+0>4 zF6A`kN(+%WYzAZfJ90cr#Kmn5I9N_i!)@AjDY)CIN!;zz75(2BdczyI`i;;HRZI~K6U4>)VT zCrebvwg%va?L?W)Zrp9uXb|E|iFixp$LV5i*Sm_W%#6!Y1+D7LEK=grJcDv>_L&+t zWz>;5wtsBpqg9Kmm#ts(Z)M*N84IV*rwnp)#5bE@Ij26QO@ETd!hD%o_v;lAALo$q zMBhA6)gIYv+nh`zpt`Sege1xK+5B@SPi_GAV26U)hPdZRN}|5RST&u@76=(8 zAZ}tmQLk;*Z#5aoZ~3m6FIsh6-&$=~ZIb(;1d<&aNuUmCcx_FC(Ik6gNV?>-g@x(^ zEYLP(EYcwEcHCroxQ#AsYuNWZ#CxlnC*398Ltq_plJz+`Rtq#s~P`I2>2WFJR zRT@Fpn!h%Z_%dxVV}NVUR?Spzzuh@UCrX~wiM!ia6`udL0g4K(;D}sEiYz^OOEZ&V!cPv< zebIx0;FN=aF_xM{szwnV3j9`H(7Lj^I0D9xkYysPVE z$BYc;Gu9b$c~k*t9Jsh&l!h!-9DYK0=?cX)1Izh#NtUuzt_wpiXcXy~&@^z)6w4fj zB&SV7&p#OUtAIeLf^X??S2LW|+A~4TCy#7iaG3OnJcc*QQ1WMW zyE_8^*AAr|mLuf#5}UR&pu7fQuTyGp2|RBt;-$@b7NT~DJ|(AJN@AkbYqC6;ujJiE zE!n;c*VcX)ASZjy^a}P#sGe^0pXw2HDUz=@Y-Ttmois|vpVIeda_;suMp(f^KWa^I zg^ME6+D{&R_TnKJ2K+-aYkxswtCdS2?*XJ8l5_#(^O> zOZH3;R-Qp_JhqaM?6%I+J(R|wjkaL+bRZV!w;d!@dW5YBe8Q=PTp8^O#ib#ul^2Hx zaShTAS%PtG?H+XdByMq}Z~gaY?WMGB|ln-D@KYiHevYXe+Dg(8r}m)e>dCtW-M zZ6-SHnamlSO2Nvpx0SU7cp`7d$5n6+L@g}dM8n@%kN*IOwri1l&^rut^iBEot{tRO z7lc)+o_)m8)OV&}J=z~{uNN&W5xf6&a?d^CpuN);UehA%e-&Ga_0J&qhm$S}L+kmu zOQiSTb8`k`Of1#svHvWMjLT)Cfp?iyeTdC&@bZ6`X$`KZyzkrRISG6%Ml({eY0S>* zLEI?;Ut)m}3$Sk%Cn2rAH|q_U$@+^*pIX&NvxTA;_J^{CbS={{g}&5pcyYJLxxu4a zEnpvw$M0;eu|x6xRDBkB-H&Qud--ItmU-|}i2qZ|`_%9*kurqBYITSu(airsf zFNuj^?~uC-eIOODyMUnKdhC5sVqXwYZ!OTExKgj` zz_IMzEEP*;D>-=91X|X7WPEl82EZAl@)=Vl;aKiJgnrgBC8yzyJN+exDl96A3B-9& z)RUSlAyEG`*iIr*X~G@>i=&8YgwP<1FkU6v%>;u`opfFBC+29JV1fx9>+&c}|5{f4 z%5?@Coj8&B!URwvA9V%u(`%8nkl(_@BPMI#Bi4voJMx|l_J*>!YI{0?BsxYww#|@{m`08#9Exi zgzv;7NIgGYaO){8qk^O01!5npdw*29Z8GCS$>B#;8==_3qA9vbw9;{_NzL*0`62?w zOOg=Y&9v<&bDAkk2{w!O;mP9u`#~2_dT}4F*U4myN+FU7q0Ob8FT{dMKOt-JI_!!n z`lUGQNhNfVSLG4m_pxj=AYdrtx!P5lknt_hsh18>>^s9hEHYi=o4#w}wjhioQ&(Or zATExK09k|>oT-9^1;RLXkA!eso(G`rx|mmC+yr&U29Q_s*%f%-GPZJ?0h1#)vXX_z z(`wbR-S@5o>;DN7?Nuysw62{?J8Y|f27NXyMqeJD>17dMU%aRYxJ(8Uc72d|`=?mC zyzQyaGF$s*XCE2}lY2}v7x5dkZ|900^Z8I3YAq=t*i;gB5sg^e7lr-~4;ObtS+T|v z9OJv$^3GVuXlkvJl(-Y|pd=$nIw+-V-B&|GM-juRJ|C(SI7k&8PsRv~*1A3`|^VW%ID*%odM6-#^Dh~qU3#R*1_~1Hl2DAO8 zU||GtE#s*jFOd~LFQgX*4bIFm{S;lCUJL3OCBlh=hLw(6hO=t+LfIYEB%M=CzS96c z>CkWFTc9YDig<&o@1QPN5&m)L#*B_UkeGM%X6JgF95g$YxclR! zmF?wLMZ%OZ2y}W}8qsglV|M;2`1wnz2=tMmZj#g3X34I>==17GD7ad%t~KAI<*CT7 z)*-UnFgzoy9b^&t5a8U*F81L6RogF?+mss>Eoeaw7DFu^4@$nN?u`9e#jjQ0x;~Bz z6Y}#C6GOCP%ueq~oTjP*n;NaO`6pPe0+o9xvZ;&`1}eViTQK8#0Vp|OAdCbUJJUjBtVBUp-FBlrb*;oWuvGYV%ij#{l^2 z#TuiP=b8!*MZ|~&z)G10y*=p02z(~A(HwR`exG}l?NTOjYj75eqZ*Ks;|ER9wMc0? zJNZQV$Q$sj4Q=1rvHpK6RIRfF9jPDG5K%s7qQ{GT9)BIq4l9foZ5bl3XUxm-cL

  • BTX{Jo zy=)VD=#9yZ-{#{zAx7{uThj5kCgq~FyPLMV9+%qU`OhX&^iUzndAf6aEx;1#F!G+k zuj7;ho$IR+!rjSsi^1{TUv~Xi(N(86)BA-&V95slkku8`C?SAU)*&% z?-&e_iy*1&mv6S2Lq1*(>X_D3W-GB#dJ94`rSK318&oS+|ROCR!Nf6*3@N&IWt-Er!xBpz)Iqz z9yn%OZ4a0jS2wPA#k|$!h_j;{M#lxPeGGf2Dm#sct(i+M|Z!TqK@(pn?b|tWFlMh zo{x$^43|jE)mtB0LxkynHu)Z@bv80pA94~b3KLzd2$M|qDST(z8;P|)jtYCa|}!M#*m5J#K%lW1fbv>TdE`Wa{_M9mRJ)_upj7tqmb0EJ(v-y|#B8l!qt!=Y?pL_$w}6_GN(cLZLFU62|$yjLbb%+r%nWVf%_)?}R(1inQu1={SHjVIo5t9RxC6TOE0qjj&LP=4q+@Jzxd;pk=%Y zq3dQck+DVVjpzYhT#1+Rw`Fob*fHPggp3PDU&miApKEyFbd*ai z;&k9?Kz9TSa_sK&B)tYABZD!3Wp*G^@%e5jtP@H(!%0E1h+a?Zk_8dBj6_8$Uy(Xz zwqi6B5J%>MzN+dKA#x^brTtdI*Cmgt-z{58#MneAK_^0+!*k~rx5s*+K@H1A+8Kot zyuEu5Mw8&~;zpp1j(rH%>v$UHHsa2u4eKHT4}z$#oK&cWt{LwHfwIW!AVC6ESH56| zMcnHW)4n_)7(Lv%Lvfd06Rzw&lInr5tAVEjMtInC8>={A zLM&~R^20Xy#eYA}nhL5;4S@wd=+&5)fO@a(Ljq`tFVolZ)X9XUg=LTEhik30qZgR2 z<>VK=#F0U=%^ofz<2&3yfECo1kXX9r0`_9fHviA%g*rA7Ax9JltQFDePW`5IBm4xk zNNAKpVe?BQ%*gPyjXG?-2;_h#_Ke2PIOIh<@j2HFq{QlqYBMMml&$I?IO|uO;_r-K z_!r{a=AsUb+Vn|!3`*@tWXV;GXWyw?K!3#rncAq(=BAFmvIMXgeWFfxE<^UP21Ux$ zNqiD*2rbQiV~cgV$fwuAH{~mNDA`aN8iQ7W#?j&bQ?p0_5gzC`3&bd?{wk|cYu@60 zt<=K*mW37vkyb>63OG6*8J8TsCtg6QNTRm9QH`N~UgLG2*R-RzO!nRiW6epb5NQ~c zXocAqC?s#F>(A?Q_~zcAL4CmcAG8)ky)nP)mwu+;w8}r`I^)E}rErM$|9PoC;(XU# zXumT3b0&7YS;#19G-OGC5j_z5*pwO-lP#_P>dOm|mUiucF7EWrr-|-Y=*^;wN=Vlc zEB08*Wg1L?8y~a8)%~q4SR7=Ctnq@_el8|R0Lnj2 z9YgOE!$v#g+tsp$Q-A70ZyF&VJAhIH-}rH>jEb^5RhvNg7KGY$GfVd$!hXhfVCghm zt})6^c-U1g)V+N}f$MycUvH0C=4Wv|KPGrD1dCrIXM?*Cf|>J!(r-{EeU!s#)@3NI zQ%pqJR1E1hKdbh$8v7*vX+Ssm)!?wgW`W+-Y&`MR z@t=N*03cy_9tpZ?Kk=y?-qrKs-grd0L0y37U1?R{n{BV#+|%y^G2})kqentR0=Ssq z@%!cas{-L$GoQ;#Sn{s=eOJ)j8{or)apiVa7`GK{fVy(1J5L3@L)~PJTAEv}_D%*B zD@*z_4zK;i$-DV^J+Jp@!Sp>+7gy&I9 zptZ)tNA=`{pUO-ot0t~N3;vSLMa5W;F9kyY22)M?xnljO(K}VDd3NaQ;_BFnuSr#$A5=SYNjC z$YcIkU$wz5fK$YAlj`wLp(0fbW3Gaz2H9j)%uV4MYX@yVBAx`-b1BxeFK+EX40R^3 z)q#l}h=9$s^l~~`Or*$h*L8$GN&vxUXvK!6cx}}q&PBG)Ce-k2OxoIiF5&05y|Lz} zN@=yt*bc#L+^Ju^kz6D7NKF&g3)IrDc?`7c@P3bdpKrS5XSP>3D2niIMwWaS;X-BQ zvW2eTBZQvcuQy|#0aByQpci@RH8xX>KvCoL>N~b>aPXaRFleK9CaS?i88u$0AOfvI zCXOWgfD9Kp@APS|VfkzJ)OL=w|3~`10HKqHnVf^Mf}U9O$IFQyj^%5mLzI^vLuv-J zCqFl9jcNGkq&iuj6y6AabFfnYY%_?c|T_LQ8;vSv+6tXLr)95cE_o{U$4sAzN ze1%#T!&?-HgF0G;=~vLC@%0NXy#Ykjw92d9DdW$x1kJ&{M=rpV=Eej)4~SNTP=``> zFP?N=Ud8rcLy@xamzdXLI*x|w67pDrGkvG7Na%`SLm5Y;r=#0K!{g<+ zK3*#2uG6G1!_@!SeS|mL_X=!P&SBQGlX4GsDEwuy}wg~Aed?XIc&si8eX#Q4iJ$HY1aqOPUz0ukj6Uvg6(Ly7fJx7doGjx)$PE#7ZiMB_vaF zY_O)@7qk%+ZtMP$m?lmqVic*N4u9biGa2e|nh?PmdXcXg(9ix ztRQioZQ6}8(TAAiM;)w9oSi<($XSJo zxxjnDlpKJ^Xnol?9<&^6ExWiZ@7YQx01UT~>0Qd>-qUV4r{_FOXJPmQllbtoDs4{x z;v0xE)l%i&!+1N>uPeGq`uVa*Q`yV<7#AK-#!}O9^kg6pFIvIqM=b3`N8`B%U(`g& zkAsI0F^Kk4n63;5T#&pg*g!zkm?*lMuF`LQjLrqq27_2eTEcw?IsUQpc@z_=XLXTp zx9$nSI18@V7KO8!+kmBaA%?p8J36o)M@fXT##=5@{bQP6ZRziNJ23I1g~aA+blR^r z1(ZM>;RH`5Drls~NU0pAHuR!eBsl(tuq^NVaW9R-vW8Ft(9h6eJoS(El)sM8J>H}W z!URFdPE+iWOxh2IhCVc4Jnoz;X=wDW_Z!QT%PH&K7@$Xk%|jOUt5UVKwbzlNX`)te z?1&uD4wsrW%Qs(0QZ~0_}Z%EPE`7={TX6?mbCq4uFvdc>+MQ7V% zIs!ei+K=9%Y_q?@vs!RFRtrA;TSb}M02hm5J5BAlIdBC9$9K$F4 zvyIQ|%&e{YX7a#Ri++M`FHvFsY2b(#C?gKK7a%!~wpw)UEDOY_pbWd@!z`$R$dHCg zf=1!?h+{WSrDs*5iwV@fKK!o=O7t^55}Qm=`0np^v`s{#5ll|H1!RfxHvx1`-Z%xh z41^@m1Xu2%z~;l>J#prulx%7dw*;NBP?Pe0gqf@il=TP%*Xt;CBxud$AryIak}raB z328CG%TNcbjJ@laWYn|!)wbQBmVm63@NA6>YcidK$84E>yqSMAZBW;$E-A$S>-^|O zQ{H7NHU-;l`xS*-3DJJ)r9V^x-1!Dg_`nMc&vRj*DwayLMplPcB9X2yH7)GO7zg= zS0!~OQ|;r^0&fCq|C1iRM?!aWT1;4t1%Wv;V?7?Xytae3;&8YTdwyvEFpd-P)d)@W zY8=o$^h)WS{JQ6h=M6};y&Ojbkh}w0O9ANeI_nQJ}5kf06N#M za=N4#Bi9>+4*F$VpeV0>Kz+--s1f-4=Wto~bte;LW0H!I*IrN$i!zM)JN=W3peuYR zR@Oh};zNk3>5G9eLp&x84z?duI40%1&l<(Aa+ZW4WJmzF#F=xBg9|JQSqn|PIx6E2 z*Z~Xh{h3O`zOU}#_Mz3J7n~BO&b~w9wk`S}oSd>{?Rx^o;uiAd*_&@$WM}13$y02- ztrWzMlI^O*-#(!F@Km7-3pbb*moeDIQ#3YE60PiN5PPphEyv-qyh{LWzs9%S+hlxS zfV)}M3iv0ioN`4TwQTp(<)&dA@WZU3>~XJ=D%k@hwWFH_6sng*wm?^&WAqC4iu%b7 z$M{RD8(daa_K>Q_g|-gBE*rqqyD~NX^O;5}b~Q~Xn^zCh$43MW3#!#t!^w@%j<`9~ zV_n^qPb#xysF<2ZTC>{r77AmlWabGoUFp(W5+&}WfdZ}4RPpVQaKMK*7XH=X#O& z4f48(wF9o!LcwU!P-b+(^<+>)V0WC0lfW#?d-{JjC(h(q0zsh?lzpoARyx{zfmJJ?o42_~qKg1kHQ9c|NMD zb-Y>>Dj`f%odQX92PbPnnuprSr{&ZB+Ci|%t4#Qp;a_{O{2|0V$eXXAJ9^Zi;e!v2 z%@AUo3t9eIW~q3}*hh_sM_ImJg2pvN-HwKLe9AT$|I}tp@%+XV(fy`MNg8c#ew$pI zyFk7Cv6BkAzQQ{8z$V`mD2{)c+LTp!B&35Pu)nKO49^}nF?5G6|NWoozDA_}X+Ulu}|scy^%h}OnY<=BQS^OMVL6}iJD zzIc~rb#Ao^aA;mE`ocIR`yv)z&ZZzY%2Rgw*t!N|60$r*7`-BGMBqV&;hcH@IS&8m z^u1j@B&kUL(c1#s3+;HAKrec*{s*(Qt3(f;U-tM4{YJRxJPXiX;Ts1TTMae(y$%s~ z9d^DejBg;&TA$YDk15xm2#M3cY64NNvn@3@JPPayOaBrt)byW{mPPn2Mr6(Yix?3yGcgQTL%;7PZcX z#5Ba>FJf|$=?nR&SS1Zcv8(hK8zUJ)3Ph33AWn7Hbjo@a z{;#$sdtT#i^4cB{whC(3;67eA?NBaK;GX6DeONkg9-@9Mz7j5NB+j%{(T&}=lB*Lc zO}e32L9zoXWli!cYh6bInEOFjlPe?HLS%KM)RlA^678>(KzA=7Gif0s_k&~JulS8g zrgPp%fa!ng|HuPbWE|oj24V-XV((F#cJe-3O9+8Q`!asTxsr``Hd3!v$NUgDY>>h$ zl+g}~^=bfd9{(=6k(3Mc^nW$G7n9n6^GQw#r;G;Ef8RnTl1O)gn6{gCuGW~0 zk2*gJx18oeCRQfYQ`CHTS}pt4g+ql}n#hFbgnPb2W_Mb>L9)d=h9IZLPE&Ck_95@B zq-SBmAJ&la9$_oF%ktpU^tPJMI#Uc<9U&S13tXN~24+BKz@2V*hj1gdsG-hpM@nBe zK%JAhLNIKKifMAWQP<|VDdF7$Z(IBx#!)k0qG0DeK=eGD(-P>W<2R?dfbF;>PuKQ$}&1k}STtsMAPO|N%>`icmPCd7v)XZ@=8X4&`oT0c4-;A!m=5`=>cWyr#|}-!!=>57|1V{!X2+H!tD-Wlch%N^2Fa zY_5EBgH|;cr7%BLpx8yfKpL@nT7u_F>|9w>6l3;<|(2_lP-iQ@)?A ze@?u_4hgQY|5|)zpu2S@s9{el?vEyT{>CtU{w7SQmoVg;0pGCk$lqH6zmNwopHT>P z-Knhnsj2S2Q&!$Cz%;IDJ}0lLTzn5Fm@@84UT{>uX3VQONNN%T?WmEl6P4O$f~IRJ zs}wOMu6NQo94N8p;xvsKkf>PwexUIg(QM*wZ@7Hi2ww=R6bmdxZj;e-zDgOKrU{KQ zVmt7;z*V5alw+YSEf@Kz68O!-w72vun#g%XJszb8u}d>ripS-dy!fQSgC_`0fHMG+Q8zzQ~e$6mw+55&XJOWMF^P?lxSUuH4PY@GlY(+7kRD^dRILH^=-*U>6K^fd>H0B_QRP=-Ta+TFe+x;^wE9 zvmah1v!G&IB*GwKcbyi|WVaeH8>!u|6XjnuhPa;BOxw8XzYA@BYRuDSfbg4GFmZ2O z><0ocV(zDRlo6&WZNsOv284`eT#vN|RwGMgTA-O)LHVAd+Y zj$1QxI!M+{WV(;FNUxRA@LBkH;N^TE5n}6#ap0io3ptl!0Onu$Z5|b+Uz?;tRh!|7p!V66|wU%$XpzS@`1;FFQj&6UlToo z$;ZREumrPBI+Gns79eCnx>x%z0unFE_=i^@UP=a=`;rv(rCDi0WCKTSMjB7p_gl|O zuqNk0MDa~P4ORnM+bV_GHKR#H%y3G8MA@vRr;Vhx&Ktk;YTJw_p^7~|U!*+9sg4W` z3~+lxIE(h#%UPEC9-N(_G}`G4OG``BVoaEnhQ=um6O;T|;V#sVm%Kusf!@+4YV3_d z`fCgDV{oby8gdQJTcrl*TZ9S}adU`P40sJ1c1rNyeuh%EJ^i)K*Ob7xFe9*B&RZHI zIt&xCuNprFN;WvGKir_fg6W=P(Wc*-DYNZKg3w8WbeXt)_S09kR*djuG|YtKigbFiII_~_4Yg6CEU z&fA=auGNo>gemxon%+h54WRj>`NwU;U2b~*s}SH>^EkSSPWVUlJ&i zgG|uvB1^-IZ17{qCkAF_A*WS@d)6fk2hm?|rPYG%R4X*JVR^@9RcJ1#P#lSBexbn$#z1el$J zqu_I7jvRs>(V$2sE)a; zNMjDCEhP(CS%0a_p<9jOZz0hgT3W-`_;bbYIA~4YWbLa5K{_Zl6=>NA{RUZrjONi1 zPW9}tR{>H0&`{cErwTP>gF;}Dnlv{l2pC^{@cEz+2N|4|RhWL$BJ1~5o;T}F)uKb* z{aJKym5sYBYhGns!eDtkH$IFM0WuF7?<|gJ*6VbOnbO=A#71<(xZ)~j-Joy;m_EU+ z)t}ixBZ$_W0(EB`9qys{D&I4x2d3DU!LOd>?+vk1L>*QK!_7PH6RLQ=LzE9ra&Yq*T$yewd0B0id;ef+gp{pa^VU`z?s?Iw)Xrr4=o-Z^INdnse z+CTJjmv;w;j7J`3;}p%{?~*|lGPd}LW8!T8HMkzVT;Q53Tnu-uvI2bSI4I3i?VD

    yMHFzrT)il`eT&ez~1)B^G1%+RM+EdG~#z zCbwxPjxI8>aBy>Ga-RpolNofq^V#>?24va#=UNIixvX^9*+tFMm1cB2_1?eW z(A$YR{Tlg)@X({NeC%}waY*plMwP0!^)`rgdkX^-8tpbwK>zWx@A+8`yVfv0#QzpKYN5AW0O+0^h~_Sethhd(Ol-)nU*^(L!+8Ih2?tp~SK>*lu- ztJlq&gFXT8{8v9|HLmS}Z*E!BzVn;tcVBB*zQzc(HMHJ9;RMw@IQ(HOxOb&65(dC@1BmK?flulZ2&#h+BLtaq7R+v0O5^7p{7$K6xp z!WW!Croz_3`>HFlljr=*NtppKt(sN8@5}d^@1 ztr35>NC_ZX#J5k`GNv|l2}A#-H4!+a&9lw$8OkNk8_PpNE3A~hFeDYrWb=`HvnTN_ z^M<;tZb#>*rOXqN4x_Y1x*qxUQhiKXOLXm&(y%Cw$`l%5M(Jx>btSu+&J?1Z{Yx1S#C&n2kub8GM^yRkbFf})dqpL-jC^a+!U!JkU+u!<)kZyM((=yH1@jWn?g2Ob*W9ZGmNzY_>ULvG ztQ5DUR}{MXDdc^0%Q`8wC5ei^vQknWmadx zEu{Augv~&w2mvjn3VxX>Vh#u!egV5RRvbbst=3hMQp)tIdw}&b9-TF`96EHXq1CpF5r1t0$eE z?3k1t*pE7#A5@2>Oj6(&4N;b`;I24T^RLv2%s64xHpIXSsYM#YM`ea<#sQdaw-Q4J zH6}WwrXW2NHzfpng0+MXD9w+zJmdf~lWMge0{%#{0YP|&84afoZ&Qr=brmMAAuK?98;o-fi!qGyF36jR#As)pQ46*s#vVl7 z+l_mos)dAJ07t=|ZhXf4iJ$#j|5iMpG~0t~nLtR&1AoWA*;4Lt2N9|-3A zUk%;NwrA!l7iQ}Wy*+Ih5D1_?xLSj_x`FKk2m$*a1?aP8T+$QFGLatg%?Bvm-_w=*28zVeiY zPRFfZ%Z7M8K0ZQ184RNbj2GYA>S7?Dw(U90uK%hs;Ln)x4F3o1f)p%M*LEr|TJ<4X z4an*y8cme`zRb@L3%c&`OJ9ro^K@mE_^bfS`|{=P8DeQyr{rZ=<97m8Ml3nMST$Gu za(;5Sxr{D~h77Z44Fzi<9B&meB8DGjM(%#<5HGK|*B@+OGfEw| zL|~KF?j*C}iaS=r)_e;3Xi#S(M!Dq{6dvsT?}H|>Z}*tDQcE5lZAClDZX7_? z(v{oAzA71dU9v@6wEY_Eg_wm{AuR5S+qG|}zAf&R3`4&M&z-}QQ-5&d9eL?6Lq4KK zOXM}7U9R~KT=^+BEqtAh{X_j!gpyf{ao^!$;z?j z*Pb9R&Hk2OqZJPpECiYz}{#!wIk1!1aNf zs$z+DIWdn+TZPA3wPVeq)gn1W*|{M!=quA9l?Pp2#Fe^n1>Pza*5tL|K)*e!53}c@ z)0&$9uHMMJEhOyEhZxldkYB7j6U9&d_?$4HPks#bOpdv?(N0s+hOiR@;D?__Aa&uq z+x=uCRh>qajX+PY(xOMsOfng3s^?=(SZPqfrN&BY1~B>yn1Oc(ZJJ+UzmqzigQn4l zZOMe~6_+udI9X|o39@ZtB>;MQq2Y>C!jWJtX{In2Da#h<6||H{5~f2qJ~<7Bca`Aq z)u1sE%B1AfKQv(BrPO#+9jM2f9y)ff*UjdUgfWz07sL{!s4^Sn{i$d~N*aF(m69s! z+r1ju4CJKT$Fhf&syD1qKM?hfZ#O#R88~tr7*2P{rSNgaKdGT z!mJvrLWzTJ!fhq|-RZV+x+j%Ox5M0lGWXbLb5qKvej6YC-L!k__Bq-d7L`7Mw$oYT zhrNcZd?~{C4_qQ2QoF{%)uZROZF%Dh!5h^?9P@PTYPD^^Mn~3BN9gxhM}b0&XIc$5 z$#oiB(^bJ(tEsB~@2frPv-)}Ow2J0V5L|K-;s)@Ru>d^92^=83T-8}(*I$={sSC*y zmq!Phpp{Ir#n3T7xQ6f2An zi-qIa!hvvZ5*5X0ZoKZT3&5d8|N6X5D|RCc;au{EqPS(yD6|9y}HRC+RY)CanB@oLTP?*i^Uu?#U zfvo0KII*8CQuIc$DJMd41(FV1OigLz!#bMx+x?qP#!MDDh`Hv6Z(4KG zWb82=8IYzaFi_4D)4!=Ou^nUDw(`Gan?MRKZVpGKKqw3NF@dWylGX#?^zC;J+;9;! zfzx5V8&>a*HW$ZrFJ-^Y(f`7o7yMT64G0uMZ+SdXzhPH>dNP`tgA%pS?9E zWo5!`JJw|b9Ed`nzJDx0eC9a(7uhN4-v}0#0Flo=XuD-8k16yxyzx@SCY`O<@T}p=k zJ-Kpqqs{sXtxxun#z=>26$1dNTNitv=bnVX;LYR3#mfEMym}2b1RmJKP!w`%((rU~ z8n@NtC;GQPHvZ#R_p1f(GneqiH0)Ti znsxeQ`yYrBsF>D8X;tl^+-9-MS@eHXq;Rj#+EpZOZR$CJEc}Gy7XIisvpa77Ju_B=JT?42C*4iipxV2-IESSnWLXH(eGsY7As`hE-4bQzO7d24_cjZvJq#(x^SL zjs!bVDm4DISWackx{|9XZxWDI8x0TRA#wpWe1zXKfyPmjsQ%7L{Fm`YYMR#pUHQ0Ax*(FWTVM}99!3GO3P7|+nH@T$7ID3M1 z#>(A0aU^(d5L&Ow+}&$oD=PVM24hpBf3i7!_P4xj;qXsI{d|8kh^Zbz4U#ZcG{KMn z5aEeNt$5)874ZTi4o8i0%yg)FJGw6X3;6@Zsf7#oLA7q)iS9QXJPd2n)H)HMQ*W6` zvI6C8tgT*?xS6X%bj~{2=WLGdSx)-c>A52zUp%p56;2Q^ewj60jX7VhdHZG?$2EGV zI=3t-hK@P2CTjogg{ga)jbt`snm>Ae&ZzK@l`=DhmDHS@f9QT_zo`&Bb625RpCbuo zEV5{57hly&pCl*qIVlE-T&=ZLy{1i0<+u>Z>%c~WS7d<|v388H1en%kD^R!G7k?!N z3IhO%{FfvpyK(GNI>~7`NJskXV>PRSL0S<}85BEq1Of!eRkaHCHUQ_kd%%eAThcVu zW10Gwd2*+1TQLfiQYsSxsFT#{C-%UB)v62(>EYUfNq^zubnu?nm)qGUMOPr#)xr=t7q!f!49ujrSzWF4s!E&IKT`vVq}kf<7zPKl2fVb->V8tz4j2vtR_aqulsrnjx%4SNh=%#%OdIiuF`MM(iJ*&;j#WOO59DkBLkI-(qdw+{HghPEv~KfVZN;WpnL~iB!fH_N zsHyh;jd{O!Xzwv}8^lr4eU(^Y|sO|qE zqoP63_om0bUJW1p{$)XDEA#JfQ*RN7F1=VATzwFM?nkGxcu3%df3U|VRDztA&vI9I z7nXn$HAUwxlgF@Zk3>;<99aJT_$h-L|3}_EA*`RDG~|IL2wN-38YNlROv;_6 z2~vMXE{orP1Z-fxz=_v#=Q2)`XrzNEC6v$tE$W3ksG8QTu`1*k3Ky`c>E*&UxUN0P zW}Prp2Oa6}HfCe(uF$gu(OcB6A-qqDc}j8~D>NM`IX*<16(ZYEs!te>rDUcwA?g$? zLF-dB&!xu?ICPK53}2=K6UOuHWmt|18N_snVi;OQvp3Xb!Z4-BoChf=*mF24&P%5N zHe>9Y0@F^h_*M_|SNLDJ&q9dG; z!BQKIEV+* zV_>2>ZvCjb09mG5x;MjULNqU`A2@@x0(1B=lvJ*v5>`xfweO+Fy#((9i;0Jo2_{sX zRN^5YN_*1KNe;eV<4G`0{W8X+hX~rApz)^bNA1gFM}HvD&lN97tBHyC%gpgkbtc=4 z!_q;xEt`5b3FQXrN7c%2u+z&a{*B-_^TKJ5#Tof(BPrIPNs_bJ>;Es@(wnaHgCl|P zuH2fAFsAyvqwtBqNrzxBz_M1(51Nk7&f}YXLQP2^I1(d&03duXI0xE;Tn(XZDgLe& z7)y7*3b$DSz{qV?AHh;zXso|ATOgFkzNbUMS)%^`mJ$7bBJY-Ne>neM0f~L`uI5WB z$_g_T{m0^ReUtkJWAT4VP8;4)Ni4$^AKNpW2A)I~OAxmHSWt@p`1d_--{KX!fob(M zfiPlW8wJ3dnPC>P|srz6P3r~LN?g&?h2vBTltH>ST`^sXQ#0|U`4du6bzcOM>GNhbJw*xQ0i$q3${4W9%9n$dMGe8+D zG)2u!#i=TBUaO)&g9WM|QlJ8^)Sm{Ip`4L)*s*1+INj+GI*S01&eBYdqn5XTGKKTx z@(fiO5Fn+rd!1h0L3_S`6SUSibDCs>-Mn7R>;VYADPQM_oO5m;auitZ{9rg@vXJ%I zA0U%^?cdL83z4NTPy;yz_3XH;bG>OzJI7(|FVbSn)pEFFFvF}#FXcHBn)VOuSkJzz z#mb}(pg%n|s>+K8tBk1HaF%FR`~C?xp0A=Ty7BC{;>anToOdmj`E1~T9VoG*CXlP* zAh)#cwhB)`PnX9(`JXG21x$TUAys4LN9os_4i-%l57avY>(k?Oaualnxd`4nlS`l|psAjS;|O69 zd^YAf5pz)|y(dMc%JN4;b6EHnVJQauYJlTVpY6)1yj3@>@u^ffp==T~Y*4pSCW{HT zB6-O&VW5iDrflpR5LTbg92@a8Hx4ls#);%Tc|aM~W2rJf88kjvO81k&vDBwy!6}82 zc%$Bk5xkoqifp}sDkDx-+Z#Q~YHAV`;%oyzG2c;#VEXP=yh?^8AREfubM~OdM8y+v z>Wb>f$ueZ)92IOqWtN2p0ff>R6Iv(|<4bWF4`Dx}BU#mD$qg_}T3>7xS!~?Ao_odl zri6-)+1^nP6sL8?RQLx1F!8i0Fn`4Yg?UJA%T}p9I_1%#A+DmCGo({5(5Y&o7vD}x zE|p-Uye0x2?{x4Sb!C}LTBbM3VG`*rLS%0NmLw;4VAT#6d6EN%ia%eWR<&RVNs(iH zp2Bir9?Y4l!XK}?8-r4kpYr4#~u zW>DeE$;rt#Gz;+3M`dN@|HsyQMm5=WZM)b&ML?-aRa8)VN4nBG(tDBKdv6huCITWL z9mG%sq?Z^VbO^oIgb;d%5JC$OvUA_hyT9*!_Sir8lQA-Kk*qc6nsd$bJU)0x=f{}8 zC$fhT_8wu5H-;mU>>pK$6<-p?zxrynkAmJ2-K%_F=e1~Im#^LtvMx*B;G&Vwrkp7Z z3$$q&oZ9R6^p#HZCqN|GS#c-eC8rtpWEwK%SYGP zN2uBq4tQ2BZV9R06d9y?K$t9)2QyXg-nm&ITQTk=B%5qh*>I{9!W{oY6Nv8Fk-Ymm z7&2M;MIlF7gmZZ;Y}-VTp->>ONU;Q2I`~(}l#kS5C(~E;ne7wYyvf8MZJ)0IbK3K| z?R9EmQ;sFEPfuQ@j1)hhJecTFd&%L_9Qnc$Wd5jD3~k-@bk)%u9jBQ*xMG}O67e3v z#1!f7zoS4NNzYSX7ydlEs?y+#bXCkKb8@yD!T*4U*KoyxSjocetf}J5M}?DawOmE9 zCls}rzQ6V3nxAE`6)D@?I~m{?i8SncVI=v;ktOQwR_zlp){`=QsT(PFK4SBdnne=s z`giq%>%J*atnWblrRa|&xSQ4ojr!F;4bpyE)W2)%UlQ4~B+@%`KIEOb_$SqS4{gow zyxBL!lO5ebrL^)|R;9pa-Aw%8q)9AwT`^vF!2VODcD7EXz$6?RUAIp>n#FW)CjHOrkzMOLktr36v0l zm6p^Rrz^Y!1=3@`$^TZC54DaOahr6hxRI@5O$HrOjpI&@7n`C?==qiWo9kM$WYU?M zMlu4qY47=_qQA$x1MkP@*#}+)x9bBNm1xg0S6K4vWT}uB0d zE@*l2eS;FjHy_75qmH;dsT+iXPup85#PuuRjg2rn}Ai=Ir#>cP2J4= zopOJuwY$4po|}QVLa&@Az3sA6!r&m)CLS3s`rV^AQZre3=jbmDW%4|Yvz%N-lkCux zSmce8cU*=pXm7_>-R8_N1crhK#$V8l@75 zIKQaT6$c+J*k-a29FNqTeWRt=q_>zezjf+N!OcC{twj6UrP3DG?gv%`$H|s!EAO@b zmU}*9@~J}h^B|>t$|L%CL#_?m(03fUwCF(p7{8u@XO@z{^t*oc66vbi4EvNkg5N#X zo->P>Zk>rKM$e;Nqep*{Sl=spPpfX5ph~#wNLBrutVe5``~1hK!k#3!(@yaB32lX0 zAz#zGn+?tiuaoS&v4xCT9j=ClZ)#)(t@Q_{w@OW9<5a7bs@9b0_j!Vs_|jcS>2#%^ zEB!w3-^qh6EVG^?bpqtk!v2UfhamfNa{#wtuClG`Q+vZ5!s`NT-?QZ2q=27{2-={tm6yw@EqkNE z3!Vbmu{{HkE?9s(c~2Dj zv0kUtj9^fF*XCQZB=e}Nh+L+jWf;wIojmIYfz0aNlUd6c#!PkE1jT0w|C(M}@mXs9 zyZ;yDs_DCN34X_BjJ`5%z;Si?(4Y5dINXY3XVQPg3`%-ZyfE=qkyLc_qd*dl!Y;UPw2qShj_!BBoKo~?bjTLWNiM|iK1IUMLHpVee2nJ42G|5J} zFEPF$QtWdvp!o6ZOZ!NK*VL2i|v;USeAbG!~Tu1c5Km7f-$ZD4nKz;fH^5k3keTpg+R*i4Dk8-&l_(X7N zDMo&!n&+86iwL23aQjBnG@*XpWBQyslwX&WrysrW+u#G$bcN{KW42p7MLL#cWYG_v z`j14VW)QuvF&W~ZskI_Z#XZN|Gt_4KCGp#@cBVz^Y|`h$3%6ey0`I19d-aTatSk2# zNRrvTH;Oqw_*W7YzR$!~KV*(b#tvfzh@@KbowQZJzNs_l@_alziS0 zN&eSc%iCtawdJ>xH%PI{Z^RsI-`}BOXC4(fbl{-}=(mqairrAZ87ZAl;Y37f^)18O z(fym)A$d<9qX60pi)9Q{T3vKZRedRv{r~yNbBL~ilD7Oq>9=CeR6g2#3HsXp?xOI{ zA=RD#vEXRU`?oZ+``4r&FibE_{hu|Xb(3&*r2UVpb}2y+X85R`?(R?Re-4&8;(j~- z%sY-kWjf~T9I7lJ;=ey)e|V!;6wX)gb|w6m-Rd>R&Bxchmd*Zd)&JOC6Uq)SS~|2}AtGvP4-f30`84fR<%QCqevkW2!_#c+WioCgQ<=08vu}t5@{>B~rr? zh&whNl!8BYKeAjt8Clr%*~ZRZ@f?L+pBy$bFI=+w;|4=FuHqNe>^m>N54BzQ9*Rmx z&+%;$|0B{CCp@DvVI$f8>mi#_(o03t{yzSy#xjr{FcQGrcl$EptyMM74%>8ZDc*2| zmk+<2T>~&-#2X%e!I7db7IzB(ja4Am^Xl4dWyE;M$;lG3jq)6BcoP76b)-cq3&0Dg z;`h}e0Ecd;2`qhUBIw1qtNp?7RBZ58GpQ^xNbr<5UKVNm@cN)UqAg7L7)cl1ig8{- zS=_rqdi1uQ86303+;3BJqiton&QAaN1@Fxgj7y6ZBtSKOs6%QMNw~4wFXm0G@|!bXVWdx(Js~dMzIgu_a~0L!E#BMP!zz1 zwhpd;+R-dYAwUKneVbGSKH>=9zkN83smjKmBpk}LGGXZgAyF2{kbX=+kJQOxQvu!= zKkRbdhKs^^+z$yxFx{VxUb={^8D^g`6s>J$soymfE|;-jg1z~y#q#gCa^3DC1W?B9^JBlM!kH9#D%73?;D3XF?O;@Azyo@n-F z2ynJIxw7Pq&S#PU2Ow+48)E3AhQCMEu%w^SHZoTJ0QJ3&W8u1w$F#(}dUTm?x%=-r zu#AIpeuPS-F~w-gStEaFr^8c}yKg1W?dapaA=8!F%y>5Qo|lX;E^eO^Q!vU=FcNFB zz}AJbU4W)fap-F|hBM}&Y9|G8?Z6JMH;@^jMO@dB2Isi6dq3*wL8iXbS=y zV64d-d_~uG-ZN38h78(dN`hiGvOU-+@4fG<274~cW~w(5Mw6Wz?)QYB*5z|QC)y_E z0O@hOds6WJFJXk)k6?Rb*_PL}{Lzl@#E-hY7-0VRJVsOwDOdG0nEMFe;I&gU3=QxN zn44uWmuS>*H+O@D7uIZa#lh_Rce;eb(3cTz$*_>JnHVPc8y}2PTzfF0DH59i^{+$% z2lo5jBvau5{+3}4p}Wwi^@27v2-2udbPk?h2eJqq$BIr3Ozg){*^s25$C0W~J-7^C z+r~8>CwiH{`Lx0PSJPo7bOrMx6Ke4iSJdfp})DV({aOMbl*zP8B1H z3XAlsgnWibmeCwJE+F^5Dd{b*@Tl8_k4>j}pqPc7H;8$VtS#R6*Xnwk3 z8^!kTJWemeXI|IcBr%%dO=WAL+b8LOD;yrYy+x)+jiDxVbCdr=p~#~rOmT{4Ym9*; znJFfgJ&j&aMm);ZB&nTQ_I&%{VSP2}!24I!uZUTW4zc-z>u<#fh=*79Aox3Wh6mB1 z(!9ya1j74o$A=KB+w_E!`(QdRp8o#Q>{t9n6RJ7>3V*eI@Jt^PWVqLO=6p!DYGTy$6-Ayyz%}3+`M_tVbDRl}?F6*co#z4or}^e5 z!-&6G>lMgs@L@ClWYsZ%U7H4zN{Gh)=W9OHj$`>GJQwJD{hkP!)q-w30b6EYSKVm^ zm@VO;vk?5-*1qGb%d1_Vf8uk~W-~_2cBNw&dq#40yYvwyP)pQzc)s1ZAw|qiKjD){`a1;L|#*~NuQV0$E zRw>&HE-Kr?=FcJntdT)dhk!Qv^Gm~9cpL3=5>)Tg&7?M3B|NlqtWCNai%?j;%%(WI zXig7XpJsU=*&a%;CjURFg_ySeKMB!h+3TK_sXH7HGJaX5rkj1n#D6KSHe4=>x>|av z>KakZ>3foIN{_Gj$#bO9^0M+z{a3Wx{-%?ii!ZJ!x=v`8qp1~L`->3I*yA%ZE$=#0 zBD<@cw(&oyw@17(0V{@GaRB42wLru89E1ZhuH}WBYUpZPK?xo`{7U&CFl4m-){r4V zGX1~O@P7^nlC;cqL>Aw3=KKoBk;~k!*G!zi9Te)T+j_`sA7nLi#DZA#k_$-bx<6D8 z5=^jJ-?)?;_|XOtL@YF#A@BCgXt(UnqF_+3M3=7eg`!+drOOz(gn{#pqYJ4vi{(q1 z@KrjY(@JD*_G*r2;p}x5xRcS^56zwvr$voBnIihoG4-&!vEsOAc>r&4o77#Y}k7v82IWv&x z8lE01WAxn$)-1!47>3%PJ3}Uh15`e-m~9TbnYHt@6z#RhYv4X>3lxfOf3j&STr(_# z^OCys4%w%H@T)KHeF-`7Rtc(UMRB`5(KZ0^I&wXt1xV`sEMvg?*ePZ&{z0GR2T8On zh%9ru6_l0XkL=glmO0!1ZSDQ9RY*nGKAXsGjy}l4fY^Ci!p?GOnA5M*+s-TIf3C&; zA++Sbh`FhP3+sX-zt;S!-JgPFGB}K|&=KtPcNY*LbZ6YF_d}+sO?QX{1z^gh2&&jj zQ50fQ#j(`HZCgU_TiY`inkUu@eA}1#lSmJ%}zKN)u#K~%vF*zcVyVos#c;|-sew~ zyS*VH($b{Zd`8@1X98T5Cr>>1rpzdTL~vzCh-Z(_*M?{+U8YIv7cf(MqmE$qvy0a+ zFG+(fD2+l+Suei!NYeiI=F>9!7g%gblB7*!(>hLw9ew}731|`isr-7PR_}|**iluc zC))H(t1fISrLYoF0^SQVQ}OPLRq)Zw-qRq|#xU5tPEgccWAtT-!@;la3Y9+aqkAP< z=I>@dsc5py!5rN`ckh>)u1(u7%~WI`hGSC@9eQ+>AcwI$Q&DZU{(cBUk-%`=;AEYk zE@(5WO-f2wF#Z9uDNvI37;2;4i~w&QqR~3r$NG9p8{9`tCk`J?LT0r7m^akqQPeo; zwW{kLR775ts^|qCZIE@Yl(>kvGFnbA9(Snd#aNBaH)G7-sUw=i+N2a7Oirgf_bC+vfr*55e@dCh!FWVGF?N* zYq{W|?b3dGk%ry5>5u>ihYjx%87Xy^;sdEj;@t&kNMyJc7j2D17j!gd(6*C(vt$t= z0s4lQKdR$@k@;eSsDF)mXDL$b1t^yPW;<12n}nd0)MhWY_mX{8W7&GV{N_Q-!9lJX zRGKRd8h5;zm1itkv#}I$Hv0!&>oD1L(M`_Ucb3`YcdLOftj1#7!>l2A|1{~TkN=K! z2|~=<%Cd1TGsov1acFDg3%*)R!KFIN9bq=@$|#-S?Y`I~^RPX4Tjgl(hJ7(=G=-$N zQWfx<}IbX-()d(Z;|8-6$ELFWqBBbWUEf$Lmh^S9TVXb9u)`-HdG;fus z-+sg!N4yQX5ZCe8&3Y0qIQInU={PGcV)~wk=JU;-2q63EKC-PcvzAye!L=BKo9iGu z3G|s9ni>{lm#KAP%3sVHAX#7_|7DTC&{kyZDj!)Rm?FsHy4A##XVoI)+ea=z?K2?n{Nq8(XRz0N7}Ug~!+wM||uW3hrT zcy1_|a91R5N>EwcC+WoM`NQ)BXOke7qXsL<-I=B!QP3nXd(6YBak9pb#q4hYwt9T! z(*+9)3}A(~0BVjKLyC%pe3F#cUt!TWeKp`(ByT#szAc5ZMg!%8-n$HnaIm6+LjC2v3e#7S?7bbie8RKNRgaEs#2WT3@W^WJ9Q^@KWKTv8#TbNxtZyT z#p1~K1n1mGkntOp_Ro`5U$Z|f8^Hb@T7$PVwgtg2%Yz%@rpsT3Y67O^D@^X+>11~w z3au}qOR&Fbfn0~ztvYQ2S}#sFC^p#+b6rGoPaz0YIZYGkY~{K7>7Y**%f;RaTZm`AII>c&0wv~6FM`qx%hGh1^&OOr3b(ed*Dn99@GG>GE1h#UAzIWV2NGsHWNZJ$ zF7sQPGX-T}^X!aVPn-mZeKbdUrQS#j(W2|={gOamIdRiqZ6c|DLW{t|d ztY+=WQ!IJbX-sq_X_=6xD`=Re-}y~O%{z|4>VZFbMx z=*bLc5t0qa4V4rf^xX2T%QIBKu291WEZiql1K=Afh^G3JvZ)4ML3dqNIQlp7UBGFQ&r2$2%cniHYl`BDYqAs3YedqbZ0(TKSnw|Y7xm@l0 z`FhMlZ5x3#A4YKS<<>}?qrmzxc61@jV)pgzt{bIBIy`iRs=AOo%v#7KT~dbRvm?@^ zlar%Frsn4#kn7tLa7EJoQ{ujy+*Yv1SsnszNZM28^SLF=)B+J{L zEUp@oqwW@o_iaJ4naiX+}5)QHoBK{y&|M?Ym2=;y%X{xgj84dElKl5O-R&5Q_ZYcB~ebKj*SCSb6OC;X=%Jq1Nc3 z7$q4e8Y+vbwh8k(hfT#838Q`}1Pe1NA>fDRGj|aud<~5H_W7HjoQL2LEn!ruCNTh*+IQb!r zIFT5a^Rj2>g|?iUfp_@eGnH_o(ga!i*JalAxsZNQvR!- z?RVh20l8AOgS*3KU{6`@**u8nz|YkD%+`Q4Tmy6Z;C>Rbn14$SCqn*FIipwzIQjm* z=x=C|#)s)su!x{LX4PSn`8Mr~Xm;Aw@td7Kw+ zKNh>Ag;yCwtIRxVA~3DdjZxb&@1JF2yFTT^P=Mv{3Rn(9=3(hChEx0F7KhOVtS#cMkH zomFWP-^lvKF=)-Nky^U!t63A${^p z{oDlTT5mM+5QGN&^>O2){_@f%CP}!?%5_L&x*wRsH^v}Z zS&@+7ZqaOyOQc{6j)Ev9&I-J%k}=wM6Aw6Yq-HJECO)E)Up=eLm7qKZhf23W>0|=- zXXKlGx6b3LRZ7Q9)rrlUARkT-D&)D8LfO3~cIsW>A&!3*TO|QEE_rVg8ljZ`eH_<) z)SltNZm0NZHH5$2Uc^TJS?B7#0XS73Mf`DUAU{d1LZ4QfcsY%)4^CI6oH4 z7w+_JAql4kRqK^{126Fi*@LE

    hwd)O&%;8%?FzhO5lam7Xq!9qS^4}uvrE9Y1H$PAMI-RvRM+W+>ylcJz6KbDNP;Ni&DG2`a& z9+x(^eMu>7KP)YDJ<-puai+PI#%jCYQX*fNA4&OFE#KmN%3-oC;PA74Yi-?TXTh{_ z^1{Bz0AoS-Ku?w7Y^%eMq_6I#f76_;iAf)eAcj zm7StX$D5Pi>VvvSQ%kSP zU9q!77U{slyXe0WA!muq3jr&P136&76P$T758_-6>4)<4*IyU2AvBGSU{y0a`}sdu&YYX_{>O-czkztF{6uK20o7VJ*UE;_DACIIKbk4boxTLIem zy7}^?!{@&dw2H0k$ zbAEGaxV!JU63bmYMC_`|r77QRRx*I>XnNFq_IfRgcrmVi1I+ntMl#^Wi{JO{D4WB* z?>xcw>yrhuukUK?`?y5sH*g2`HZCEZrvP}p)79a&nGV<1$)+!`Tyb;{SWe z^u^=jKR~{WHge`{B4)n`qShjO|9P#0^&lV>u$#%Yik$ru$X0u$q!cBy*mI$MIP3tb z1+0baW{zc#e)S1&aXL3ft~d-=UBm6KlWaVsbxqK6I5n9*t`L8+U1Tz&{?%iD2=BGm zD#D=?C0!n}jwJu`Y?DMnesq`~F!5=KMyAQ-s=pr1Uj9R7H{{ZIuoED`iu1A>7mRy3 z+BtZ-L$T)}Rep}32=$OzH98)8)}Msjybd|Zb!e^!jJ9CZ{nqP}0|0*`vCm&Q1!GAn zLHTLdrzF~`*Pyjp2lfm+x%K&{t&qtW5%P=E*&F}&H-CLI@bqByvf^uV0BT4&BA*}U zy`a!GuEO?=Kg7Y_`66Bu;BfG>Ge8u{9%^{e;khiz**wd-cY;W^oZv*Gyx}qh; z4#n(MW)MxyZIaBqtR@)~3X^PXt`4gGSWQopUeK# z3o*D0-hknvAY@r^W)@$ehSNSDb`TiMPvFKaE5ay-|oy^ z$3vPSbQO7px<34~2c1CT+Ht*tc>&>nqtL+fT9!)Y;2CVM;58_3p8K3XwVpSWxcl^c zj6%vohQa)5h^OBN9+PL+az2!bX5W7~`nJCvKI&?Ne}z63ME8vTMTVb#+5oFrbA4=^ z`A=BQ@SsHAy%Boa#UzpoV;a#I&Rwmn+6Y_x31_%C-Wdiqi@vl@-Z(D?UW&Yb^1MbJ zy@k!*-AUFDNo1a{vx6Q$hGiEHJom-DkJ>NtrXRhso5Y?*YuF5PUnWJAHV3$C)RTti zi<&Y){B{+A59^HfcabuofhhZC1SPMpX0G&n>Do%%aSS`*BB|jSJ$agGxn|BAi-8xc z0*d>k zfkMgB{^U|b{{9yxRX@-nQa!!5(O0t}640IUnf)Mujp)`{v05&nm_D7||NMj>X6bhf zjKu0mnz|E+5T$DkQFRIB-O8c$E)e*7?0Pm-8rHnmFdHl(6FpSEsYNZ&?62wgv+BXVxyl=dBwWXI){EH9JGo^EM%k2MY~tG?Q-Gk$oCDY#iJBtZ6Cv8R2ut=F>0$NHx%JkLk z0F*T{BHAsQm_G^CCxUkj=i315e(9<_O1~f->Wi#>_W(hfkDtb3Xlh5lA<+( z|DLf7fAGabg7ZM#>MH4FV->vK&E**l;oAyH%5e@DSlu-&%680K$ZchPV!St8C3UzM z44O>lI;%31-t^gu-}ftYMSvS^>P$#0rrDF25{O%PEZ5G#gH#pjPahsC)Uiu1YMDz< z!CR#E8ib&r{rT38Rqt-neV-EPfkqR=_(s{VsX>Ktvm1tBsTKe>W65py-f5==K^^Mg zps+y7JuIpn59u>b?aH;}8F(7*Z9lq`I7;OS4rS-Dkn!7s=t=7QKH)*+L|6xSSfcbN zM4D}^;T@AC0U1IUWX;kqhNPMQNrXO@OZcvr!X|#9$wt2)#0^%faB(YUcL&>e^MX$^ zxO`Niz7%}#4&EN5Scq5SNnwj0rfY3WuU6mqd1r`__RGV~Opf+wualm!?0nbws8$`{ zV*1#-{i$Ar`h>th4yTys$37*)k1~vsmxooi|Gmm0jttTX#oaj^IuWE45zOH*Neh*$ zR+0OnVOM{KWK;luAh*74|Y^6Ww6JPe% zJ6#2i&Z`CS`3K0SE6ObeYuMc_5=l1Rysy!+I1AI?Qx3J6om>8I6c!sc@W@3#py+o* z&?giNW(1BII+)K5upb?1*+vA}1P3bu^9)Ao)zzHA-^+Ed13Ez|(kYq8%r8FNMR6~a zEla69eDUDj8_MY0cTwg`2qGi4a@EG~=Eeg^CGjDKh_@LGbidD8S>5~CH)h5MGaaqA zmvhM?q=TvF;1tE*z3McvR@TAn)KUvxlGU~GkIOh@2PwR?a@@qNawDVkb8V+Gmyfd*(# z?|$cLpYm8(6NjRT-7fgDBAdD>wk4Fv8OjEq)48^IAVT~XmIN2 z6(u5WU&S?25%WD$D%~$=qd+;vdcWGA8EyoB&r!(R79?fSD>qkZQEZTPN1ecc4#fz0f!vXtjKFFiYB&-t?pte@MGc{so_o$y*?S*nPUfN3pkV_1B^p)NTz1kp^>wm|NJ~xA+XdSKUL{-{uTATec?i{=is7 zlGgg3;)s^@hYB;#0B;`Mp0h}eo)UCpU;G)}_Qa6N)X(n=xfx&R(Cfiu1TWgor|MEh ztH0iTR$>kQ^hhN88Itl9V}x1X@ggKDP;$dNsILDIvWxnnKQP~)&6U8pHKS|9x^c00 zGn0LGz}H?%&VT+_w{O{^tFb9k-Y(`-LnBya^=>ckw9ch&yu4m4NkB0>d(xM#aDRYZ zSgveIZa}mFjj3CGtkIFYK)vSXSvDBkBP>*7IA~h*ULhEwQ&%MH;d3W6?z0Vf-g=U` z{86uXa&%{zT+cT+n#Hc#Ia(3%MJXVT@yX0!1o5aQBsLPTz z;m@H1Cdg$?klBsL`T+A_)XF}<3w??gxw!Ph0hlZBB>1Lv@YMz&_$?7J5fM@4Knlx8 zc*P8KR@q;?!kvO;%U?Xqbq?hRr6`abE!=f$nfhZ`K7495CU+~+9S~aTS*1@X>XayP z?j^HOVw{D;abs|puWiD{%%8kAo+C0fn9`qzthIr9f-cRV*MK`5r2Hl4%#O%tq(VEc(1u`^=X?g_;Qp}xa{ zF#3A(RX;g3Cx0ci($rnID{h2pbk9nzA^j?qwQ{+zYEGm-M;g5wt{U;jZlZK@Qm9ir2&2})~32FX<3%gy97Hq!Yb4tcN2K;Dy79alXi*9BpCo_E4M!jMa+oh z{Y@REEk93Gth)%j^X=JNe4E3C8GQ#hWd~KocDmTDiFM zfd7i#?bg%ACuU-hHhPfrSXzk5@+FIRu3 zBD^hWrp1UOVa6fWFMGaD66ObdSD&z&qy^F|B_o0Oa^TPkGs@RorcgLLy>MS>{cJDK zNZqs|>3$;m>0&3zt@>7ocHQHI-J;1%w1l{Mi`UO|s9$*Upuuj1c2{rqn9`(WxcWDY z>qc#qWbpWrv4}(-weUv#krFp8!>^#9qNm~sI^YZRg7>_-j~*lM9m}!1&Tr?42uchQ z=Z0X!&ehkm^COAd!peFSj;eahzB>+^bP#End}zwpK?m}Sfxn)YqlR?lgHYs8icUwQ zA1pViDtaWT%(2CEye|ovEg|F4C_bmO?=j|PJL0|S-QcU;Tjkk1*7_=SfMwVzW7xKL zKk#b&@vhLoykwsD_{~E%SyFoLC0(~b+p&?arUI?g`LL*@u2s_ZrCqX{e1x^_sh@X6 z^ni#+>)zdVs|Wx0rLQL;4LZ+g<3Zwxl)yhC;%+9A5@KIU-WN>%W?Mxo(v{QIDb-Al zODJCK1K(Fq>@6eqg(SM(RcU)DXJ)Hsie+|+R-0E9Q`St0g?BoT5BczVIhSB# z7ZMrD!K`JTCr`g?!5D@@;mbunF2Xa6GX~D0_hAZKuc9qr<36#B{pV}W4PWxHu2Y9c zPFy(y%O$ZcMWF&gwKacN;%Elxz>1qkf3#n2B2m+$AjrbD6WWjN=d2f=Rt$;tD;I8AEW;L>In~n_GDewn*myN^)w~F&+MfFf zzk7$=dtLE4(?d_t)Xi4WK(KahF#lt5+1-c}@hFTsSGciX<{EnYN$b5~ll2$0!?ZkS zBR^*=XnB7@YtTV;E76Qp+=AnnrKFkjMI^O) zWPugGQ_*Vr%@vAu2$p(|0?)Oh2dm2BkK$fP!#-OO+NT^RF;ROePZ{M<`@Zz-{ecbB z(a17NZ9mOa;#D4v7sd}Ql z#Oa4m2hga^(8Ac5!}pLXZWUAH=wp*?RXHKwpzHQi!K#5Ef^y5Z)75UnG|=T6hOj!` zA&*o7rXaiG)mPq#iO(;V#>g$B<8Vn#f$C~0v-u(W8U;GM>DAkv6{|)!69TfPl3j}| zBuQDIGU3pllXs(JR~0S#OP;4++I@@t3c4d)Eh`!R$wFEpj!lrx0eaArFl?jOzbXNa zk&8-oCbx^m*}rec$1y_UoTmQBJVu3lR&R8JFY|>A$V*2R4z) zuZ-vsd%?-0Y+7~c8V`4WQ7A(q{j&Y)XU9CjpFoH5FLF3nn~8)k2?)@zh5L`rjwOqx zq28rNtYPzWStkS}D$0+(f%aNOUEz$(p!vIoVTP0|EX!;2A^!0xhj&`>gwy8e4X+ipu%lewRidglj#_FSLXmnyyxO>l8b02UZsml-i#o<@-D3 zdg;vzG?b_iH%SNwnY*l{)BH?o(Ga7sl^p{NY}K z_1>#M3wp~5e9Su{Vw;B_Zx9iEEI(Q!S=xyM1Sdz;)2TC@F|avPoJG4Z(7$0wu$r z3I(b+84b0`C@lE|*_TJDJ_>B1HGOJDSwlvGmF;V4DQz$5z8L?8+^=73_0laB-l7)I zHL7Rm?K-Vg>^4}%Dc7jTuk;poJW^UtuK(+Kc{-e?al_6|yS~WCoE2#MyoBl`5m11e$*+O-%8U)223N{RrNSS=VX6)Qi)!;tG!`y-?M_unEBrS>`@7Spg-Y)Q# z*a8Xavr*?}=){@uP-at%8F+jP8g}p6L~q&sAyF%z8a~OTl3cvKUz-lN%v0yc%*u(Q zV*yXR@vDY(cY9bL?_ebn2h~5G^3UnK9^LZvdCg$U;l}>;3@XwMQ)PDZ%XRg?{9KQv zV5z+OWNli*edEQBSBQZ~dMvvXz4 zQ8LtFTYhaf09B6A)+_#Y*HvU4g+FD`F=Q;#p#P95Uljc5oNP4qYgfZu1p_rLNAuJk z4W(0xU(l?bRKwYhOBI342F?_lU95cjiru< zGNd4LL7g_}5Ssa|QAMXa(U%XoPX@)&kzpp`FGRkTt%Q0twj zAh`A`y|oCfe{*i#nMZ6YJzG*`YWY;<-K;-;%y!;AFF5$44GQye@>(R+3JcH@^o?d7 z$)2SQYZ`-^fmgbp6*yqXdDD__@3CX7#mZlS;{c-DR(!-a9uw01UklrW&S%0WAgx}UNlh4b&0=hW=1p>Ug-^P zcX;?(C@W}`&Kn;4*>8fa`F#b$G)y)ia7&1#+xuD42d@v>KZW#N^lzlwVfLyWsl}B7 zfAG#fsGa*QSFE@!U)n|SK?1w#$6ABfb?pArQ=~uXUYHgC-T0IDc8;vgk1{*9Ozqz2 zD81PFM)ePI@o8U73Y22D{3D;~I}@M^$lrp@Kv_z$u1(2T>_L=%Ame1d((-an)`ll{ z_@CI=Svv=Zd#yeVe6h^muU9PN9b|FL>w@AJmsFUfPdE2zz(B(ma9ys-Z zT0>@i=FxfHharzyoo!d1cqgQcwC6VU22-|0!9wG}9oGnDS(|&L(^(b+#%$ki zC1>=zIt9?{6z~};&EFyo(O}qhk?rv>HPgBG*!I4;z2EIqNab7Wxz|o7r&q?`Yg8V^ ze>Tf(wctK<>^{*r2r6i4hBW-GegQw7ihmtvAHw+gTW5d7#8+fFqm-xkRZTdzOZ~hQ zv(nO*atAQw_c7#fOC9yoMmK&&G}Z(j4$+~WP#L_v@{a3??-R%0;l^C$4g}qp9!Zxo zkIKu+iNG(b%2x2ifT#+C@?9WN8^|UuH~pq2Zld%1M7`)%Kt1Ki1my>rEGcQvXdODJ z1a0JWDQ%5Pwy($G(ZJ1SivS&0_N&vhqL(!=?bo(K@IXT?n;3t@MCVPzGPlzjR|2VW zcdXC1PtC~Wm$%(~UA<<~nYz7zqu{24tn}N9r_x67u6 zy+)hOW5<~123sJqo{_^ohqJwXSgvLj^dR1z0h{5kXZ}0^J}VPz_}=u@-OOyx+unOE zW-2i=_Zaje4{N&1>`Ocvv(-+@6o)KKEHDbA+3OF2!opHI z>Z7Pm;)N1wrDdAe=Afe@mwRleacs3EY{HTF@doV2ug0zq;|Pfm+8Ddp=4QGM6b0%> z9WmUZA+WdjPsR7g4(o~>TlO_Z0WzVc?wBVulE>@Ta0&XV;hF%`-+VdpR}7r-4+_do z`yiM$s{f7>#D--C9Ml8pxe++#T>E{lvwrMh6+JEKKI)uTt0AJz%!rGTD~YE+T%f^4 z0W^vB8o?hiTM`|(N`_+a=Z5$l%j-e>=%q`iZvKS>FC;w?C4<@bAW*IGs8)1R+uhAW zm%(JW4wxk_8-N2`q3|osyy5R3<3dxvDwG9ohIIu)3<%!QU{=_pwYW16-g}(WCPk^E zw&-}c&vsyAEWqy%BILsth!o=~)wrWyXxFXtiKj%j2tm$peV67V#NT20jAz)+Cnt&7 zUFgSMrtVP=_8aLsNiq-o-#Bjae2G%;^x=Qs*h6d6+lr zBpI1LM623keZsnWuA7%;GPte=WG=yTNrB+PO?ejqUoQ3qB5~eJNgo^36ieusW&;@R zJo3@~(^xQ{-*c7y;@3>0#KD@_1_%|!i!yUF8~|S_(KP{7*Cjh_Ca8l$nv?eF3pob| zLlfL$Po_g*0w0E}8JuR-D0w1Zew&quw6@Ow+f?7NR3y`oBnWNw>l6rHJrbW^JGvl8 zo2n;YId#)@didbHVVdc?XH#a|T;UJzlO)QH2d+I02G;-ztxsDf0_$tSlMTSB&F8+; zCks5#^PKBy!?UJPz;(dz=3Wyd4M{gsEd{DN0iRlk-y`kb*-X&zZeHHF=@~DFBfwWE%||)$iz*8+KhN1Eq)_PsxVgAxb*t_> zt}Y*U&OU1H!@PXP2byfn$4v^RYX{EpGQ-2KA}xPXI_&J13isxUhF2bK`WBJ|(Dj6N zzAz8_$*$Fc{+PhAiA4b<-ak=1nVOZ(K)hIBy({z;Opzb9&Q0l1evCD_1rWd6PFNc4 z`awsxJWsA1gZ(?K##}TER=QN0l-0~L1?O6()}1(Vy>@$j9MnDEibS(M`?i^j{wq+3J4s4kuRY1< zDq23j`C=CEl~F!DKsuYlq4ln8=TnIIH^yK%?a)GG|G{kuk z1SCE9y*9ju9OVurjEwP{mF?6qd$pD{)Od75D({ZT08p}7YCdi%)XTDE7nH|J$v;uULbtd;sE_8lirqmS zXajx~-1NNbMK_qvC1hGe?N;a~4XP?hK8tE%V-`wX~8(==$7hP#ZYPc7BP|LaMb- zsi@d<^1Z)>i`05CGzYWsbF0VVo{db_8dED2;j+`|cw>PoTI}xR*1XmlT>2>(!*ARd zH{Sy(;%IBPTXdqQbAA)^ze2R)B*npzT-t21S)8A!9VRJ}vZV_a zHv^g{VIo{T1^&-2xu3kJmf|Pn6t0oQeN|}zBcEgu= zT)kJ8&f4;M4rumvFTuz*%_G+A>l7EB5Tnf6N^K&vv6o%cL|@fCz)VO8RBkd;FxUUy zeD6zZPFJ={udW3h0EyYUSjU$9o4FW;Qk~}(pnhJEBz90C-=tav{WBxAis^4seww_! zlr-`1*%bmIurx~+?GF+<8^BjHOm!aP1t}3SO)o1u#5UJf-{+2I(qzWo2b{PO>-F!H zX^|=@t(ryLQBx@qm7Mi5K-+uEC%ajMc3@iVAm*gM* zmCI5MH`46(^+)c6AP*l#|2nc8?Ywq=rtckqE4!yCUdgh+9Y-0kY&eTle<7QIP`cUM znJ&{-s!r&ckXz`c-)#XAVH?OQTT9VH4@SF@EH-qBWnN3Pv$sw0@Y)W!`OynPUz<5y zcY^4R7A068)g3TWpRXYGI zmOv?!`(^;b+`sE3ZTPLjG^<_DJN-4!Tld?G<>TkqROoB(}bJY`vdz zq<)?(h8iT!$`7&z(y!k!GGkq9Q^gPH>Ss3!o-P!IOpK&|W6J!Ztdk;Jz114Kh&S<} zGeSO>tRkvQ-rYSsPwhANypBB7Cv_dhYzQ1FJQ&8nSvge1nOSR39!|t(~R<{?jvdVHeJe<6sa_pn+Vzk`fypOjOzy ze<7l~i5dpcnbSA4yz8q*<;S)mYN@Bc99a_#@SELZEwM#f<__w@m~`(?3zE*T|mo6DX|`5c_`gU!FFNKI~ZjOEZ(8$Q0ZWMvznUgb!!62nc^i$gOFVxx@30*Drn4*{QJ@QY|{J`}S^wZfst-qfi zZWR1$u~6C`pE*{i;(kfYXfLY{R&`{h86=^F-5_AeJ}4p0P0ZydCevf68E{&yZ$he*CL?^pE^NMbkwG z)0ZR8JoiWzMSSjEYE5>Wv>~yMP_Xm0>;xB*S~<3hsrKUFw_h+KYteO{e&OrLB#fnH z=j3X3&GXe#Gt!FO5#$bitDcoCtxS{pDQm(d>Ee5ra_maHVf(Il z^dZ94MjqZ{S3T8o+9Uc}7PP%>;zREinnqV4lepk~+A>_GFNiVfH1 zkCC#LBACBjlSV4!=BEqAU9)9qC|@^wc-+jFtf+^m%B83IFAsA#{>-o3U=xsnOdZTg z>HQIsqY_;iDwruuW!`tky zdEmL-loxEP?%!F4c>)G+uW@F3M&^PVZ+L(_ImWfmMP&Er@pIGA&T?JT`-G4KH)anL z?@;op{t(z&pp=$cYPxo=U|gq2~L1^j>0K-LD|YtRh#o)^bIP93i)>LM6DM)`@aY zxY=K(HyX5^xR3r`k!z6BN-<-r!u{Jl-YMj_a1`9;W$Nnb_`mXAP6jslZWK3^tR zXx^=)3{&aI`=}nh7k#B}aDi5p;XyTfu)r`rs`(yuX-8!Zpo306FcrV`f-cg4BMWM| zedY*N^#6@x;CpKkt+^w(*}}nAy2f4gJ5u)p3BlWE4JUNg+k&wed=b%ys{2C3^U8Gw z*#E@{UL!YDFKBf~cG{;#Xz`ZL5oCn8o2jWn#Ih&&4mK@xwz9v4>E|eG4NQz-trx0V zaCqLI(JHh+3p^!XrlcV}JiL8@x_b*z2XO}}wqxh$^-R3?hR_0Ry-3jR-RDtTL6RW< z`a21pS6Gq_Cfg@KCZ=K-D6HPp8y9qOn4IP&b_X}ny> zO*^DzX5!G7Lbnfn*V56-H)kHy2Uji=OM2)9w#TM+QDV-8(A&6bJVowhD(J6U{6r&? z9MV7b?5mKZUTJeX;#qxTQ6i%6FZ70^VOmJZQ+R=DWXM2j+WBGbu(9{+x5RT_Ubk_c9~3Zg z7kwc|WR_Ef*!*9BKvFd?-?^qr@%i~I%1fYJx9qBBSLV5DVc}=-rmqKUE)#Tw;_MU# zg#;nGEJZ|i#otsrhtY!J5FUKKw$etQJK_N>lER_;}Qw~xjV6Ea+96U^(+zCQ* zDm|OQYxvH6PeW52vnz`87WvBD^(*gcub#Fs&YJYO`D(gaH43f=V;IQ0M zS=rijB6P@IEQ1&`y4lkklhOMq+?*jtPCqO_3)rs<=7fKuG+6bZ)d)|sg%|Lju-}aa zM6Ya52!q5X7X50KQ!Ch;b6vKISLi0BBLy3GI59TZti(dHRq2*ol~r?B&j+&SzLJ$- z3|xzqf`k^ew6slsbKXcwv@cMWV!gN4X-rPKNTH;MV`59vLTpAdS0_n%;o`eHf{JU!iw21!xm*P2UfJimqc2arKs9&G^Lo@34YBDKuQb4V7( zxL)SYJCp{+3146W%>JtwnbG|vYC^l+d3P!|Re%i?h`#J7lNbD9n4{q`aQ+o(CG2Py1Y-fDI?daGzW4^;YT)?e@PZ=Q6MW)>n7`n7dEB;_&at{ zX2V1tYQ>@x*=#Adv+!Mx39IZAEz0EJG=Tt-prem_k8NJ3lc4q@>xKvGyx2RtomB#r z&Mm$i;BcUwn_IlxMz#h>2jyuWF?Z*fEvPqP$kSm3v@~mtN&pV-fP7YK)azZkH4mNt zU}W~KbTN*8Cf>uI)s%ofe4%|jF(Sly<~T@4H9S?)T)o+E7M^a2z@G50Ds+^9&zKk6 zmA6H}J$GPh17nX?d8i|!Z%>2_Q+h(I+}YiDn%>rbV8-0%0g z8#}ej{CqEDDTeX1DW~IwiOT)c%~&ddj`Q}F=8>LwVhFfYKU$aMPFnp;*s;+XiI~|y zjI~lqZi9cFA?ig-B6fd$Rha{f9y5lk+V-4CLc!sdio>}~DqiZUbBXJoS}23oO_K|o zW%rY%ereKXoF5yBa&^6rR^j+TMHiGxc9q@FwYhY0{f-8tOdazzG+Ruy1rA7vH#5N{1}O8f7#$my_A95Jz6q>O~naLQ`@A$op6iWXC#3W_wsL2ySm($w-T-)!=H^ubVyrF zmJv@Hjy(aPw+|?osgh)y_hbBBzLtj@kPuYdRAJNDl0VX%(Vu|$rk(zrwR@ac8cDpq zqay+ykid!|^Y9p9*!3czQI7T=Zn7e*d_#m{Uoc zEO2$V8M;tkEckJMo-tFtd&)DjmsXc@tI{}k_Q>5@?fKXqqJ3o2Wz4KouyM3t&z%Z- zm&!;IsgF(n;y#l#uHF|@g^$KDU`ZY?6=I#s&40iv2q4`X%v=^sj*yZcJ*WIh{ke?> zKT1%Y9?mD(o3cyjjHUJda8ze~GsG{tfEv$&T2&R&79PYd{9hK>gx)n>RW$j<|zhWbr$>di$Nk z8W=0C=W$3wQNVI;GNsy@`0S)WiIgi?AC3tM7RAYK`7Pp~OiA^IyXnLn zPjN2hTj0_9uRmeeLYd~(?qb-JDcjcZ6NAw@-G0yx(g<$qOqOyFp*vqvL^rbu-=xEw zqT7sQj7ceO)rN^6AJ}i{bkl7@f~iobY{QwnrF^y*go|D&TCUw}n@KYPzTST~ z3UC(wEG$_aU!~qi@ABwNWLfFCU7*-wp+;QVd#~aiE1xA4*d|QW9WAy;~eWTso!NIJJ+|k8;^oy?4(!R^$B>hK1_o8%dH~ zRO1H3{{n3f+W!=Mo&bv?Vud_LE3XnE}{-wQW}_p)-bI)Hlgc!cnG>9l#3u@N0| zpS1}yeLWk*p+`D=x#Py}lDy9!gD5`!RWN`ah1ma1)EiQ|)YPA!cOd;x>}WQ#Ledh) z{4slYyY*Cu$}W*T`Jt;1H>ix$n;=$-B`sZxm%lhY)PwPLKg+3Xl5lZ6h7M*u{H_7^ zJS&!hWyS9bP;W1!$zLvXNd%Us+Pl;hZhV~jh1SzO?d-*BoBrX<-?I}^4zGjPn-PfD8 zxAM1*83a>&uT6)xySTMB=+~bWc|HkvKG2y0d!Y2Bp|{<{yj94UVVIum3oO=01q@)p~RHDBvx!zAqcd|I!Qj@hTwlI>sWhyxb4~YF}MV_k9AT-5EUHT!}%F zgs)Cr=Ir%-ZlBt`Ohl#io_mlT^xw`Q5KHS#kOi$Xay&1`)%h&X>k?GlY6DIQWI_JV z!9~CO%)|zi$(DeFc{Mg=Pf?_Gy#_{zlW#cATi52a75MVqDg>|Y-#ty#8O~?=9(`Db zL+Slb0d@5G=S1Kosi5S07+(k{0l<|X(E2OYfcV-@y?pNO_IBJrwUy{8{~sSGF^lSj zA-gB=e@7A*YCC9@Vxtp0#k_jPdLYM%gqhijP zK#kDG#+2UWZ6CYTrTJ!nGc&X`ODy}7O!d}}r>*~bTiAE^h#2VnJg2Vvx z%Otn}X(5lzCDNPwMVoy!!Kb0$NH%f9-V+uk`De_N7he({8qU+K8Sqv zayy|BSl`B@O_fHFX2Ov1<@<`e0Kk0D#p?ahyqj~ik7}`|NW9GZpbk@N9`6%bK0YL% z^;=02_kB!7!0LxrVOpLXm?&c!nKXl}2}?a_uQ=^AN`#uD;b^(+c|P>@N_0)Sxw(0t zh29|AwhrNBvU$w^?8e7tBxX^Adi(x1;Nk7ZL~Q{^6wMRowFJ_;&%XHoX%q22{X`fc z538h`+dnS*TJQhGoZZVeT70iezuU{1FZC<^r~Kj{bY6CVQI(YReUN`zw4{aI!7vaF z_fne@3HXPJUj~RS*J+X2Mm?n|v%{YDUC0K#TC`ZzB93F0mQmOw9%DcqY2c4EebPnn zX^>{EtGna6)SJRy#EJ4~k(!GaBiNC<#DAORGMZ?fc$IIt^C9m#3x8ZfG7CM!R`w)ed)ScQ!? ztFqO7)hza{ql%>mve$aujTg@G!&-hQpq%uoHJTj2){zNR)nVRCq{;6w{u18XV(F$@ z^MJS3&}g@6mB3N$0L4LkAWN7b6PXdm#W?iTDt|`vJ`CUN>;P_XA_j=%`(lFGLlPL4 zQK=b1hCBMbDs%8AsmyD5b%k&|dD$qG3jHSJZW!rerFSq>W)F{Qinu|kV;0uwVJn9Z zlOT^(Nd5LAB6<@SM668JJ{;ITiUt!4&g5N%2T zGgO%QlTtoRBj$>p``{@*N zHw*fZ&l9D;SvsO<*=cvBPhHiuyJe@`lY2^a4qj5=IM$kty24IKO@1h&f37g2>3j`Li8MHBX}0a@Y6FWtwAD=NzRaTS#$rr01WRD zWmZh$8!l85j_HVh{{%N#$Y8dl95v@CSCdz>K6u!gW{?2LN->D+3Bxmu9JG&N!wqEVM4m*T2DD?_w`5~h9pVD-e#qqHNa^uLEYL_7$C}pdD^~R@+l-UzQ4MXjo`m%L$k%6M@`GuVTKtf# zzMdG+3|qxBZ@t2gyG@DKj$Nc=qL!2m+i*y!?Wq}Wz1_s#!KGMba9ot^fcBmPX|t+I^*z$OnQb=48}S#? zi)FuxDE0DH%WgmQyvdZ+dcn720rwaSYjb9&#PZq0mkw4RL!Io+YGTgOq_b5nEur9p zr#gtm9kHFt|GzR`3LkcbNn69U0FQurgd??IR>3CRgpqmdxJv)tBAJR z-;8UP_>clc{#zw{Pa%pzKOw0Ci4Zq}N9i-S4>P|P2?&7Je*bUT~3T6om+g9IC*;%HbgLb-`!7zWBc)C zwcVKKCtt6$a%{0OILMb^Uw%hQVu-y+7=^PPXUUJ27T?I2`z?I@7lCgm=(;#!-^>gymm9&F)5t@#^#ZSmA``NhJ>$_O4bj4Y+el-? zFMJHf?nh%X#%jZY?2$>e`fNrV3}4SJSS*TY9kx`W0c$rv1jB2tDQm7gVP7NBUBL@2 zsO|C&o`G){mON=PmB`aYjQ{zTg}WHdox$71n7;2#X6qZA%6Txy+pNgT<3pzJ+tQJ; z1@*q~!Jf#|!I;0OMuVUCp)5MjD7irS>t#x&@YNMp;0?LgePrhA_Q_i7?TP`UsoBKu zY{PbQ{~W?&;Pd)mlLz_}-FT@Wa=*Y(?)!%?#1D8G_z+jN2m$!6pM&{-29el zjJkZ@Y0sZ7-nlsRo6U-}KD$cOE`5#WojFPv0- zJZ@D=mrr#ov;wA~GpAfi@P$0gYe6@yj%rH)?L7|z=9Qy5k+($W!ez;`jz@5+ZFZ3a z#Y92@o9_hmda-tKfcp*71u>G!<3kFCb+7sUwZa20N@(t4#S*Fia+abf4Qa)R<_&n} z!0jUVIizT0s1wVW=x5(M=aOHG9;LH|clJy>J;<(=cJ+nk^cCWB(|I0(ER z@aTXt|At?H(nkl4F=%9+2&_GI6qmPMY*vfB^^v~bTZla0zP-HNimZ^IE8c+7sZ)=) z4$?-<$v)lF!=3kUKebU?y6-TY`Q7ESthM>66u7JgJcVdAi488)oRYLW9FEmv*)i<| zEfKcl`jlh-xJVAaUtGaod@fD9(#_O5AF{zBnCP`Z*LWz#IurW)0MZ$2^^X6Z{xl-M z(c!ms7x0?ClH+}Pg04xZviADQLb}@g17jbKWQjWVGLrQ9glNjK5p#X)KfFZ%#=Co& zb^Omi`;fX?*J)r_Lt)Pc1_pS)Mgxb;o*imFu?O$aK6y?QAm-&uG5 zAWs|9ASAN0O-5OCSWcsVZ3K|Vi@dF9d^3o+KSp}G&sgmPYxG!7PMoZ36zbEe7kNUq zqx~2nj|9>5_RawYkC@(jdjXeN_HS8EFp`y5?0@`l6hDd^{7>iv__{s|Cg>}|ydq`7 zMYRr0P-lIPd7VCY*#$!L%Buv$Akey6Nvd4E$dVK3MUB%5E&%aIl*3Jf3eWk>e^9P` z4w&+hHFE;r5p`rj&N*{xRc;!m%M59&jkvj-#<+C$TC>Z+;BL++WG`PHqr{A(kP`D{cjdC{7-%yy3xan2(gPkvBs; zYY-Ct;;2*06AMN4sfblorZU!4Mwu6~_-<%T-RkEq7SA+o=07!*Fy5{do9Ei{D?5 zz)rks}zP z<6^Y863&-D^|*`Rq4FT;bjU2l$kzOF|I0_B^H8Q$fM|L$-s5ZuRF<-Ir-hQ2-1TL$ zz&Bhun=1}?x1M-(Cmh{1gUsh3n#%Q5{nE=jpx)(my~DX~_7J@SF7o{4$t7Gh`>k;a zNFki|?DDQ5y|-)xeL4KgV*LW|?H9!IfwfT-Wq=ViAO&>)nG;;N6UZ%S>mCZ}b+mVJ z)NLOM;&-?4`%{cE&=M$gA$@YNz!B+cRUNKw)vlYmRd~{J^Sw!v!Yo#>5;-klSXrAf zZUp3cLw;&nfND->6I47IE`9eq&ewG>$iqG?z7TCOL)1VlU1b3lq%U$fp}oNTP z(i}WDmJw`Au+cq@lxlhSSUd{$EfyLaDEzxr)GE?ObbeOC;mLWKrx@W;52@p~apuK4 z^`-ToY7QBHhOJz*My)`zdfiA|5Y=z!TSg;V>OsfFN3EH9O4bDr)I{cjmIwm^K9oO zQj~O{_D*&D*Y%$Y>G3+}99HbOAq@4~vLkw>niYNvwGQoN`9%D{tmQbtv6bE+5$o{CxO#z)Y%v|n_J-#xWkYKVV~q`^=OvmXqaj@L8DR0k9(7ruwO4?`dQA6@bX*mI4tmDBcj zG%%lj#zIvO7@V0-nfd{g3H}qzKd+yHfBsATkBIklY4 zszZ{aNcil^jB`^W9;nUp5~wu_7u48(6OEK<3>e9ryqGW8@$lVUko;K!Tq^Cin>zss z@2SEpDk-MwCU(%Xoxc#*CWC;Z6nMC|Iym59-xE+8!k1^~BjW?c<28>)zy0-k1D1uT z-fb`Zwz<1`Qb9o^c-Y)Wim;x1j5CLFNH-U0PL|>RHn!n1b>y^hnogo>_zwG2>&y6BE;8bS%0`^foD1V zphYm_R)oZo|O63V9xkPR0&G# z+4U&j-&c#bZ=Z8s$ed(?^3hsWA#l&9o7TcdtZD9IG0Vb{H;V(7(`Igz98{e1McXCj zTi?+fpzEWV36OY?SIz4KFdfI1(`FVSK=mZ4jF~gZ>2$8bhfj8SE9R>=8^sz-J8)0U zXkiX5YsLt|P(KRN?>U!V?6$SdBr9LK+)K%FN=sr>0zdlaaxNa2N7iy$qhz-8JCk%Z z;T2Ag=bL}k(`I|Z0`mKZ@n$ytb%&R!<)&h;)$V93^ZI^gsN-+x$~z_oCz5$dT{iCn-I zl=oOt%|zbt5yw_ZA$^C%7GM~_gOFamgjtT)Ipku>%6Yba#)5TT1K zqc^YQB%*_|$BoWeH9Fc5&{}RGhA24B16w=c_<^0tP3;UKxbrTa&jrjC_5yx!%NO%8 zara9c;S~d>(Rt?*UtuIkOkm&*Z2kkf)*!6g8#&n_5<5r=BGvu*My5E?ppt2?VvBUT z-#r^c@_CAdndwj8QsExk=}PO%XqbnOv?v8cqwr{)T3E~f;l_b$3Kh48OM_KklXH42(4|wf=!%V zQnDPY*M;0=r8oE2zgv-Cmz`%3Ja%vRxn#*EhWK<>NC*ZD*`g`@Nw6~0#D|x!7FT`V z;DSV@RXXSSI`hI=f6XYxf_D&=?RIhStaMULy}5-xiN(#k9k zOdZn7oVTV>!e}bt!sQzIMA~wzic|?8y{4@50Hm4WTasedjv#8mz&p>qq8*w$sN^xmLxl+M4ANdOz0e$tef|OUZ7k+&CxpT ziGVkd=Fh^6qrH5|VGRU9q%oDf_3} z+mjMs6e!BxS948Q4E6{b`7aVnAbu)NKu$w;X%c$YfP)KA`FpX+A+b@doM?;L+h*x| z4Bd@xztC&OXZN~_`J*`QV=zB{lC5BWP7HNC)B-yBFYcJ*yzxZ>Kh9m(Q>3MoidCn2 zKBUx8UVh}H_uTBnib`4b6V4-W`s8TtK(}nPZi(2{g9sid#&vPN`n}WyQ^}qDeuGzg zENiGpbr3J_>;SL?zmq6t#;T<&7HfL@D%2#-u%iUTZNXtn!kYw-uFczEsSxUpB>th{ zQX3^NMxhhNWhzs{h}AGplBTh^FUR@x6XU;$!%>(hE@bV}y1=-ptjF_?C)Gr83&(8U zX~w)dN}^J;{4i9Ga6_`dOfurg2V%i&N)5X{xTjb-)Z)Av^CgK}Q(0G+ z$$#qd_VLM>rL8l5d92f?iXC+Sc8?Xj*rT#jhltY@(jUen^64_yohM`8dElpXd)?WF zg=<#_#PoFwI!Jh1LKIu2cozJUVOy#(Msz^bD#pzmXJ4pVB+j4t@xxTEe6y?frzpv1 zG~B@sZG5S^71CQcdj%seo+o z2cqb`Po>FK~pgf&d>cUU(Z%h!BzUbpZXKnQ=WNM7|qC)zZf{&Zq~lgg}4sm z2{#h$d$c6leaSrIkGkV8Jt<{EbcwI%*uP!$zDZOqt%D(tt<}q*#C7>*X+oNEV9-eJ2Tn z6|KQCK{OznwVJJ)(SZ$Q^p5b@O$U%xc>R(t`gx-*AD_tb$vc`oNOIz&s~)2eZ&C(& zCX>{o=cKOC8s^i_j?e$rHG(G=Kf{6~!EBz}EypI~R_b<31lTYpR?pM3b0db&1smlQ zw&TS-P&0h*^uv%6QKmIzhrL1Y-Up$J3emQO=TtMwkL@4-d$!E)pGpbi|NfM(Ft2*n zAql$V0t0@oV+Z-yO(6BViDnTIi*fqKyIT^7^-T;goVdTP2B=i7x_6OfDyw4u64>Jh zU5d%a$D)rWXvBYW_?^Q=zZ(%lLTi#3Q?y_ynigc6=C_< z-fx1^KBKZ0aF6#k6{GL>vo)l`f2m--tZZs3_clupn>}2$u4SSp^n~05Wavo3H5l&j z7S{H7g6;C$lPU}U+oo7@%t(0WZTIcr4bn(WyykWOdKGX7%53w#>J59laA>s>{5=uw zl5NYhKg+~YN=(gsYxXy3HJ$D++77{0=6T46R_KvHySMeCuP}8s;_(beGPO;b#qxCno7^e>9RVE991$0G3GC=8ghzls$Ijh#)JqxU4hmEXB|`~`D|OIPu-JOUVp|xtX9#r>VdUV z=-hDn)q^+VMa!iAEU;8(gkSY8{73FR&H zk$NeIW-bcX3b zCqd-&+~TwyJ3L%oP^Y>;?(bBkL#4`lp5|PwB;pp|L&h|s0t6b%&`YQ>Iun!7_{}an zxV;M_=Q&d!+u|_@csLbw6A4}`J)Ct^r&CrHg=hy}u6OaQHe0Nqnp5bPNdxrNt}I{U z6%1Tf(RoXda$VyY>`+7HKbUxhHVm4#AWUYeK84MNmIw)sHf5?;|NPYY1IQ1n~XlOytWf8U|DXi6xVzWa|r0e ziC*zO8RQeQ4u4IzzJ#uIMv3i>kjAxh_MH{c=Q z<;mfNmiurF{eRi?1ZWS(K>&zuHk}RkY=Sshh%sGm@((JY9q=o(1%-}~=XC-^CPNz> z4Guoy%I>)5=Nn`Ewr%`V^%V=>)>_zs@C?x^N|urrob;{)h{lBFRj{t+GEd-ZZ)0QQ z{#2(}AZErML^KBU)o&g#zdA**v4|Z=$&H_iFGN4;ur@FmUDkVcYvp!`8?>?12v72{UWWVwOeNMao1|!oBm<2a2P!&R{E2~hu}q&}Q2_T-8;lP@Vlfn3jm z)FWA4oxfLH8fe5*FL+p_-O^}}xCx^F0`YYXZzo8)bMsB?W@knqe)Pe*Q|0zGFkF%3 zB=`oLXX+u9AE8lDuy9x&m}a}d?eY(P;|`48S}2*3v+*>YtC~&{Vu~@;y9ru#DzHe| zZ;-opq?*NeuJieMM|Q&o`8llSYri4EQ&QhJoEV;%U^*Mfo$*LvJtV4ST}CJ+V}Ambs%}P zI~w857;POnXLpD8XLe9psk_g~VdBq$*rJO}us04{ zd|u^o&ZgCT7gkX(XgK$m0Bmfxv5Q#*Kz#hmpM5FB&sSb{14;=-U{`WBUxRL#nUP9IckaDwmo44GG~1L*xe0Fu_bbaRQmb?D==i4xFx1KEn?_Ip99Ji75*qL2H6a;YMPtFQ*7< zWgrV3Hnq@+h9jW0o#2#yvr^e6m#*}29R7XE##m?5&S2(jdxiOhGX(;1Ne1CqK@G1NH2QWK#O#uI86RiQN-v`d$ab!N#hSo7nHd`!r*t#a zN{ZxM%ec~)--op28@feKoTudL2Qhs3Kg=KfKkc0Y?EguuH9J~iXO32fqIGQJ(w^1; z^<1u^ZRHSO*_=xBFul@0l`S=tiuOE`c#SB{cth{=)=VHG^-wz;bwpJ_+>@idnQWn~ zMLZ)Cl?L<4$?3grlfa!i!1@B#?&!I{THdG{-*ij=nbXO3>LYZ^BY)Blzmt$vz;#G-(BQx$c{Y@* z3@zroG|zinsNYkdxN}$)>R-p|4O$%tN3bodyO{V+*``BL>vxO0!va<*2Qma)3zchz z$dH*bmorGQegS^&S7i0;0$(+^^424v)H{7c%I&2)r3qz`ij0u*Hw7j(j!q0R}wof)p?r4dRjZY$R^Ri4r5^|AloOT+?3Kdnt- z>U8=D(2*sP?o&|3_dWiO(wZTr#XkY^CyvBErG@<+n|?<$$UATp{OQwzOk^^r)V2z#a2EZWHoD!seE|&QC?+wUxIYB%*mTFB;$Hj7U7dyu!U2 z<;-0>s!-pP^PxGBS0Rt3&CMxvi`D|0OwlriZ;(SJHMzJljRI%>>k2sIMQGOez1H%%2C3C0x=Ta8PP}@vD%-BW^;OVo(iJdzd{* zInA=zc3=mNsu!DZNdx&uwwIT0>j2-VRgznLUyWVtpyL@UnhhiD$6!z-s&xw>Hw2aZ zo6+%grQTMeSnh`7`+`na-MH=sozhu;u*4CSYVKB58gp?1Gtb5j(__;tA$qdskn6>L zZVVOLh<5Rw^EyRPhhi=XtDL6GG`9-f@Nu_22Yd?3t+3G_7IclzL9|6QwhhvR>DhJT zou^m`iEzialV9;(LHR@ccoPrd1Fp5v)`W!Dxlp~vgCXy6tfe@7NN?6fjdIBE9~4(= z{1^wbmuBcjCi7WIyhv75*Hi>kS;_}9zaB!|0HP*$p5~;wbB*5s7ft@K0t!^i+&3qM zDU$g;S~{+w%C!WG6L!6iMK5Gpr87?_le?E@OyGeUrCuwuJyN!WcsH!R9m*(xq42^UG3H&g_! zFthwC+E7?=&xx6*XtgMUQtPdGyM4ckaON_7s*cByK_l#WWmh>c*YhYd+SF;OWzf*| zsLHY+t--N^+T1j_M4X9L{1-l@E5obqsJB`7bv`2_pOX}=dCx}Ih~K~8&;=bfyBqQK z^IwV>|L}gk2(!mraGFQH$wZgOYNMNf#sh5;=NzHpXj_y&62iv8`c#P{?7zvA+OD68zaLW} z@6fM=HvEn;x!byJk7K%6c`lI)&7hQ{K>zRD-YKJ^_}+t{%Am&gzuo}Rj(A=s?^Zct zlu(Yn`{>u?wJM3M@Vnv7LR8WJue$RJYohD+IATLYP^5_n7A$l`1cZ<%Qbj=oL25*l z&_Q}lR78}jC`}}Y5fCvHBTYhRLXZHVmjnnBARtmgNoXNwu)Lq|xjE5EuVCYdhKf@K1W*I*2CAt(L>rDoalST?tmnS%oE|N z_T$WBf^>B04a6vlgiiJY&68DWamKCuAw9)@`L=RpEUzt`bHL*MKZ;N=jt!O(-!w8F zd6=`BmVT1YpD$j1r+6tzr{Q+n!7JI*?v-_6f!$#sJSVtv=%!NYqWVS2XBA>=B1;GD zBHIhywM$w`=9f=vK)20o(ftd}zYml%0{MYG;D7(NVHOTv^jvsbv%x984S0eGirG?T z+q&0rR@3GN!5l#;9V;S!Dl+JF62x)AleZ*9&*bqy+wcdMX}>`uX=512j7pPTsRLeE zD>u_5_k@FeDc;n1q+H&+5ay$%@Sd9HuOQe;v>vptFu|RoR%+JQ?le!6fi|du#7TEo z>fYU3vWCHO!%9_OHigu`g=JLq)&);td{Vtte^81w0uEN%S6zSdaBI7hY^cCRPiG-h zl}J?E@(=pVigTA^v7}xYyT>qV`EK90!MuRg?$DW=L@FPGG5^DRa=p5WwghFoeZjQ? z!X1{jxxJqtvk+Q*&d=ZORB~GErTiNnX09zBko~*WG{K?aMRrG$&kYRj(e9{Ef!)2k zKUPCs&27)4Zqr#Jd^H+1;Kb%7fmKP5!%g^z=@AiYH6R=*QER-W!gGQ#qUokKVWugr z8Vyk8z}usT{ZY@rPeL?X-S$Wno8uU6J2l$EsE)S(Z(AR?`O`SN_@ z%%YzzIozerrTBR3rFV?mJoBOv66!`4#!QKU^eC}N8q9G-IMz(rsaVbXPG~{m?s})b z+5QFQqduUjQDpU8`0S@G^kurq;>4*?Gmp&a2HpU%o%kH5)zS9W(OPWlj9d?0j$7i# z%qqQms>F5D%o{&xG)6xWEV|3mjnNsc_tI4^L+ELCMit{xchFp8R^<)$8!w^x6$T$Y zy*qzY%-`Ch3*lFp;6rlXXgmFgsU}FFmr+wqP7>2Ulbs<(-&DPY=V2SRv+$c;N-)6E|GbCYy<&Q_IKFbP0Ed__Pp^>N3F z_ABF3o{*=JI{+BX0PoNe@({M?nCwrEdu&mMq=8r8T?f zR^L?_$M?*+!w--0*~3rJznc1hj|>igq1V^z`%|n8ds?K)v98HzkRy$DtJ`mXu=2x3bas1Le%N*PZ!p zZpas4zsBgLb#ct4%$I?Is+R6)IsySA#D}NepXsqMd9X+>)lRBxPch^qH5oXh?Cv|B zeP~zE-MB_m!~V-fLY3OK#~XC{%t+>imTtM)vI8WNmF10(JLo}xN<&WTHEmG`v7wi= z8Vfj!&ofkCWY1Y4i6Pi&XQrbnDRy9>ndCHjBgEZZ<(i1ZJmUbt2Om*W`0Uk7sBWEy zTyJ4G`{-QJ>x(+3pBwJXcSYu1PPM5Pm=NO>bw1fGD&)YE+nU+$z1;dJ@trL(T z@rinD%tt8?mAqT?O#|G3Al}2F8IxUtMxb<+j-9HMu(Y}{C)=HsMuX*OlT-D4vn?e% zFUrUIda1aGhnEl>&7=i7nL;-5rDo;mq{$DCkv7=kxnX%%LxtN3FM76y8YVkY4;6xa z91@F*>tT-*XP!TesLVPTD_+uMNg5edk4P>6kw`n!wU4H25KeRkda<+%^pBuptQkRV zjB#sKpl1H0>={~lP`&?4T@Y--w@n{iaII~dc==W7XZw2_--!jhn{a#bv_6j~a$nxn zX|6=$t-JYV?n-7Gm0}d>8`)Q7?Ay(H&NpI;&r7Ds^|pN~|62Q`rZIHeN26DE@xsrD7p$jB9TELZ=bb{cW`pnzK&YQLM@K@n5T7PwPXdN5>rP`8dvK?O%`5l984ha8P8`e z7MaOjmF5xd7V2?N@#Pjbo``o`LqEXN4jLmwNf5Bq9&%8owwbJjvQn;Aw%7Dd{wLHr zuZfAnzG6JLTk~=o<&6)wiT;>2hE}Ujthxo~UOw9EX7TyPdbLk5IR8y6k}xF3V_Fnm zr|qabo`4|U=RI#YIpLvp_D8W>uweX2lExR}ek6WfOhqF>KFRnPFKlAO7wUTVP1koN zLXg&1=S;9z*AER1sw}xNqikULn7=YPIInwO6jknZK3pAqFd2|CcfCl+x_#6L|i+&s=)A*Ipp z<@Iv?FWLK&Q(qdPB$Ho@CRzHM1kQxWkvYYQ-yj~n@-I%65UxKHfXnvfkLiTw*9*E> z5Dzg3@RYUmY)jNYg0!#hZgn0CrT=S^UJHuSU*vL|JN1%-Va~OUYLhmJDBU+3=ik^W zxQ_CJp+XYVt8;OwGEZ+Cws>GZqhBm+e*lOaCK)elE!W+DrZs*;Qs`^<%dQC?MUqQ6 z)oZ;&cuG}MqqY6`_A=i<=qZ7BT_yfG(@IVCw^H$l0oU;y4|wA~?j>^x5~~}d2CeS3 z#8z%8p)INue(R^hN0b9Zmv%kWifzBFbq}_o)_KalX1UQV&Oom{hbsys$LQ`=>5mtVWOpUk|R`x4)mBK(g3zQiDMgrCF%>d~smCe+FWzC%=S zFmfpuSY!jwPYwTUX()0G8*u#GTq}DSj}b`|;J%XEX=<>IaN(n^0wF?72x{fx3((wC z+ViY_12h3s>E1WUe58~W3?2vb1W#LWKWQF)(#?J3S?fV&49CXGZ+vXC1GD-$z^VeN zY|gp*vs6z2x1J%-Mj>>+q0<6pKhPh5&?xw=iop{UFFcF&w39#F9Aujpz}l5 z_i%WQSuSr8JZSN3+7(?b6D(xzTcLy|clvFjb-I7n14>awl*Gw1G_*&BRj%(^cyMvo z%pR*27Yu8s`3@VP>Izg)s;{r8?-)MqoANj=g~^!PcuF2Sg9(Fyz*yRoS3-(B@W_2)q3$MiiH0LZ3;X&bb~9Av#7Y_$U0o0551Mgc~P;~zKWvPFA|rt zg#-F`DJ&GdRq=uS4e3Pg2rWH*N$(iQ%GfC}-keV7#f~v;4vslL;0DF~!SZ@F0qUn3 z%JWxkcym~)_mBLFjB9^IMo6&h#~Y2a>gZq;x_hc$*_x5=pnPQvBqg-#;#Z7!FngB0 z>M3$5`CgG5_wC5KB;BUsA0sSC#urZUWZV26VU6Tc;Kc{4lk5!yD@P)f9m1YDNSQ~z zAdkhE$%0~FGPD{`b_?ah<5zVTtd9$=95W63LfN<#^z00NL;^c+o_WRwyT+fW5WJEK z3$C-*uB4L>VhDT)LUD$p%^R9s`hgbrGGE&Egob$T59NFwt)~x6E$ogygIGg*h8&}7 zc)|l;sj6|EC?{n^T-s{re2lC&?1nnQ`wT1x}Lqt``Ui1oCGW6XN*)EYH~0e9sc~*k)U@S z6?#60#MKk|PRVPcl$?!be*naP-2f$v67yKZ>kIE{^QTLz|Ap)x(2BT zeI0giA}0=>W9j)m5fq|!7G5Oar_^WtuCV@1nkIOpwk}Q8L+PzhV9$Wy<}wWs9Qbn# zVE5j~X{81NM}*g0o3uR%obAZ>hVKbYj{@uxqi5Z?=1!&cweL+0%p||piL32j-yYQj z1f7xj;P(T%)Uj)yS*OVFg=)W{qNBwku|`LqsZ5MKck=Rcj;OQepB!U9&SCm{Q zn`77Vh&9;O^aaePx@q058s>?uP9H05vc_+&&%+j9b~gv1Z4E33E0R(0NIR;QjBwi| zPk9gg-1lQFbC#sv-E$mp)qkDpV}RNtoTl+1=2~cwS6!}mAj^z^A*>FF)XpBKK@ii4 z!Ue>S)C+iH92=FUO4%5vusWzpI3MaGtxt5s2D$2b?$RuL?$PY2(1k1th)ICiRg@-i zt$E@WNUBxz42!a+dM11+Rsxr4+C~X0e5&S)oohbRYZtOIxO4IO>y265N=AMayA`n( z3Dw+*hSLAxGI2KNV~d2)qD@1qRO&xQ zaY5kD-gte)%%FzCo;dwxd=8qP@Pfz~exf5{7 z84@7}LUoR0*x1>a%1FAUo*gv<^fR>>i7PlI?ixC7#$s1 zw9Pdvh`m@_AjldPuKJ`0nJMHZn?xg)n~8GtOQ*kEo#5uj<086Sg#1^O0skE`2wX?`pV{pX-9pvXbpO%4(frjOvT<@*_s)pqR)V7DDF4Z)S_#zwy!kOysfz zW6Kty&XStRdX$^eC?FY<^MeCfdB=-5>K}NtT%1i)uz7!^QL_-hx2D9 z+q5~1xBr~5KW!xUPe1=@g9LxwjLk2B(!Z7koA#X9uVLG?hjW1hzG(oT|EC9#QWV=@ ZZy7Z_aGi%E(Q5NT40MdN^R;e1_%E$a4%h$y literal 0 HcmV?d00001 diff --git a/package/appserver/static/img/escu/Slide6.PNG b/package/appserver/static/img/escu/Slide6.PNG new file mode 100644 index 0000000000000000000000000000000000000000..bb0cfaefdd3f193f606bcba3aeb5f6fa92a64346 GIT binary patch literal 163389 zcmc$_by!?M_a=zDyK8WFclXAE1rM&l-Q9z`ySuvtmk`_u?hcJ_=ljjf&hE}L^XKwB zMfbg3x4OFO*!!MSkpN{GWCQ{PFfcG=Iax_HFfeG)TZlP02rw{k9z3r!&=t6|nv6JD z?F`Wg=mN?@Oi2t3tRWup&G=tect=?sXD~37p??j0)S>)47}#ftoTQkBhr#)~Yr>cD zj$_1$CEMxy(b|ly_01=jE8nBd-+Ws0M8pHK9P{^%sFtNNLmN{Y`cwb@Hb(ya&(;~w z?#;81v^e^%sikF#1DtIv6#m>88lv0~`P_i?4}=RRP#Xv*`rou{Lo_(3L6Q}%&5=k< z8p{*1`tEK;1(uj_;{5b0I5X9!^xf$!9=hE~L^KQx zaRqwXCf}2iG+N`)x2Ia4UP0TW*4EZ~jbA|tNl6mpfB`x>x@4d86*hU`L!G}8JXU9C zXY+lu;oGTJU*T;*s-gdTi+HT+;uX4VwW12VhH6(=R|)~bA_8C$vhVGH#p(pN4{*8c zwy;zPFxUI`ZR$I_7(hW9dNH+fz!%(g0gRNCRGU5;P87Nd+hsJhHmste!ij0IS|eDX zkU(MF`dJiGZKAUK?RGLbKQ%Wfk;R}}7TW#0cWwZ?9+d{WnaN^~8vSBWrkIs=Kqb6* zWW`Gu45D3L;(%L9WIU;e@&&diouTIewizZm98|I=xCW!7YD?k9#G_Cd=Y%aCnVz;9 zU$BU}eGo>zN3y6HiW0&ook6Ia*4o1Z59(k*)f`dGOt_wMVk$*I zs>NGY`oWn@lt5|*H%}PsDWb90*!4=V_JmT5|4nH#yFKjRP8k z5hD`l(<>QgBu9=h2eF$WN_tH5H$&6W&`w&yAV_kM)%`JZ8$-HS3lK^vD0Cm_N0BQA z?e6O8ijhn6?}Z^mI*5hiQww}G5uQ!SH4KbLH3k6vs+et!NAdfF)0$r}3uh36zCPny1$ zkT?Oxa?R^yugGO$XNPvIYz~z^ql}x0j`AjRE6{UfIB(5F`lLu9X|XdXUuAi1$Q+!s zikjp_Y3*%w^6U$gIUyJ}Ll1V9Wd$kquUeuja%_~@xRZ}F!!&J- zhFxynG2tP5*d7uBKZ+TEwDmnf%UN$m_?B-)KJ+vlRwwU$pHlVQ+L~IeQ|4;$247~| zfNXsgC_B3vvzvT?!hJ*5OS`b=aZXei&+8q4e!_KtoIEdo& zUUx{fgoWHLhy2rX{U$%p^^oG92o<-?qzsDGMf`IepjA+{g6p_`C{HrmRh?fzD(UXQ zF&?Fr?KxfV4VHGs)rK9$`d&P~e3g4B(qG;3;6n0+ry5_r9VML&nCt02JjMQ|j)!VM z2wzsA9rZ|M5EdU=QGt$qeqlK@sr22%Z2LFFB@WjtVnz&|L>eCLl%-~JMyXnUPa}`y>_72s>p3Kn&@|d(LM5Hfo-Hho>?ZvEzsz;#0!<%UFnnZT{BYCGL!=t}5H}jnZlrtp$Hv^%1oQ1z>Y*bP8q? z+9`g$Ck8%Qe0J7459PCsFsvM7C2~a3+Ys0=gtY<8rOuvkW5_dV6kOcnSl|vk*-#F{ zG$3`u>^({(&emF1q6Wmm^7Cu;RVHPZsV={2D|i(rB~|Ds7wZvnorsq=HJPT9XPQTa zmyTMWGH}pW`8azKtaUl-ritHm77-!!eDfiKEUXv?DQ;2gp8wmZ|F9Qc@6D2ku;-D$ z9MR|Hi08&d0`rTNYLyX8(zuZ=JJuY1?5z*Oiqum~Qe5puJG0S8-ihcSNIuEk7lMP7x%Xq>-BA9)}p--g1^}I{L++8b;;2J)4YF;44Wm0^^4sW~MaO0gzXeShDdW&W1*@tsSC47~{=sjSEO&Vms z1W{3yPsj%<%QFJm3Sg;2i4~GX$#La6s}PR+FR%St|0WHLTw}F;xx>1Jl;$b9`aF3e zo0F4+b{HK=6qYGRXSA(2i|raPZyMDZ8(W&0Vwl;ONgOc=gaIR;x}53qe}{x~nZLkh zw7^l369yiMaGcNBU1#w0+-*Hi>Rm2x7nmCIW;XBCh70pNZxjpTZDzNRA1p5;8KemZryaZsTrUy7v7c z4xTrHd-u%yu&^*&YaobYjeU-m_)|xKxAid}b(!&X5LN~CuZ=J)RtrKYzjFYJ4FR&o zHM`c=E&dqZCbD&C^ZrI}6a3U7hGtU*S=nPdTNvZ^5>D;~n2`3B_Ju*OFGtmg02vnH z`~xew_okS~&cV1yO}N%(E*WX**6GI4)RkTE8KX{&N2gCB;fWtV(QWY)qf&gSS*V%X z{C~Ikl9{G31ZkRkozWhcioxi3OO<*o-S-!K9bm-nbChOz?)!ZDOhU1Yz%>{M za#ha}*rHpM9lmz?F~w*Tb2n60K}f^9`Xeyczt)WsHhgOS|{G1Ls;L6%q>Oh(_ooD;C?`Xbv_L-9$p`YT58iyV&5gLB&(BN-^V zP_5c=ux~&3PGiFt#yh%z)uxo)VND3&MZ=4B*j|8R=?ogl8tTB-)H%2pV!%;t>2*sr z7o+NFvS|PZIx!+y>nFfTI2o9N)IS7jcPPA+)5eL=C4j}U9&mzlW!i-D%Cqf2qL_ZsvN`{rOF-N z-W1rJ%y#>1a|r@9uK$4C?LiSC zf0^6Y#Wc=?$P>AK$Xk;vIuC&f8Oj!9t7FvX-_`u3+3f5vQ9BPKrlsIT%0!J z?^#`6DU_a`o;;Y3&vlohXaMBq<|Z-(R7EDhyaWsEptDjQK^{`UOgK5r#1p?yA|9n2 zY+XrCt^o20{9q&+_oRQe2|_HxpaP0k$F(9#tuB>`Y15)hI*C@Hh*1c;nAh)(m&*1k z$^W6sa3E1$MHA0Vy6b!Slv3o{A=rU#r7BC`8#@)Psb(;ktuB{Ps4jF>VJ4n@Nov8V zTI4D9LZhZa1Nphw9H4{IW(W?lj^**c8Y=rZUA*wX+iA z6sa+Ys{pBQw;?_ci<=IDG|6)^&vGC*vmxh^`|s^Pjkuel_pq{xyi|vq#d-k>)6KRA zVdsq=dS{+^QFGZVww$edP9vfxM(G#Q%gaZpC0@HHAR)y_1WBYv`;LS{%Tg;oa5G)# z#67UXJ2j?8K|%j?vnP=g|2a%YyZfsJ5jvDgmj3o8mg)GLaGlu+aW+lj7;%p8JfXRZ z3o&`yt`eOq845#G(d#}M;?~vN=#!kMId*qTiNr>Iyx#>n4}xB&r>FWePkdNC((mh60vOP?PbJ~V51|y&+rf+rI?(TB%%pWDKlbShrKAl5%MX>v3 zk$w3lAxm&(Vr+blVO$fsVj5Pu7177u(rsB&Rc3>4U}&h0W4^e#xSfu_(HduewxV}> z3Z=KPseKyyRzQoZVvSG8zt!V1J;VKrywl0ltDa_5WMmsKr4s_>y9vbnbML-`o{3r1 zTc879*p>Cgf=N3rO-gM561HK-B64Zfo#l0rUa~{MW8UF&?`d3l+uwWrfaSCM`nLd0 z^Q^wQWDfv@G}a9T#NcIM!`35Z-UR!KlX}r2phXn884a*K{8%q;{pudPk<#`QkM@L0MD^P549o>4FqOQW%Rne)hx0KC~QuOc&&68w0l7& z^S2ssqf?<8_qyRst-{;ONJ8{r_CATeC~ zwkIpPl75+I8ZbVQfMmEslw;^nSpx=6YRb2yk%}eSnbNR30{vFP`*^E3*^dP07{f3r zkB+gdg$2KFY3oy2Q`%fi<{wC99=R_oX}DN!e}ZerMA2bn>fNg+4}h zrUM}`^PLswvxO7gqf(n8Jd2R({FZn*J%xmomg2^ikkE$UXKP$u>6t0C>E>XhRA1j< z@Kp^A-uWdxPoLBODwY5oVJ!)GV;qCx}Ye>JkJAnFZPAq zMYT80*1KDF*4C0EylFcy>8e@!EKy!Q`c{E{nfv-A`i^^?ABSYQ7JqfC*S@CC!PaO$ z`S+2PA8sMLf(^Cypd1N3fwooFZor`qxPZYLpXhD2Bk@#TAc_#sXFmx-ZEtneK()ks-v%8Zv3f4-%{M z-RqVFnPugk*zV$bin=ORPXD8pC+WK$X}-olPbHKxR5#q7ss5t|(zJ(FIo&n*a)m=> z7gyKci4gn`vw;;qF?36;48B88cGxJe)dGj#7Zw%{aeSrp=?BU@(~inUoSFq?a#K;9qeJWP}3T?`M5^*|2mI|!~5!bdgjzReC;}j>{@wf7= zFf)1zeoWv9^Ux)Zi9%XELy#xw9-RabFS{zZBTg&YZ`2_7$b#erAF_w%`hFHmh{3=T z8h3v~uUCZs1mD2ALS8N+7TnXio{yiox4|82-@D}EkKzjfN)jV8 zx6sGy1*WP_@{Vbp-5(H{tf%82x(m#BC$Y9!QH$01%_cVX%w*%f{xVaRWB+3E@&XGS zwYbxw7VHi(nG7SFj$MZ-s@id(8vk*hEw5n$sQ@eUg026)cmm8DTp(^TldTU&><>pV z8JJCkT3t& zyjC8|GDzA#NNuZ?{RL&&&GzRW_RZ@qd-I}OJQE(jXY%5Xt3I>e);E19 zaj|4GSJxJ}g7njZ2?8IwwQ(B!GU5NM+WCQ7KJHL-l~H6u-bynW#`T(75BZoeN6$S| zg2(jG3Vu+~0ksr;$kMB%Q%7#FgK9gbHsxc3iH|#ydQ90QBvpZ0#eJ07;2JeYEx|08 z1kpuVrG(&~t~ucVaHm~ftMhsVubgD7+gU%HOAX}~+qrMXhh^`~>l+En{A!TAsB6J2 zjo>-evBw|d#Md3~N>ZaCdi;JVPG<;5BK}VVAd?0HA_|vVY*UDhhmCCs*>^)04q30? zw|YIo85Xz70>P_iw)4urhJgCaVV|6?d`I_EEodkWz+VC}-DTeQ-T7UlhaoNEy zXgxVRG_Mo{tMTH`WhZS}#6DQ#8|op=-W$DX8>d@cSV+c524v;8d)!de_)^%~*;$>a z_J`7X%)#>m7};p3u@TMlncr7dGH-#0DJ*K!M91nkHq1j zy1rke`1#+vXMD?*02g6F@)9~Ip=xpk1jXOGGZ7|eD__+^qoD7?e4!u#mvIzM;U?w8 zMD+6THJYN>+AXM>g{c@Tz2uspAvBRk9zlylrx^?&;aV>On~p0f3Fs`H2a^Y1@m5l` zN(KiHn`{ z#)69uy470Mbu{fz>jaZgE~bv&hZAUl(1wrbi53 z8APCyWA7f`Y>Roa8{LjqbGRStq}H@f)(KDZ}T2v=)O5eI@g6A)&dE(--$2 z%&BW$ohIa;;dj3VmJSo-%#``#X%gsaxxpFXgYHFq{ljK);f$sz(}L9KVX06i%uFyL zB_b7PFe4HaDa2%HccQk5|g01`J!RYC`-R9vLUO#ZovBBtcbk`i>U-nVwi11@>TH;{PQd{e3?MfR|3G_^G>0k95cd5??5Z>S{VXO& zL2ZTqrLldr-E@5iVwuE;WQ~HE>W(cRu!uQ=7vdOD)=#EA2d#VM`h9k@Kj;)FE`e2Q~&kkQi3n2!Dm#+h1C$4dL zuqy!|!mBS18(Ld3ZB(YC$NRkIc|@#v^>d={ld2%;w+M&N#hyEcKq{J=;2)KhQP8Z9 zZ13XqBR3~!sSD!_jv{^-A!{?cDpj^b(?kC(@gPwrlhJI6-Dt523E_R?vctyX3OY^(Pwg)1(}tX0!RX5OGjg&eK!Cz`e~h1sy$}8P8eraWD>`?VoD#v ze0z;|MMtra9L@J=9xi1!-^gIzI6<=fZ?kz9{&driFf_V^2TUNheI^u-qK-%`#)G$$7Y?bV*Y!8zb zQxi$LvF#vFYVi=oJJ9>Zybi{R6r8<6EI*}0?v6Tn8q)09GVHT77Ue%vH`e(T&=hw`nbCfd_tMj2Oz20?5s)<$L zj0h8XXC+bJUuT(C$!0J|sQdB3Kt33%^PEkjmA{L~X-`GW-6uaTYZA^Jo=*Fi9EG>a zA5w?nNBgOX{X8g7eywkQy}J1pFJs^>@cc_}?80MYx~)I4t2&P7tS86ud73=9E!6%> z3%_qPs$1H^s~xoZJ%7)Ml@vrq^>0c(d*;&dB^91l9hRBT!W>y1gUFqC%67pB9Ru@f zRqV5}*%DS;_;@4w`g#WsUu87vsiwUBaCXq|YxP}~Pu=D^Tgm%V8-=%zQWw{@b%=G? z(5y<=7ewYV|5A#MaS*6vfFb%aX?Ie6Wo|WVeo(>+>l|K~Jzb$uNs-*{wxit0X78=w zNWhFrh~U!D680B?^-lZ?xQtMgy^L2cr#EI?K&L{qvs?B$J5g=f&GvoGcz#bh}+!a zB6dQgAD}`*xo_gjvvwJ0rctsqB7o*U`Xyg@^%zvT$x`2ooc# zlbTD3(M}dEFR-SBVoFzK83U@vChZ)9AW5+L6(+pK-eC6JnD<*>KN`8s6CSg-c?c6v zw;P{><6dgq9Tu(*zMf)>xmTv;P?WoU<{(DXZ!Ml_QoG64`+id7vXxBY-U>54v|ZTH z8(D|5)AH7yS4@SQ4MulbmVW7Qd1)~upcNTOdcHA8dNJ!hTIgxMF?9EK6cGk#1xHaf zGN>2`Y8^l9*=*yTybNb~mVE-BBinjAeO?j#IzG|&!3gVfP(K1B^i&yT;@v#zo}F10Z-ZVg(T*(7h7~w$T2BR^A^mBg&^mS3H0u9hS%GNPs8^-S)?3w zr4Be1dKa4cmztTSZ)3qZ5W~p?7$Qz-6>amj=H?e89ovG9oa&v`bv-n_5~`-4GpSwTil zUmC7tN*OSgU9~(5w%y!RA}QkSD*%EL`9!@&YG=a!Tc5I3Ek3UV1R4?&GP`)T7@T|s zCpTO66>~v$lTQsQJdRUQ53dcTK1Y^m>=Sp$*vi`K*kHkzaTbv!_jc~p5e7UpX=EK=;d1a+s}wO8*9vKRN~M{EkgyFwboV_B%QJ; z#OhAN`AUE2`_HNf=)%l>C2$(tmnG7hgC_9S=YY4!jpAAyP!eRCQtw_764CCOO8NED zRWEZ!-5JF#b(_DlLG_c9w`bzl+Qj}Lv22C&S!!?=DMqbM=Icag7V~b0gy(KP4{KvX zee>xI+&G+bB6&xK%r!fy&UyzSuvAB9l^`oqH**&`Ba^__;||{r@VOP!62i&2IV0XJFw3ukV+*ta(B=a}6F?Y45p)#GK8@Jy` z!2sApO~@cP0o_)3u$F!teA^SR;@PFsf<+a9Mz1i!eUhiW ze}PH=&9bGTG4gH*Qa^9b)<(d>#)d&g50XS&`VeJn3*6`e3BEB@e~GgTk9EOA_w0Oa zzEGB)DA(XSE8fAA_$mLZXudj;=NMY%KRqyFT?iK|{7a6>{t(9J%+ zB+R=50g@-BXyu6ZAGmoEUx$Xc3hZGr3A`II3@aey{}e&NX~wYsOc$QCy9niIYix0U zKux{-C9mG27)#{sG}uTXxasQ~1extM4=E88#C;gf|1wH;@XZv1F*pbUmu9Ug^XTfK z+VJ(##qn!Wm)2nX5p!8eEGyas6P8Ox|d$wr|&_a-L>a@9VTl zdKTyydcfa?f@O{fX-k_)V!!PKi(km+KVOR%ersCee{ohyTLq2ot( zlSboocFMGsZ@E`;X=Y`;R*Zvt{Oj1>6MfD=O`^fhYNQ=?;PhoTnAHHi0AN~Rp=wV~PYX+4HQZIyAaaTjRQ3Wn3U7SPWip1W`+?H0L8qBFnQ#_}K4*rW zA&aXHbueFcaKXT&LZRzj6!YzO6D(YrS3^>)^ZHyS+Z-Jcb9(HFzVSn&b8F4gVu0Nr zaijuoGv%<*>F+8N6woFJ5?N?3>E_(if)I1g5@D)ICvINc*anUqK(C zVr6iT!cbc=qi;P}6nuJa1nKOfH}*(Fae8(}NE%*QNw53Dhl~vTg~|m|kn)>?Q>+f7 z62XC%HrmE|Uu(yd-XAHVVuGM#)VY2Cy_q5QF>g@NkZu1Rdo!3imv2tJ+M5e_LS`yG zCiyGi+#@b>NHhnBCvYEYzrjP7SH7$y08W;(C8Pad_D`Fdi6z>$N8 z9ToyZc4Sj0rj`tkBy(EyzKNas^7V^U1|I%e8B{vHIaIn~@5Rrp_Wk@a|8)k`(u#5J zw(@wIkFzM%5hz@_R7U2#w(BvpPA@%D6PSU#UyH%in?uxOWftl;-;G0h@EuyIW)^9M z*{oXj3_R>p;td0mh4S>*;uDN)TD$DwX6M^rE_WAL&$#E89_641ereBA0NDPn46A%) z#q}~i8v?pY1Y}dLlxKf$AK{szyZnVjho2utlqv>H9X~?gi+tcjLsgsuaZY(*pf$-m z^PJTvgGskKg63s(+2Ck;q_aEIKV{V3G+GP8rl89`o1UE|%za@l_xQp_Zd_f__9N5c zZ>DUG@T&Tt5u5MOJT|!(%G-p#;K=lN!bz!Vxa9$PRb@hCF)b_9SsMQzA6wgX+&1o) z3C5}JLBx}?eO#PWf~L0|34}D9L!MOFXNnVK%D&hUzd$G=CSSvk@1~in<0@o-PVBu3 znd#aNNB6q&1INwYZUdf2%({5r08n#=O4vv_@jsc6CR*OidL|><=$7Nt&UEEpZOqIY z?kB+>`MU7x4@OY^KS}EraK9ixXIGiCk&Ase^!X8xTV;>Lr%gMfn|Pk&L^Qk<3Nn`U5RAIR2=hQlMERDnmUIZt*MCjB&$0|gpsQQ2%bIfi-3 zIluL^=D1?E3Az>xwYb_bl5#fnu{j#3{@fwiFw2n`?0U;kZ!0_+Voq@UF{Sj`D8K8* ztvd@YLb`M1=<}@QrgZ!oV|#vW@oGAMiH%%Ot~A_ZZzJ;(`3O*O9&q|p;RotaJe!2K zm#NH)sg!XfnRK3Ay3X2Xyh<)ABHjjVU{X?0=rb(=%ZteJ`@s6_Xz1u7`J)YZX55>9 z6mB3m$N05O<0CpgIMq02_@Z1G^(d6Ho0#(xPOeMO>h~Vlo1O0CWF*H}^oi=~YTR+Q z-_SCT)EbHO-wNoj}%cD3qfyX-b-c-gF5#1!ITWt%^h{f3h8!C?w@Wn-thaoXJ zk=Q^Up`M_gk(H5#1Gf*CnHR&mub^_{zM7Logft_fX8;qIxY2b)p_7gm06pJYxy1Jd*5<%Mk3Np;fYo12|E_4k=c7w6dP;j7_W zBqY1($NYH#uQ_osRf0r#YM%C75^&cOI;)YCnHhuX#fIO=t9FREGEBbuPn;~c@u%HE z&?ru~x6$%3St}T?K-df$eXu8jowVeHVB*p$T-UB3GKyefn)3rvTy(HMrg9!W=1wMG z6cGh}Ehkb)?3)<4NVUaBgB%43nf6(Fq$eQ}y8P_yfh|%n$CHzDj0=ZJL_$2OFXFH! zqJ#V#Ru|qije{SY!esjrA9o$c%xRv*x24updCKOim!s&kiTjU-4=~&uzo*!B12c^m zO1OUxT0-#pk0{cAg}c|~A!hJ@>*8&14|;`3BnTT9Vm$C<#+FW0deBgU!BLTrB8D*v z0PXdn%Bm!S5wLy)5&w-QxDEGT;D6q-%hB5gRUES|3N|-l>(95a19(Q0H$HBhWzkgE z{HLq-n`ZmoHYfexu4~%LTjH=lG#o(~$e{<~{gZiPiE?3PtslZ3tL<(nke*Zfttufq4Dqdmw ziu;B&HytzYB2pKvmMDJRf7OA3Q`_ z4%(PB#R_ZODw%-G_%)0c#M99&bmGm;B|^|6Lzk#7(JfY|c&*Gen2yqVb~!*9dwS|< zN`UKy54(s$x1>rah_En0rNF`h)@hmOKx2YSDgB;*FTX%espLI9zR(^V0#z*)*#8S_ zro_$Cv^UThni|``$zh;G4+;*{zobD*K;i^!T@eH}VyP_jQ)1R_fM`PsvqB_0tdTcE zAo2i4VX^|R%f$EfXz+3pB6*1d{>Fg(%=`(rlC?0Sie&KXz=a02vv2vvw9yDBbl|+6 zw_n=1`0MSQH5|PsRi!WBBvpyqPNf6&tq}k)Z4S&-RL~Q0BjPox*zRxzk6*DhA;XHK zkpl7I_*E!?`TFh;Gga+O3u?8MzLZEfPRgN`df+p0fV8hNe? z1rD6ve}#BXT?T`5L5^TiQ6n0B@&Z-{xx{Z2%36Mrtc4uG^1jmd;89&>E(Jh|BFcs7 z7*<&W(fMUjTYjtIpqzRg1^cx=wvvQ`YGUVcT8x~o3|TbZF$Brul}(KVz~!c+rHMyE zQu^J<8)C7dP7UB}malqo3qA)R=1x}XpvWgW1WzVml;Hx;M-oTe+N!%sB*9=n)~*r6 zVwL^MwUfo;K))W#jyXqLMxSi%&887b%+oAXLT@c^2IwHCl7|edInPZw{jrsc!CC1W zs0Og%Ti4Qn2uF#M8L#96490Omm&1tptsM5pUi}S6;jYwYA8|uo9IX+aPagmaxD^Y@j1?3F*;#CDUkce$0U@RsBSgZvQ z8{}!HACU)8Dm%U%1gK-nN=!q5SvTI*uL_^16{d^a?XT;_=~`99K>|oh9>&Xc^>_0it;IZhW{=asoA8!qeoEV}A@#ksfW{Z(h^eYU8@;}zY<@BG?? zY4~=RqjKr+Mbe%rzu+x&5r=*R~Pumw6A6%aI)uHeE&@#m1#oiX;h&x zafI0I+f7BGDk~lsoYGPexj66Gq(M!5On*izC(1s4s6m*LF1kVkh}BU)?;__6bga(@ zO=Yed+#LfB7Qd3s24R};`kb*tJxbI={6D@p9hClJt=j?ZFcc^m76G~frP=s}K+fC$ z_-hsUV;4B(Zezhu`>*XbcgImBHA3R-1={pU0C*^gGYVOj)S{Lf^Q(68H(5b2WWCrQ(y9P>iF=GDm0CAlwHw6OH=~WPXbmXWg=qYgKux;tST|hF#}#D zJ$G3~bVeC%&G%3YzV0(Vn8bPe2gHrt-RQP;sPIlfOqkio41}HE&w76D{;oCl9FQ~n z6I+oG89uOj7q(@jZ|6)Dt;a(sAmeh+bk2wbgFi?3Y#j`B`|!15@M1FNHMKpy@wg&Zp9Oo zY2!WztGb9@pE06_k>i|pi za6NwtNrL<^JKu~_^%z1>lps_B_7_Zr{_^^OBziFQGN|rCaa3jO)Py#1Wb#NTc@~^t zFyl(udQ~*zKBK#*V1#QjFbTUHN6`X;no=@nP%%VBzFtk(N<1jMLwkh#Usp$fiY5ky z|Mqi*b#(CQ&ZB{%#8)_z{`koOjvW?3gU$@UbLp3}YjsSc4t;=e~Y3I4;}LUE0c4Ew7vTLh5jp_sVWULwL#q@lMi_+;KGZ@@&ELc0-JyM z_DTKrC)&rvLo#U_kil#dok2YJpof&~QE%H25iQezQHby(FBnp{M!^)9;)A1ib*Pa0 z#eOggx5#*NIRgAj?{N!Hk^;GJHYEt}+LZ7*bZnVfvfEAgZ%avRU|p~Qex9Px!ROgp z%1xGPpD9AdA41=xtk^&22Y(9ut!?{ilWaVM??rGk{v2V<*s*#UGig7CV6*M`M(LWC z;~Rz^^y3h)M2R{XtW$e^7E@Zr_1uI}7~G*j`q@GX<365t%xTTigQWfvG3uaVr%#Ol zPK}@iD)|s|a(m7b{SkkiaEM-J;wRY_zn^eS=LMd$HYjbE`3px%cIZE2z@&1U=N-x% ziLdyVbA>(GQ}@1^9#i_$xZLa&5(MI1C*iT~))y|}fl`a_vJCL43s(=59?z&FY8Ntf zpyC}EMWpm=u$EufZP9FI#OgMa(Z2&n47i%MH)ZwHNrVpcgyw~ePF4R1HeP2r40Y;x z^>v^t|L4KC5E!5HXb%66I~!7;Yd>cvIK`-5Vc&t3VX`X!homQw=h^K~?rN_$V430R zW(RwB*tVGjFKsy&%)~*jr@(W{-H$r`xYzZLa+WEl4>zihkRMA~JnFq1lbyS2UaSf&Z0Lm3RsP#8Jbn0b`Kgz6wBdxiVFkG>qha1NSQ{DXuB-GV@#I1Mh=!?xliF zokWU@5dss}gxtDcx_z5sw+SRay|k{e8qT{eueD0YJE^Lv6)$A^auf)YeqJdi+bby4 zBPeo#_EkqOnxne9))jtqwAk3Ox5L||5tTHy1>1*BIt1XIb{kCAPMbq{huOn4wTO)` zUX*h4_Fx4-$cV1TvSXS6>Ivdk)>cZh_ZoT533oyvpsL!1j@N&)xcTYvSX{e&GP&kV zWU$jC3=n1;4j@enJ`21dG{((rO1@g;UgXKmHpH(}D9;<6W~lZdO1)Xlk!}4d!jNq_ znRPgJ2RS8L;l4ab*+LRRnAVI*)O_eQX<`>cR_?I7%}Nzhn~8Ujzu1DT-X;t9+g%R* z7sa-qBa=2X#_{Yh&LmPKccYhilb|)a#&pVs8oD!hhN%NPwZjhcZd%72#x1NBg}20o zs>wp3arMg9>#jAIhIY`F$@j`N5LD}YlpUgl&MIR>cgQ@%UgL`de-wI_M8;5&-LEB4 zx7Avni%GCCkDs&t?P>;6>3xd+Z`^?^8~R}QcVFKThE8y(`rDe`MC=5#sEUlsDmfR9 zW$2E!E|Eg7+uA@SBYQ&sN|=}238-~}*4*ry%#eKsL#Ijz^!Ng{p;mv0s`C2-{E{i@boj|oS1DOYKkd4{+l^Wi3fP@%7CBebaqi&-m zd0S4l4UTu;bh8gZeKQ|B@Yka+n#aX63sXUS^*|4Ya%-`B6Ud62*d zj_>??pWFJ>%#Dr&5)d9a-H}$+1_`NbuV#6x{ie?J zJ?yI8z}G_difMGxK}%mSwd%8Wo2QO2&(CJy{(|Y~$#Z5D+0V!M7x03p=*elOPu0q8 z|wjH3+UE1qn8nO)sPKZPT1T6aF*GFbV?~=ruSqdq$lKqqobgN zbhox(%ii7FWBpc{kSMwdLY{HP?doHzFTM72f$QI37bk#bT}UxsYk^|y(js47-YH8 zgWEEcuV&MGDP8z->z-XdJfJ3WtMI z(bIWan2Qi!{1QqV_YHjZ3j0#X#UW^HAUO!NXfS=?IV(I@|1aL&F-Q`i>l&Q4ZQHgz zZDZQDZM&y?+P3YUwr$(CZEel-yx+#ge*14X_D4ljRa8}E-pso9)K!v|V<3dMBYREJEXLfiZHXTXs6c!G)>Q{^Oh(y`%`z zV`$mS%d2&-q6L>!hZbk;j3z2&tVK>0Ja%r9-_TilC5NDuQk*~Hlg&ZKRk|FscVdlU zrf+R+24D4I;sPkjyJC9(={YWKMbn*k%heF3Wxo^j^4~-N?4r$PCq>&2*0~a69E9*DV-{B-Zuyk zfq%5%s(`THPK6Z}`RP7?cxTpM$*0hsp=gUIH*qGoc<7vifFWsyeu;eY*)pwq4^B>> zgA9Js^hv8d{B2KNQr)t;m@H?SQaR^yvhn#{^}B%vtHh2DJQV#l)xNBAfTeYAcwHAu zaqk*fdV6B(v}hI+qCcS5Ad6*%hMmLhrWl9Tc3(P=!=ju zWm?iAV}F{RyuH_)V2}&b8Sa6?V+WXq$py-U9yW+^c70=BU}JUzf4Qq;HDO+1K6t>r z;o7j&2ro6@WnQdUYzTwFv1nuqwOe&e@tmD@7g58@Ol5E-r_CBx#64z)njdG|_0-{U zV_{B4>5(@Q=fiPrhPf-rGmi-BXbg*~dg}B=Y@uSvU53AzSA*ahS~#|`snhRPr(Pl9 z1RBzFwRbANZ%cH_eX#=)4HQeZ>ek6en|)!3NFWUJX5Uc(&fPl>N*W186Z6Zp>26|X z;A3w=g22e2yvC20q1!pPioCle-^pEbV5ml11bNU}cIx~ZGyTf$sA?MFA&Rz+6o>cp z=)>HPg&#^KHb+g{UtaG~ZXd-cgXJNusv|JI@e~TN30-_fY@3?^?eO^VIf|YU^s4wJ zIk$Z2>sNG(Q*zx@f@CX>5l9f4th*@;ElqZ^x=w1K%`m$kT(aDST;ir>@M+liwmJ9OM(Z`CtuMktw1*V2Surf0vC$olX%yqFXfi5M( z*m1Rt48!ic^h@qYVvJ&L#L$*WG9;9}9y>Fql4hy^GpLhVVv1hmz)Pxv>EgV0mYyaY zu&(l0MMZCnqzoNP9At^)wYE)p-(ad%$+SKlqo_Aly7nO&T9S~xrEk5Rxv60|(6F~9 ztUwYFL`kb%d3|FtHw>jAUGs9{4jTb5)6Q@RY#!A6@5?A5dY$(Rf^REZU#we)1$UPX zwm+pjp5Q}f(ciCrA6HM^TRDdXocAnXK@W?;7=TO%1?vvZklbsvDZfV6e?O7L)`_N)=2CMN~x-S*4@DOQppZs^QoIrPm_8~I+oGMdQTgR=At0Cy+V|~`w-B`JdONt zt}Jy{*VOb9Pp}f2mom)GQAZ5uba?&J_%y%X+}sQ^ZO}EW*W1-lThky46JZZp&UBZr zuWdkNwYFs%>Z@ILI*W!57;M|YaB?E-bVuN8{Yz)hFd1MzqtUAW+&=aM>h_}ho`nO8 zVTFhADNS``b=h7+>pc%e(Q(Z!&dvXQMu!2@Ebfv!a^HcAbczkv6H{wab0hF=sp;+< zTcZda$89aQS)E}@M&40S+K!wbWzVF&=z-kYO;U5!v>qJ;m4_w);~$>hfJL1jL!B@V^Mp**D%qII&FB(lao#vOUN=I80LS zvb072BcE61y6F^wO|~tSH(0ej)`B{#@O1> z#8f*471g`Os*I$>6;z%>y9zEgF-b?j@I3f=aA06&eKm|J*v77l2@T3Xj=r-hq^6n= zwsD9MIlP5ONc;$hyL?Y7^pq8}aA%A(=e8Z$g6iwy_Gsy? zCWh85O$vQQgUjDj`uHjlknZ{RkT+r`orJ@V``jeY3=UopYI*np5y8)eD(_n+`!&wsW-2UABf`|5 ziF*q(qX5$~lXS*qrmQj>n3fXk7zU{q!1taeABE=Wx)VI30W8_g)Mw0muB78kyP>+g zghB2(Xy{<9iNd5$2C?X075H~B5RUKMe}Zy(rLyk~)9bp=b^vGI5jLkx?nZvXAZph_ z*P!yb92f0q&qB+zmW3ei!}>!i>Ok<^{~`Y3M@6KnchzBf+%v5g$@)As2||uZm8}iK zQ(y82fM&(qZ_M$1B^wD*q@Q(xA=K`up2mQAwB6D^s=X7*Oehzd`>14IzgfhnkL3+c zO}WzS!F&mo%@#-M$cr3bvHg(@YaqV088{d5RPK;d?VJc z^hY1+CEZ*^PXQeesApF7P+jRbODKDnNvK&yQJ$sns$|`q>8Q!o*Gl9C8Havt_pkuO z$?yl|8PV$lY#X?1RJS;07b)y0}oQAx|! zn&D_Q*DC_0UORM6t>KDB$u+Z8G|K0+_TAq20{kUWn6=2v!Q>Yt3ve$){#wP#=GcZk zfCCc(r+pM4zY5@}{%vl0fW^PxQUq2h*q`C#Z!w)D#}uFp{c z0pQ8TjHhcq=dY^f?>e^a$EWRX-~DU5?2nJf{cDShMyUb+a3B=?+$GGf%k3}OG3?iF z-}f~)x6PW52l*MswmH4mPjQT^jgzV8PlE4DJR_0)=`9b9?Vm<5Oei3})F7seDtZ^f z?)28y*1vxe*Qvuw7yTH&1ddjPbZpfw>z#cLX=3-Ld7;N`*~-McQC`G?tpf=1H`Mj? zj`_&-s~ZRh2m8i?li5V}#w}FctbwSqYklaWg#BW?-pSL$PG~B4eOc}u4o`zJ4dP|e!*2LIJ zFF8UpI><1?^wqT1L(_nRfG0FM_f9{%b72x<`R3P}Vz;9XVBb13LbWV2Xj$7cab&cA zAAA_9@gv_m%X&+D>)fa`Ab3VmU*VJvzREiOxT4|$Ya)=h(3yF@0)DjtFk%uH}-XjKT zWO{HLLe4MhL-X*C+2A?vg>g%*xSJ8PZsq_s`C61W?6J>e($;PG6IbS!`Fq-B+`7g6 zZawyQ?1x0m7MQARK25xRh&O$b0wH40-KQIWaUfTxRpLzx_y?ey#-F;#?d;)%ytE>V zqp=Bcy`}XnZJc7dl>w?(UNIE|C#~y~IZ9uF-ah~^d;i!IhLiKo@TU^CU!IenLLYv@ zux`cr$=Qfpz1u{v(tnr07WA1_rdt`7MH^y z_3t@1ms!4}eg!L7)8ptImhem)Np|+yp&0eh&Ci#8guLbp+2*#x%y|wz4fOo?R+qjH zb1UiLQZamHQUK5B-VFlYQ3RYyOvi_dNjD!4jFd99>j3u>=MJ&Qab$^T*n`cePoMCn zePzVh^0AZTHXU)5eKjlgCac!oI}{_x7nwBL2_MeGLtwy*00Nu(nkv{iGdF#Dq2jCV zZMJ|7@^}(R{eH|v3T@akJ?P(mZpz_#otE>CbkJI?&fzt^wx)SY{3RnKXzN$pEGjH% zW@7To51*e-MdKG<(x&Bkwvw9GpPw&@N;Wnj2}$^n`!a8M5p4VJOVsO$F^&hiV2-3I z;zOgrL4_X{8glWK1@iPcal-@rsjf}c`KTrB-*2bUevTTM8GtA!8f(xLN)B{7h}SQM zF`d;U1qs_@mjhvWPJJG>+^LjdMdMhhoquk6BW-rI!7DwO4>vfzf%LYd5!!SBMD+KG ze$AW%G5suY^_3cWwAX2HZLQ7S%!foP)s*BtEG*6bohU;X2Hd4CwPe&|dsM)?xuQ~_j;3Z7n z5$Y)j0UH4>eyZTIJOy61sOJ=t*r^Gb8oDXRU}OoBYmX@9;es24s8? zDN5AcUxd7TOz;kzK)A^kkM(<2R#puU9{}=*cu8ACL`U=YqTnwjH^tOMCOKGjI6#FD zFEAW7Bb&8q2xcwzfWJj38bdm{wRjLXEh6NKKv?t&2f#tj&UqO2G2TXNLa_A344OeS)e z;OjhN^LKQ(MtaYugf{P{+fVUg#}oqZRTU;IGz??1UV*Q*pAs^}($E>w>c1+{5>mC( zWoy*q(I^rCYIaIyVn>TwYIZsXX5{T|FokE!q(=DRfo+k%#k{uC~)oJb`*cY|5#mQ2me)hm_!EI0t47$90VmBZNT3R zfE2!%^;;wPv7{C9g+RV0zu&)wq|bIN-?qO5zDuJ0=v^c)za}dg05D{F+TY~QxRuH! z@VPbSOoZnWDWB0F>!CGtE&JyP+lUem?ZcJ5K5Yk8nd=F1Gcdp3p!U&JuC=xJ__i)( zy%=i$v8QUQq1;bd zci+2huFy8USIxsa{E~F(H|*NeGH@wa^Hg;}a~I^FVeLuGD+&pz>E;yxCNVY7V|mF4 zx-%)4VD@v$;*dKN(6n;S7-U8--dQwRe8DEWQ^ z!3~!e_@ZSWIG*hOEGQ;OIam=-DP5t#f33$QO$ry_x-F>RpXOhC=>wEmX~S}Ep_QWu z@E)A(kr~N|4IFxTyuWz7n1-~rx9(3{sx``Oclml5H94hKG&m$?BJ0Luv2+l(Sm`e* z#)GHF0rNV5C4$5LEFO==g=-qC+%qY-WQG^HLKENaGdSEM)4``S$A56WO`zR1)3ej* zCQ{FNcpAUCf1ZMTdXQyk{OeRXC2x(HS>M!LvJ_E;4|n@lSNY{DHga!@%-cXMF+{+c zVL~l4F&^fF@1h{WGtRuM8M}M`4G3A=x59YUzLS<$@+gxGMke-fE1{KaUewcb1kn=% z04fC#WZc=!XZ#zh&s)NZ^*Z*C2(tX1>AwzseRF?Onz$Kpk(mP&76bmzJlL!|g@uKO zP1>Y-A-e+?m|YYNb}$ZM)R8XN!7CcUVBjHZ>R<=#0sNepel{P200z7j^G242BN%kc zcQjzup+1VKx~W=nbhP8OE3iBO=P26(pB=+av#^*94r9=Dl6fwk*yb`&3JMAFgmuXABbuG!T1{P&#>W%tZO36C!Q3$wMQ zrKu6|r@qg~=eS(_6X&bupB4yt^M1Mqr!{gEC1op^{Ug=1ztP0yNDr2}#Cdu?knRIm5k~ zt=9fO-5YAWmR;N0%Y7lYT~^i97+d;y{m62w7;S}a9d0gGB)V|P$jKJT!R*2nT5`O8 z+6v%GxmjiKn8^tN=Q7TL4P7lQ%f}Ht07z9|dhpD(uE@fTzWBg}Kth7TsdzK1gdUO)lSgwn?OfdV`bC16)U1f9f5RYfE5A5a888VKSxDb}H4YE3O z=nF~IAXpZRd!UW&1>Hw78c=Y)}L6T zoEjAkqVI_L-B%kuvZCW|8jTIr`FNTwO;KsOtN9|Xs0WTt9$@p5UIb)@-$~RM z^U5cW8FS&c)w`5!`*`7rJCW=6CIdRpwM%Q-DwWapZ-@4VPUJxfxAsM8v)R|=4B~~9 znQ>!C&ZVPIM(G4ALFrL1x`Zog?}=&;F8w0t4==}zWiBa-@Y%kQV4G#uIgo;IBHoa_ z-RNSWuutd>nH)WI#G*xHc9eGFa1Ek_V6pm+@5*Mor4Cx}B9^jRn~z)01(KKF5#j3| z)!Og}2?y1p(fTtF3}twSBpw_C^APCMneLH=2gbB>Y}WG*nFskyJ`Ixg;BiGx@6k@s z;W!qA7~1C6qxp655VCumBh5cyKmcU!cx-fZbaf?Kr$2W6?-QeT|M^FYa~a||$dH$# zV2o2r$Z4p5vXTG}{XPSLsAFFkHnlbeaB3-lfg$cSwAi+kI-Ch3@VPrq@w39${5WbS z;5_+^UE?3d8_zkRorJ5~NWat%=ftbWb~hkn(l_i0h5%&fw!f~LnZFY4i@qzPlbSQK zzGANZEHSOD%zUmAw!c3`lo@xnKaYx=0C0+(?I zWIT76O6WeW0vM-+DqTL}qJGB{1(Po5REH2X!Tp*3vE}_d zIZtTJ?U%zbLcfmZ`bYfdQg@_d3XX6BB3n5tD~e;N$%Ie-Ow{v+i0$DjzpzBmAEwIcq% zO&j!IdI6KsfB;a)>HrWeqCf_h1poi7QU52fH2<;Z5B0BY%*>Agz$pIHe&aWw)ePX7 z5C|d!Ku`q<8VF7Z50KIWp1}#?GX6)nj_uE>{~vuO>ko&X|8$-C|L%wU|6L~Ve-VHF z@2_^vjoPF3hhyd)rr~sSbUcloxg7Qe82nzPx!`M59O^f8p*`-8CePk`c0B>j zPfj3Z@8_f$E{i^J&r^r^Q_--;tt~TO1Ha{U)0@rm9(~|t!$N~!?#ZlkMP3SYy$R9sX8F){$3t0b6NA^h|Pf2DJJb-XS_Nhn=BTgFpeHHP=7 zeI2zCoy^XRfsgtC)>XVH;3JQbP{BotlTqPO9O6oZOZdi5B~}WAl5I>?+NEVjw3JYg z?OZ35Ot2Bnyw_R1mm~^tZRrUVAme@(0#Y2aO0n=L9O$_~VCpDR9sag|Vg1reK=9!H{5QwOP1B%(-$(^}w;(Jc12kv=;;MJ}lIh_SGUd}BcWql+T(qBH3 zNDz<1WIBIjA1S18&R;qxI%e(yo>Z0FS{){EYzxBpuuGv+fb1H$aMhRf2coMrS1!a! zkB_Us1!55`nqU;p)11*B9Thxz3lL{5s`EyFz^_EFpRIm71_{DvlvLs?u>zn}9^&|_ z?j2ECs=@L8z9}U2`1Li%8#WJ*CMT3U?L^2|G;^wDKnhdlJdB#!d7H3Wer}wfqT1r*7ek z2ug{i0AmYbXy7uY2fXe@Kna3Ybm92}vK*Vpg&%O;izlL#YDP@pQJj;Nr6_l9U;hI_ zkW>vWNzliL?6nC8QHzmTp87QsgohV!<1Ob%3@s_x;E zSTPsK#^-`M>2aV#{AUTM%6!jYDw-APm~iP@E3^xfm>-y{3Mq<|=9fN{P6ft@t_&;v z&@uO$Wu*#?GeKapyE!6NkF}#@KdHpsV=kO1pM0$sb2n1Y$nldG=T}g3)qnYjKmB!6 z!Cs6~QaB7C!z0Iqw5M6oN}2~k>&brp`{r7@d-EhGn}p}2s;qRM9meMH!!U_rDG|J& zfvntXlRp`>C>`z6R}3##>MtM7FG8T&PZ{Q-5)d!{H6#b4R<)-T=g|Wq7)~Q$((r3?7gC&Zq*?L}!8>J+J@b=;hc`nX(s5G@}YbXRZ zf8L<~9p+OKi7WEV&J9ombKlcZEp%7kMQgpgBu$SAPIG~CE%ta3MeY0`Cs+^++K$tD$DL2T z9tNyZuPkCgM_3`NOej&57YL}3fM)Ykx`b4*`>h~KcZ??uJTnWOm~eVIL*)yP*9_O# z+DF3iIkH(8&5o-}T{=X9z$`c_RZ1N?^#}esFVdFsl+iPmp(MF?{KR-ljl*O@EObaik%5MQj<*A%P4&PhEe)+o!DB#`Aa$Uk9`XdMr$bVIe%zI2 zHV(mUX>nN{`D=KSoweQTuq5vnf0ZYyfUkQ3pkowpfc+05_|&7P)r4AJpC@?Q?QUaG z=}VmLe#c6#?UjX#CP~ZiZ!pO0_Ydh+O{>+0TGBP-z)mh(?O^_vQ~1Bs77n|5e)pfr zsI3_~0Xt=O0-#;Xi1^} zK-oLio<9@bD-yBh0ja9|ro#=`==>^f@{-#$n3-yehjCNkIu&wmg4k|tV(oEvwOd^X*4v0$j-R4Hn=o0dqiRj|*KKqi$jHWN6V6g^F8B95hry~#Zry!x)>RoocP?mT ztjGOa+4)*>#B0OB+v@e?MuFg5>w}1;MS+{MkFGycw9v@b&KsSRJYuCYuRfNcJx;Pt z5mb)fw!zIfKBo1?G_CKdf0B1F-S`jwjQ7|A9Vp;5H0?Peh2w(~}d#@SooQ z-s`YGiGDc|!etbj1PYSrJ%(}gsp-Bw%JB1gB%mdVj{x<~`#F}m#o?}&@i6pze~@X7qV5E8pO<`01FdrGlO?K8^oy(%LOJ2c%2@2^*aWC0LbXS_*z!T zZ9p6Wuy#&PP7Oc*q3b@F08aghiwjynSr5QWH^PMQm?HlL+`5c_@8O^Nr^y_hol&R! zGu||ITMpkpLwOW}=xS=N9n#a4sQ^QQ`6K?6qCy8WUn7Df&NHM!r&&NigcJq-m|$A^ zGvH2_C!8!%82By^|7Xy>p!~d#+}r{umWYlDahqXuE1*xJDG8;3cE;z50B*(PL%!6} zK6van8w~hxb|pOQ@b$-FZ|~^NiV}9D{}%8E3RQHiFuEiuPtwP6PhCj*S`){5gfJnZ zE}^r4*8^bm_v-MN-g1Bm0@N)Q7J#;s#hC)vI2l@sx?_kVaImzdYM3{Kii1Fj3 z!qE~tN$M1+(wDN8Ch-vPViB>eR)uk8IA(uMWrOos{z!##EmbR~`8I8e?0X+Ub7}?` z;(yJSO|tkFgP)T$mT5c-D^W*P>qgx*3C($g6_R5}S75r;rxK>L((OJkN0wiS$~`Ur zdSnp(${Zc)>aBhv+qIXqG`5!U>@Up@Xbtc3)iaTDl{2-yZzxI%3X1!37WbX%oM>1x zxUrdn z?Mt|})NnfjRePA`;q-XpUJY-7f&Wrmwml^&Gq0qEdiwaIB`1m`XFxAUMx+{aKi@2~ z;bLpK3ql>ImCC7sg(V`HFc#Jkbf3$8rtEV78D2DUR&5Z!m~{|*Qh7w>hY@xFsTca& zNoQO1`w6dA8`{DeH$k7E(H8qSm~%+%-Hpyk?%Tbdn1raYX?SgPd7wvu-m3wF0g3t*rCL`sPcGot2CX^_6$p=cIK`ZnWlUO{~*Z_0@^TU)((H7>!XPs|U#0 z*>P!U0eR}t9hdrHGDt=(KDxN)CT(nsDjPHDYn+psC(TX`@)dY4t`EQvv?j9JT?I8& zc1m%3?3=%i&h~U!I;=hS+XSgYn8XW98cQmCT)y*b3XtN*btWGtBO}vj3fSqh+uW-E zaD;)tv|mKJ$VR~yIR@0FU54PS0R1sO=_^Z!KOCA1cqHV}I#RF@@-p)sHgrhDz%AM! zY+I7~*q^5k^A^6#J78{ISeh6Z1kz^XSR0z@U+l7rOF1#Jv9stP(l1_=Un~agF$m6S z^vN_FqcxxU(^Oxtz9V%J1YML#_I~1x0%Am?#Zi_BII!=EieNn=1p}Ona&{p31wo-B zSB&^LAbbi6KG*-p7kN4K01}ck|Dw11(#+?@Kle33f_JmDg#JHHiT3~Il>Y0?`d~r< ze(t{^-M#mpQ#yioH#9T^L?~QPataEI_D%4gv*D1_VS|IBZ|Ve+zd?q0ogg||TP39d zuGp`Be0T`u?Kmb!LjzfM9i~M~LF%$Or zB{Sfs8!iA2<=Z#<<;?uyCLsE;eAwcb8UAMF(>#S>&>d!s*n#<)g91FdaWueO@UFQg zOKz1uip7KSh_QnH7#)D=NN32hBjTQQ;!LN`Su+$m=VkT1|COGS_tOlzXIG$3>otHM?&POR9pDe z;(7OJT=4FvbRxdqM{B#CA2)P0BNu5H?OS zr#|IiT-l-eQdIt1JlCCYyqodw;cxz_Shz${->>QY9KTN;Ps;@ig6{8{ny&M#tj{(2 zs~|Q0U{<#-0oS{OvhUY-fxM!j7ND;0FU&aS>+)3J@zude#?b@yvm&D zO^0;5avv}dX2N}rzt%3xg>^ZSKQJ5%e|yqA4s8hU-xyz%#dc>ak@_3gq7P)lf6^q4 zrppSgYA#*ubh3_Q*pod=Z%hz@5k$J3{4vtt5w*!Z$o>L zhy-NR|JfX=6bHWgx7%`HA0cm9urK$LgLlW+AMYN(+^$~0AxCjgr84G|2wi^8GF{Rb zzXb_PZw6TO`{n_#6X`I73&4fd=6Enee4K^+yBs6u^4jPUmHU|l#GywV^*;pLjWPVc zHl1ItOig7SPkL>qEFwO3=ccQmDW9j_A3EEAr(F^*Ny_#3a4vV!+?J|TmJhQpJNa?i zCzPWH!LM4cH%41dfBBBmUfQJ?UJ{pYx1hT8R;jF$9bcyy`F$HvX1&J+aPE*q6yw@E zt1FmG)W*W|;eJ`Z&S2A#u(HntAX0RDWy1q_Mzeu=&Yix<4}r{xm-)1j(YW6297)bH zHwLy^L7IlQ8a3oK8k{re^oC59Oq$|`J{o@hoXj}wmpp?l(cw^<<$P@La`=~0075$w<=!z8*a|KBius0aeqUNxcwo5Ra%AB((!Zn@KS_}8 zB7O?>wj!+chP8q7TAuWNsJV}QDU@7N%fS~npRCruiHfoFKf1>;$nkxlhcv@w)|Vti z%uc0n>iKqImU+CmWqJMFHRk-E>5c_(f_+|v3C#Yh_~z$L0|95I4!d?w+<2t*c_TPb z-eQ+M_DUoKc#M1^2wDutV5K?L;i96jKp0w&TQFZpN3Jb|aO>et zkD=c$F}$49DHwGLUI(WU#OOB`78Ibo@N~Vdg~$Q1zB0+fhj*ZcQohx^bpU3VZvcou zk(C1^IV2^jPr#@-^EJI?adc>7O|Fw=dk=H!r_`o`+H>yKqI9PYUNKNezthCwl1lV% zMQ(b?+NA(ep9H6BC^{ReY)(GmTP_{3YAT7p+G}&VEQ8mR@R_Id^UJegrRT)~2_Ty) z%-b)fojj(5?xw63>!gZO?JJs6sa6s>*EHMl1?D&f>E?DbFJKs_>2E||?)`~~A3Dy9 z!PfQNULbHTZo-v5ni=6%!9`&RBQ!eC5$W95nP0A5L|B1nB~)RyPV5BEVNN(t zsMGsTsUTJEP_(3LBL|B=ovmYoAV|^>-3skauurDf1LlIBN!_POr$emvO3U=x*A{j+ zBc~y(s-A1LnVDFVcsm0tTc=m2pS#6IZrhZ|GVC=Y1%KD0YIIL7uNePOxr%X2{+*tmy8)GqggD&<{~rkZ))!B*DQdfVZ~V)EAewts@-+Pj!KFqV;TgO@cF zY80K1(vy_PG2;kI=cEkNp3MYPh&u`kP35S=n~aW+36_yj__TJ=?{KCLi<}oRYD;fJ z^ik0a-qoQE`)g2sLfI;i39gR8G_;SQ;No;gbt_lkh%nRSX3h#0LTkERLdLbQVQ7~m zG_9R>(vPvRvAHqq)R83B1x2XX;K{iBxLYK|WAU~jbd8TFGHrfRstVhlZ!}8ymdM^= z{`T??)MOkdk^OrsX;>jU7&%qdXd0CPZA{#Z{3B1|C+b4{v~(f+9+T3>IulQ5>=Ngw zsEm-`jSF0?eC-`v?IW4#eZ$b^m)Kc4h7z1O3IYW>QGaAC!AGO$Y_l|mw<-$qkfT5Q zVDX=1ADabjO_Ey3C}V#uu=Wa^*G66`ei*dGO@$89%?=UstCG0Sr!Hk1T#fzA*^>Zf z0kQdWE<|@?@zxEIa0JRbOfK9BLY<`9Uj#ieXBB-@9ytrz3=Jn4zQqQzqA3W`1u=C9G)Xz zR|^2CG4J=@?B{iQxI81~V@$$l$j|*RzW;}A_#uDfZ|8S!7OwsBT;q&rxCw9jax~8Y zxO&!esTO4E?V$#SR@Z+~Bl_o4f$W~M%gBy;bF$Z2S{cW;ML^23&pjwr2j~TCcOl=k9&`R7HcXXe1ZEw{`J2gD(;3jl8D62|1lr zoU`^4|KgDFzXSb`>`|m_f3Ya|ytu9zjv-Q)|Yt5EE7v6CzZcaT9ztzK&fB&uXr5j<3 zzF+39yZ89%OWXV{-SNKi(sf-{U50UMhk(r^K8A70J`4Lb6Iz#(!gbY*l^w)~yY<-N zr`C2?oxWS<{)2ASsTXd^enkXmMbovz<`&1-g?i1_I!-j_vCI3ucgp^~tGe!AkC^@Z z5#Bp&oh}gIf9S{&I$eRDJ4~LZZ#r4=PJQP_} zbeN3kEKF<7gLuHv$tBX&E&i{V7shJsp1E{(SsuQ4M1(SM zW#&g*q>;5DYa0=z1f>0AjHqKkQme*wpQ?ssX_ggXV^tripVjdXQj@f_G#P7XJR59>R;Vo*ZJ9g*Tk(fR(5yv4LRY3_Pd+bBllM}RHk*9Xol-UDGPUGUK zkfXx+hGH7#tt@78w-eHuhqZBRpT;FA1r>YUrM7`+2et&s)$WvF%+3uCP{sUD#M2hq zQgBWjjCBUENh082OmR3YHp!|@O2NE%m+$B|Hu+#s3OhZm#a_$Sw?VCyMM5mfEKR6~ z!!&?mgPA$f5(i?YH~e_J3Hu`aDfmVcQIJEVuF=;<5}e3c@D+q7>uU@Q+2!JNS(!)u(dy;f`o7OJ-Sc@i z<%nlV(u3w+=A|#C#h#Y5ita`)()jz!%BpypH@s?}CEh{HvvAqER0>e)MUIv6Mf6hIX%aI(u0ApoCS=do;LF0p-Ch6 z?y-23W1RcI&a5@^Tjg=b-Q=joU#6G#9x}f(qHdw}baU{~(J`0{T43DsYQ_d8fZ-J# z_7|k=7S+9~C4czVlt*?OSepJFK=yeW!l{S=$;Lj~Jwc;e$Bd4Ej2g9yb6T#Xr9)Sb zNT%3N%gAt@v@v;UgBU_HoZP<;hF?LR_RpC|&~`j}HTn~MU2#hAY9y*tGVUh$AE1o{ z0NO0XV-C~qckO>_Gb`i+@WtNC9g0&%Pgd-I8q{=U!y{K^v5zxz-V>3wR9q{>opg?B zm1m<5u4F`@V{@n6SOrbxbn>n0UF&hUjgN4xu2*)lHkEX5Q?$N?hP!$Ey_WI2>{-aq zbEyrIw%2k+gi#edNv^ZXPtj1eRiEC;E%SP-qM1p$S8h{pa}9{rY>O2fo)e%LakVni zm)rHfjQX6g!=dotqML$MiDI_yyBBO_Qh7h7ZSm&qPlrvk5>#@lP)o$$Z zJoKV(w)xN|is^%|yS~B0u%JkIeEhf*mUhGbK1=-iY1$QGMZ*xJ^A z_wMYjq$KJS_tGq^Vm;*sNx*Hru7tMD6iVWwCx^q!?@7zp`BnUgGacTdfIxtbx~g zBr%Tja1YH2{Bl8^o1C0~odmt)mGP+#8|_V_4gt00B|f8bWatVaOTiTB2XTsY^9^Ao z)vSks$?N5HH3T-!j!O`Yi_3&mew8Vj?V{4Lt(}&~|}W@P;gH-pep^8+@D4usfHM}A#9UiELAYn(ZD80OXh2srtn z1TKAlG%vIHuPoUxx97p>R}lj>Af3NK|6v9kq2HhsJ7Dk9h=#Au(nx$%ux|T_gE!+S z!41XzDO`JkOTzwpq-O+B=+@zU8;j8(`BhzYV7vmEeb*|MHeCXr!lkWcV96Edv}v&< zC{yTeQFb?n+DC5>_8f=2>1%DhK03^`!6woaz9{HmUL9xRP9KUa6)TP>Ki56QViT=) z(CUW{9I#$KHKeVyGVV!etm|U?F;B1OyDS2J${=0VwUqd_{P;%aaUACsZyVbaOGOS# zWu~tF^u0Yg#)#7%Nyu$XDvDq0;^CNjI1*=wd{(@61O{)@R3}b6Gu})=60{hoJgj?_ zB|WmCpRPqK(O5@qt*WtUXmZ_Q#BFG7ymB2hK&tl~KFYiK!?N#zWO|$I1;Y?l;uBk%=wz zULHk5r}$Ap=k}3RS@0ruq!)|SQRfpsTEdEFy~gq0iwypfb!Rtv9q^g zwX{f8b8F~i_Ldf<0rQ4tJZf7Xxb6n4v|bHeJ*+TOe}$%+)qxMq)Pk;5KK@aW^ZNb@ z?K1x;c^6vR{bw7Ohv+u26d5_W%vJ*qF1GFt#^JcU>Lv1(&$GJ@XTLMrKa6!2x_!EM z*@F~4!*ATp>~*>S2YYW76=%@A58@gmXmGdS?oI;1g9i`p?(XjH?(Q}?!GgOx4DRkb zRtfoeDC5)a>CP441H{EwaWsY5r6kO_ zUjh!71FqyL<{ELxd%=;7tNw?@Jp{a*kRGY%EjGWpDjK$LxYy>PsBDZ_=GB&<`e>25 z*kZX+v|4w29X)y!2Jq`^5bhn@xT!?ikZG!_=FtluI{qxHBiCe<$sD9-bhv62({(!% z2S0U|GPOHMvn+72ur7{>nQCJVuRoCA4GjfUCGiWOulpgMS4PS`wuxge2PczVdR+fe znz~StvjvOWsy}O<(Db8l&U5+^mhq{Qw4!kzE4iAxnBEC>(^5(W)eYK~RY@+QkK~lDv(*t`;iA@M_@;#PT}3A8+ae+m_jjU; zae3k0?E3Jp*YxGByN3dEO-c335>)tk<>E(%`4-)uXDu)Ud0{g6FXH?2M(NXowXk9% z_)GlW@h@s8x&z{r4b~veIW@W}vkrbd%Uae~G86%>&f((wcHxt$2hH3--^e;xwrAsw zY~5W~@TB_fh34aChN|rSC1j+RcN~W5hw&q3(Ehbk*?`(1{Gnj{iV0 zH(7gGR^3;wyByzumbqKvt{acpKb! z117}6##Na@t8x@Py#P78S{GzCTw^v3U(%Dc&CAl_uJnI9DAOJgh8zI zw|Zo*zd>1nC0qI?5>iY@&WPt@h!tnO_S-`R8Dir0lJ74M7js>`EUXtj4!OlFzDZ5> zQ~c6v8-+O>%QbSBG6&)wgkLS>khcY zr>-Me>R%76S227`Uf1yL;=fg6Gu*CLwH#z*>g^xnpuoufyPjEiC#k+1I<$$eE+VlI z^5&N44&}M9vV*46bd5+6XMPc>E(sCYXj)9G&TmXayC1_;GRgtgPI`3u2`CTryV*fxg4lLaY zbv7z7IO{xg_6Ym^FyQyu%-Rg7IP7X?5P3!~*Z~ zhp5k53)+!jRkL|js~wBB%j=yZUY-&A6d<%Nj^J>XA6bL{X5h;_U->;tx*Zg_n77LVzPzGAdU^+Km%La!O7F)qy}{Aj-{{78T-&RvF%^rWPHjk z%?LUJaDaNBq{Mljb+O5EZ3^{&W$ap`pZZRu^13}QYp4eSwn%;oshheC!^KtIRBp`- zSQP;g>0Rt8vlh3w$rGLn<`Vn2lXg=5+|_cb@de=wtgvB5hOR=#^GdP|e~N}Br-#qT zVPAaj;Z};Ou_Uu`+sE)QyGi00@0sRw_eac1(<({fh{W27COD6)jKI+b{;SVt_eCS1+6#=16YwhCH6-F?&p3n8tn=K64gs_`47sCj3(+MC`L zgs&$kfCZ;Pz6Lu%R+SCyN5nzA}37@eoC6Av2jr*&E@|8y0Zuu4PpF z&{B%bQr-E}_KA!;05E8TU2$^RW*U~hQu(Qd{@}|4SIVTyOFy;*LL(vT+S^P^ zoqEvYEO0KOu{M#FwM%zr-6hMvCfL9}Q+wRe5ZyBk=NQb2dz5WKGge^WR|FdOCysFg zTRnbDeocZ7#ji&S8IKCBcek{hj5-tXJ#`$*h)KV)IDV}^G*~(q6*n0|#f{!tHjVv7|@mi2q>s*+_86SQ+Y5T4op_%(Tk>oD|B;i zJPJ}}%;w(%0twSp%uiy!QKaBmpg41CY+ENrUP_9rg^OG$_X(-?AIG46{X6n_d2<^^ z+?>nj!Gap{_wZX>{~f!Mc8dGi>?05=!^^dub9uunp-<*qE!wfSxyy+2K69bg$*x9y zNgdB9&zjM!wUx(7W?~n~g8okB05|0dQw}^eZALU`T-;EecoA_EYTPNZY)ulgbF)ot9$sqy1OKv`7>{_m){N$ClRTqo$F-)K7DA^KoC~rd?@w`HH3wkX$Y>LakX2b z1*epz?d@K=BFC?V{gmJ}-K2>=GOWQ~R_>;^-g5tgbSKKX~_p$QU zfV;IV74JZ~aEJAMonzjXu&FWBNnS}`e*{(aN#UChnSi_>M{qN5d!MQw!uI>6 zhD2|QOU1cd$S(>ifK-yKO(53bSUNHhAP#E!%d;9~JP-ER>ayS7JXZMFz>E$8B|5Ed zCH+ZkDC9cwKWy?*FyVtHH)O%tQ@n>GPZC^d9wI>am~sEEg7|<=VFQf+(YF5%wT1q} z-RIH3dfX2>zg<0D8Zz@-E~nFyC6;Q@*1`wswBNyk+utGPed_xe8P6eHUhkLZo9y#?}sFzUvZAtVNN0=j0AFnr27!v(xZw|$# zF0U&a>A`(77&?mbV^=anV*<)@3?kJ#uTGC^PKF(`_U#z8yWR#DqDG3YG_dywf$IBR z&n@QAf~7h3N09dbRoP6|x0?>urVRqvvDO`H?yNVc0J)9V@5iIC#j=?%ci%5s8KY{c z%A&j0eDrkZ4{21Zh7Q%+V{B$t*4f#4={h|*DJ10%Ic?ANkT6XKiW&IN z!nlNj>=I1?AbnkHldWql zcfPrM`zG>PM6@v0F2IAo<5iz!ch&U$!UlVT_)cU4TPHg#f(E}_!r^vgqU*U(#V zqdh6KSB;1l7DYT6jC`l<;Sqx^N|J(fk=IvV>AUABZ0_9p(NIFbc2;U-D~Ypn*CnR* zeTSG1$W><12@b1{4CuQ=@e59#>>W3bit?yG@p0QpS>cwBT-)9oj>Kfo5lnRZ+_pL` zW+prx76gpuJunFpy+G&c@-Bc8p)BgKP6RY%g#1ckWBl693en|DOSQhTp?Yabd1r9U z;#F;Ab_#(kIp6Ltg1@%fA5jWQ9W20w(KR|fL)*(p-N*{-{h69`mXHb{XBojsPXi~F ztS&xOv17n&`+$_ek*hFOv`X`BzA+?^tY)BHo)DMBUMgOO<)?S}D8DGjpa>}Jjde_{ zkG^gb;+N1)xXU9Xm#&S=WR@xH(4HTi;RH`Waws{=!hv+N4;V={EhZE2(eA!RDOJpG z_apT>SoK&RJ=8QLX=p&7(T-ywOTYK0L=qRp6az(Ewa304ouO|o;b0aPrR)@qo}ma3 zf0awNPeDrzZUBhR`YT}HeRVmUieXG25CBgx=5?1OF&@D{#3b-e|EF+XdWW1P%381g z&rL)|bDaD-KieuS52Aj0KSg^bF&XQ@fF#7|z`pS)D425D-d!B%_MP%F3?UCcazB|8 zDFYF~&x*8FXz;7MRgS%GvRMbVDn zjeOOU{7jg8#-9uobI&Hlww8oD-#sq)?AuO7#uyzCd!A?JA~Jta=T%DQ z_r>aHFK4qwhvwKBw?-qCi=C<)u3M2?@P$SljhZ6T5|XE)y_CHpa~QT%ewjhn;Zmz_ zDv~*5e&E#6?y~D*o17WFD)BI!O=@PkmYU%KpwM=p>?97re?p&2ma>5np3H+6RNT|* z>D-?KShbf4JHhYxo>qtDITh|tk^89lNx30aQsY^@)DZ%sd zgwzQOIUIt{_$2GxGheQW1T+svMhMnhoJQ){HdQuw&Ko%e%)(|*HGjXKHaa8l zS5;k548A>iS-0&Kh1idC6;X`48Q8vMXz8ULCo)H!u$H%=yxom^>~|b(?QL|~HnOn> zu6KX-`7r6<(mx^9N^=hUFL6x5m7YV!dGl(n};UL87L|mOBMK{!_L0NR@j;^xjG$$m83!W(*tn6`n)5zF(7l1Yg>L5!AF)H`7xhb^Re@=Weo2 zgBQ_sF%j1%Gtb4|E#i4eTuPaolu1Dv`6;GkAhRzm{tZY$07!Z(RN^!b;dk$ot>M8X z{EYl#p7MK{WW72iCsq(1X>T4$Q)OF|yGf0=Z>ZR@aBOYPaOjQW1(L>=B=qr4?9>B~ zgQ}E{x+ari01)<=jFe0$AEL|XrN=k!>Zf*Ld*LqzU6M}xAB%QX_;Yi^2yT0E^pAC@ zNKQlKno8P?)>#9Y3ErLUzcm>Q^1@(TPpRj{_J=G*m5c5~zI!_>tNdaO`T1KoEPV7T zr6lBP{4jSNIJ?NyKWFq?9+hEE!rfU!4AsPd^t*x5E}dw^?&@X@b%>;*2Y5_xFRVAV zLK{0CR?;UCQPbbna>ocnma@)+1)C_y98K&nJI7~3W81P0N>CW)dG%jKVkaOuf>gvB zBw}^wQE0jW@|ui{r-LFAo$Y1_i2Qw5IU;lz%0nVjd*PmS?ul2j{S^ARTSnIQ_A0iB zA+?`{@g9!|X>ZX61vk&a0y1Wx3ja1|ZpVGwncmLkfgK7$ER?=!n7+W`Qj-!y$h;`KAnc z@&!r=Cf(B9JRgKsKq!*t9RY9Iz{1k1VrE74MPtJNbYS~_@@nXU|0C@_GAsId%fqGW z-tG52UrjyW{7eAAJIOjT^XV)#%ZQS-p5ExcKPsgKaZ0_Un5uiN`7HD!adabQD`wGW z8_JU3#J+=mj0OZrS#(Vu6@{wjy77HZU=c3h_b4!QZB_1B9yu2VNV6ZQo%GROy1b9K z6%;YlthL&>l}0PxXp=v$P1lhg54jb_y9tHSvaUqkW@^+lhL)U6=o{^~x@!*O5-IYqXArVzye%_{i-=+ zaA0(_3FX(4Q2kDx5ln+Ne?Z$5P1JpNj`3&I-_~F-=+V0-uyuslhGIz(8S<%%EeEDv zMAAZO#W8%`ie@o6N7VOZR8y3+{|%1Us7dhlGA|X@pH8eh)n967eiq& z?oeNBoRk$L9nYY+Uk6ff&k~|&T9Zngwn;SSq3Gx!j2d|%`BEm zqo8f!!GPmb1?h4bV-cJQZ4gUVxuW^~{Z4%K1Id8?_bXtOr)Qy&Brz#$AmC@`=ybq6 zK|GDqYgk%XbvFDsuFWkYi~Tf4uF_E;hY`Q{U2MVHJ7inOib5e^4UkG|Y3H zodGxyo+5~+sDAF}vEAQZ{^{}Yk+o&g-X4Y01fJBxbamdaW-;n+Sbqo)k;imXKOn=4 zU6wAUPMxR(vah7%FdNzx>n|<7c`^BrJ?YkMZk8^IC!1Fm?o)-BcJaFcHKPVd&J|4)M?EORKXDM#RzJ z&<_DuR|qu<3>rGRQ;=#vN_J6OB}qw|EF=2sg``o4JZu#Xyd6H0@d0G!1a%ex0c33h zJ81K`FFv7{Kki6P!3gjSHBErVRQP#P31*UClPgDM;mLQ&chYLV>%EmpGOTi&Q3?*P zd`*eAE6*h9681{-)U!87Va<3)*^i;0&85Y{mEk4;o@IUL*l4?_R^pU?UiW5 zlPU(qU>;6a3xo=<7;f!XZnc>io^?;_U`rqx*ttI2pgb+PX_Ws8O|d`0K-U*)f*mN* z*-D|KPO%jc8Rsh}bzT44H1Swudd|fm;!|VXa6vj^J)X$48Xq$=g9=|o!{6PjT6i9^ z7@3Lqgr6l!GdudIQ&UBGS@6?Q6~|xZRW}*s6{QgE5j9(E%?drjJH(d%6dsQtW3g!Ayv!|D8v8dx*x& zsid>W8~^CQ`FzE~Ca4~eEQTkgNQdkaGg4X_%DmVpS!D)U1<&xULAcXFep+Un2fm(? z!p*~vJjbu=?_TVz|Lhk6vf*)!to%N1Ux)}kP~kZ_YQ}u9YWlcQt42;dWT`uj(>ZA% zs)0F}I}cXs$=VPnO4Aq(c!FJ}gUQ<91B}|5$Ovo4kO9G2RnPXGw)MI0P%%By?Jzhl z7wstBg|O>s4ZW;^K;6+&K=(XvEls&SM~mGM!`I@Xvbwf1y>DW&`*G?>8qpyvw<04M zDP|M!Bx^ZMz||MgDv$fux}s!^NDchMNwH8PUN$0uLVL#%v#*>(NecBv{YpPm{LLD} zHSzp!fH;Z|##P5~D_eTg!k-PRd}THdiP?fb?PZYd|d zC$rs8`w;m*4He559~1>rUh#7kTY5Eif!)l{uhIcpu+NO0vVs2G39K$@#|0(2Qu>Pw z&inp0a}+Jqh3S~ebC`+By`?g%E> zDdBdL6h!{Qm7XU*lBgSJt*R0|gyNX2auTQLanC@QMV} zVl|=+DpDA=^((9H>EP>@DYtReZmNJTs#kK2Kl%Q6Ts9-p6e0PXp)C9khls#O!q`Or zJE8%JRl~!!<{2%KRxJ+lI+B!!ES~M38e`_Zc*FnMPhu(}%TYrLk-V{)9QC%9#!!u6 zm>GmaV6tQTu#yL)FTz=v)ZIfb!x93>*+o)2{dSFxvWV{&B)B1n;<}w2Thivz; zzr`5iIwe`q?yVz03lfX0`QzvS^gi33P_Vu@;_~nzFWz+TY zu6G;9@CZaEwx+jB|Bb4#NRJnEekj?CJLCOR3(KzAs}Sb*mnocGvaBI{)Ko{65J;wMIlgglmKmj!Rvm~099mVP=?S= z(S*^I1s_=xNp}t(ePKQnR`SI_z{$+T0G~-0qu4ZgO<~ZnY=vqzA;U~7&+SObj2lxS zzv)^TiK7fFNclzi_NJyyPkN2}wnl$eL5IUYYpcp&(bhDt%i2xrcg{C!=Y@km?J0BJ z?weC%2_F47jl{{OhiK;c?v>^B@f{7HkEK^F^Xh4C)rY^J)9Uk%H7jE_yG0c60cZdW z;iK%eW1jke@ighEIJ+wY6=$2sk)ni=v6En}a&nrezc6@QU2gVDXil-V(7Wkxp%lXN zyBZZbD%iHMb+9c;?(nP`$woCC{>)QDb24dHqLK+^_L}@dxosm7d9DE^-!+tOMa|Z1 z5=CSFQivrcqc21)uU;AchDxeKW~`bfLj>j{&aIV?i#C` zyI;)8iGhK+Rkp?|&I7|^t|cWEx~Di>iCBE7O3IWhjbsvt2l*Z1GO# zd1I*O=f{YetS7wF85zq)#D4S{nS`m)QGdRaNBV6isEeLZ$&;Zqo=8* zSkXQ%69KV+$ps_IlLBgGg|YEKjMA;UwgfB|7Alg_{`uGnCOC^vyJzizc=?IE1KOVr zqQ~c2Swtw83u?*25e0oCF{gdtF@l)MLbUl1XjsK8Ve!byr4^hC;)Ers^XiV2^qk0yK3VouUq5p z_9_HEV^~^EO~%C4?&5=&IJb?VXndS#cfZ{la&d7p@H0$sd4z)J@)fi4BIF_|6p4sx ztVBNSXjHD{_sREk(-#(Vnx5S_F}I0nUOw^=+WfDiLoRyjV)jN-u9jX--g0|&erOTO zLZQUD0Tss5Kc^MXJ1Uu}kupigvs)`NDwZb~eSzdxKR&@Vk`g)8dk(WeMp>ay<*P6{ zkCd-bJccHylfu7hQV`F`Pm1xzisHvfp6l=teEv)bVp2X2A8SAlqP`boG_-AIK(Go< z<67WnVDI#6ChRRS=BE$m{8~F!6*+C_*0map5P@Nqv7VzFt=OEEv-nvy*GBX9B+r~5 zgUdl><{XK7jXaB?n~>lbaTHdm@P`y#Qx!9ooPLCKr3gY{&QeXA2XLBqkv zKp37{%!F8y>%^Z6fvFHYRdxsrbj`-hZ8j23lL)cWrfC>5?82_}^S=S|y*cWK1bd3x ztwj{jbBUsaA{Kt%qhLN1Z(Rg~Z!kVO5{=J`myZcB>lP>G=A--i^(!5l!C->AAS5#< z8y^HjL>S4j2|;RURo;*U97SD|oFalN28QmgNe)=H`~@D9A0Mr}Pi(#~Xijt2Lh#AU z!H|K9b4Gh`GZz*&*E9J~P;p9iGqE-&VxKK8X+OSVa@Thdk42iAhN@z*)$-l!&R2 z9q1Ql8v6Y&*GHW}M;pZ&7<;tIyZlk1jjwA=D#8Ky_S*Jwy zrdhUG*-)A-m%@-de7&$CX0y(wdCRuOd5W^>p~(m|xleo&^>_F{L_=G!)cF>cAiDYE zqZ<99*h(C?#BESU<=vyI^zXbek4U4ZeTtbO#>GQy;edVJ1(EB;qRx9%3jpZAc4tuR&wdmNpie z9>;L5nwAbfK*2VANPw!v0Uj8v7Op?g+ySedZqS-1z2%veL-N3!EATy${R-fYi(!GN zgb^k)e@c)35pJr%$MrHbyCwQ&!3j?-nb*e# zQRlkxG?UW?Q-_M3*4oxk0C>M`uGRGLYF;gUc(~4}BLy~6l~%jQ{n_Aob=4TAbEZ6j z$OjgQVApN+IDe5b3%rU&*lo(T^w-PI|Kdc~&{uPh@qCZ$_Q`$1i)n>bauTK$;waMK z)U7o`iMZ!y6>&#MLNtm@p>EQ4AZr?T3=QLfzAr3xRnkZ^fV6Z7L7LZPwn@-k(e4?8 zO|n0i;SSs^kP^+IhV|Cg4ii01y_GlPRM9#cLUS{!TzNO_K%?va&5EcoQnK_11()v? zlj_T?E;`%)83C?PW39~p@$)S-o(Vj&CIn$i1cZ<2Dw_kAuEwJfZduRrcWq&(sYxIi z(7SWJZEjRDw~jRR9mSXxRF0X9Q-V#ItcaQ(bO0rCeKgMeI|Swfo-zviY;En>aDj?^ zM|i^S?CjJa3Tq=!Qc6_kB_|kbKz`3c_|Ide!2RL2OChTg|4btz{2Wl`Fb-n4D@|c= zf$tv^unQl&=<~U*H5D$Da25z`fFLYrRZ6DphV#Qm6vxsf;vBp>qZz1!y#xEDNJ3s5 z*mNe+$#Die+uI@-USwBF%xrOD{Lf1fcTYh*R9APPXcS6|T@LcmQa;H1ro?)XgCXP0Vx3n9#K1 z{ZJ4Z^^Es2N4c^k zKIBIY5)_y?`sUkPXH?Xka;J3DaO%e7sC!{t*l$JaI z?yK{sW;LI!P1*gR4P}~{=X`rLS5>qSOg$KKIqf)CT5Q(>GWpbMJtBYClYe5MyFWJDYnBRYO!j%S={kp59sCbH|Q)+o~W?Ckd z0Ttg-ej$gYA){jABQ08$pz%=f#XO$<`vOdOb9cB8V^W-Lk4kNSf&n*Ix#YqhqzWpm z|HEAQ;!63yq$uwb{rSKD0zP%E{%`h0piE;Exr-+Rf02JO-G zF}HfrL@G|*b3b;9Z&;@~=VOmT8Z*Y8l z4tp-*-ueY7O{l3j^#zNp zAl{Rq5nY#(3AmRgqz~l}Cu1R4)npx}1_YKQY(&126$*)g!=K&!?Ch9L(dDFqQTvy> z-7*1B`1(^q+nyoylM6#?Ud;F`SHZB;!N}+=prS=4gI&*nF5WcBDPiWMK`=BpFQ>rw zE_Nm?q+s|XIH8o7L*^vo9{Vt=EBsu0?}0kVCvAbQCKDcyfh!+5fk!BO3N(2A_a#16 z%bfHmZ?6XjhMH=yuB*SaHOHp?JJ75=JWto?TPEGED5$#BMLxV*HSWtO_>4tL!XE?T zJEP#&M#g#U6NP=KP)|Rc{4%1?6+yHavz~=8q)swwtP$r$cqx{}=y2AhYI2yyoN3u{ zIe-TWMsX;O8Al{uSV_(A;T3gO2M1{zXe}jKX{ozr0m?} zo3Lud8+cP-4NlHd?+)wc=2mkYqf>w^aEs1}o(E3Y4OR?^0@gAKXmZsf?IW=pYV?0dBV7)*UvR zlPdDUXg#{V1ut`Mg< zRerUCp;SQb8-{_aFUUKvE*Z_)*RoUDNrd-XhcVn=4MtYHHXjSdMg?{Y!3g16jNOmb zZcdA>`Pv(F*Hfp!R?37_HNZhQl1N-0+3kEMr-M0(z-Pw^Ddnyn5f#ksoa2V##DI69 zXh$^N)C7e$+kM#(8-NCt2NiYU*VB4%Lb&K2*}$pGO8{oH0ohcDy*`k+ezy(*Hl4lx z{HG{{Dl5&_Eg_StP|IX^BWTGvM69Sh9k7UbO7-1trH=y^4h)QNv)y67{a13yV*=%AEF^?kmXfjJOo`lbLO62+n=^;Lr9auWkepI*$IFn1417CEZBwZBP2;uDVbCd|peGp`aB`ea z_n08s!#&T>!4aBASivsAleM6+ae10_VvnB)bYfZgSG z@G!w%{xk`2s?D4Nw>kfi=ioG<32XPsN*~DvO`E)gH_ksZ2976y-%|lg8b+#a3J7oz zuM}!jeGZ=(YNQOo2kQJigQcc_6XxXmP__rd_Qpd^;I|0*M9g?iMn8-Tgr(^cK98P` zemBj&xS5%U%<*JN8qCnECQ~Ch{!NFnxM!K17-U7pFXVE79|?1W?r!*HHQVK=Hspuv3c;=qW`uqh~BRbUs8Oi6wG+?x+d z!=26x+R2`|&@R}3FkAQB4rZ)KN9*G$4u{`*#ZUs5GXn6Qf+){zGvDGn&e$Bxh%S6h zse(uChlY_O1jn4Ve2g|AU^~KV@rM|)8yq*Bk8G`9e^*6$5#A+z>He%sHzWn_Y3^Lx zOpOqA5yzB7F!_cv0+}NO8wHzedfqUW>;Wd>%P-9gO}jc)872`JAjC|o9!n3M?Gsg*J$azVKQu6X-w_OW=!a) znv;--_oi2hga}DQ)0r926CZW?u69KkXBpwwToVr1HF`QHyEv%WN2uKR=eSI(QC&J* zlf?AosJIJN^x1J<`sTk0$|WJQIT*irqU-mi3jt9Y{Ql@irL_ zEE0e|bS?|~mbgY6{!Ztap`yuY&PH;)w59I3uak{zL*Gr0Ic`=QZFnq1byzM2{GA^9 zGSYyXBdfG1Y{Ak7Am@Yj1bHv|Jx&ET?G*6BWdd(N7oCOtiPzkn*V)qE#*FWBnA@Yy z8dS~nA@o~=e>I$L2AgUFCtDkQn3axihps>iy9oO9+0cyjaaGaJG|$(W$x@J^opJz> z3o4)Mu2XZhzKm=wCT(dsXE=e{wrg-k$YEU{gum#t&>^ra9OHG(;Jq3N^g_-`dG^l+ zeGY!A4n|+Q!c-OPuF@@dY6&=n2BQu5k$$-Et`T-uw-(W)#K)Y;oPLk%6jX(4o>LFBB zOjNbqgcux070JPoNCb?vGQZ(@XELC6WddAor1Q>eK>J~1T~Z!y819m8riL8pwTAe$VoKSEd- zA2%chonbZ}@62dh+mN<+;Hs)FbUY#w#QSSNAKIVN17{i|`w*Fgw(p69f(37Tk{??} zw?jienbw{AlHU}E?lK&F1y=cu%O2q3fpE%mv4$`X6_W1S;Z;Lv?RmU?0PS*mZ<;)j z?GpBrCTLhBL_3xT^X|H;1j$YXNOCWvfKykhn?A5Wl7UWt&sS^F^R;{W#YC$HIS}wd zKD1WH$o^->2hPu-I&0l1?dlPRunv@PzD#$bqFD)$ z*_dsq&elVlE%e%43>z$xnA;TT{;G-_Ssd#o5-*h~32@$ne zYazrXGoShpcGq~qccaUBri`o_t_{ynvLJcF>2r&bA67?$97>E{gdvK9NyN9ls)0vK zCvHMY_N<3pFc7xk&7BwlIZxx<^f444*>_07u0G8vhJ#|0b4Zvd`JD~d)aV`C*kYoq zOvXbJMB0nGnRTZ|w5jD$HRQ~Fd`e5_qD2meO;E#~!mprA^NY^spaq$M51e;na4_*a zR)_5d(4keliv6^M$`=^%`m-rJ2n5NA`hLHFJdo@GowX{r+cWK&?12{V7~4v1VORfj zauec{XFh1=pSk;LMqK9p-beu(JtMGQkUdc7?`-z50xpke|KfR=4Q`cQj;%e}@)0ZQ z^9?AhTsgTBwYMR6_Ig?~sur;jb=Rds;fmOqQqW(B7rp+&+Zo>hXsWkJ%OpA9wKWDe zDdc;>JcZ(8dUg^z=OJEdcGcW<7TC?nTxrH6{o&39)>hTU7=eNmJZz5~-!$6Ef0CfA zyOHDd#{2DjEyxyhUwSHapp!}9V@Kd3JnwC@hFnIuxxYD~RpSf*L&UE*0CRE4BLaI7 zGRgUqo15!^WV!+Q8=F5S)(9ZdRc*}5TAz6qqcd5Ex;VY?0NP%i@P#q>^l8ABLXq?_ zgnZH(g>|A>t4a|{aW{{&dAQT&QT1cGA0zILjauQ*UDHr3;C`5uYnNs^Z#dht4V4xY zao2CO_JI{cQ$Tz1N92>JS-a=mmc2tF(!5h~Gs))FcWIbiyxpC|&p6>-a;F0e?t_F$ z{v_AGV-PL7<+XVlM2Fba?%~wCH^z`#Lgyi6;2Rx82E^$o%ii>?L5?2 zlgbz&939xm+z$?LS8>A0_VsYWi{@t26?{S45#ts`98V&oTO+iG}HC#&jVa z1miE>W{`o}q5?b#S=py(XTn`6fPEYGch@8R_%ufJH)Y`eoh>syw2?IR|Bxi8|F3Z% zQAnWN!2=Fg|HH~eA%PBShUuy=ab}QPXv-rG`|}d4Xl5gDK*Y@+h^opBLhx9vfBrJ! zrCA%UD~&6uKKPq9dBpTsw)5@DT#@yf)vZd`DpjqR00kIa-O0wz`g|9LqwkGoe@lbT zG7tfxbg%p%BINhSkMS}DVS@sL)UY}4qXk@|Y4exuUnVl%F0YBKe4df^UCQl=d~(Uw z^XSOVP^>#SDRMgnyphWCv%Q}Vn{_;yspMmP9(J;zMK7|Oxm3Pbyg#j+UsE3~H)p>+ ztf`L8_!V(U>GQ889o@7+(-f+)gqKkTQzy%inQwKucw#kCCU?EQJy$RPikpTD&h~oQ z0+bJ66u#Y^$mnN3NPEu^bv|p4Fej~KneS}BTs~Xd{rNhqcaFXBaxvEWY;zK=$j+M_Zw3j*6qTNALh@QQl!6&XvW%VzmZghU)(vqA2c%Nf1b(mm^ zAl=L1Om+8Dp%ao>`*gbv7E^C*BmZ6{tN?q+e78l6)GfoN}vj-q((D zVbG_K&nx2;zC4nVI5Cwn0Cl`Ct^JA`GaDOhOsvfwr)fwn8tLgCPs2Jrx|qrkEA>IO ze>lI@;!Oi3(AhR|ti2qHLQ@F3uecb&V-S6)6b$;I0Nuo8{m;aZqqnMc^VzS|$)jtuk zybD2z0*~VFI|C}qw_F#~0)ahuE39IP8j_&904!AGx|+^oXVV=QBq?BpKJ`AHqEQ=p|Ad?2q5C3x ztXUK(r2PGls*b1PDhE8UYWsn)>+QGQj~X_m*SSM;oLsNXFBvkp<($9PbUZKjh=V6i zD}Czyod%Wf6ce_`1BpggfB1F}O75SqYn@~T5)X|)fTC@vgUsu@y3YToc_AyD4HCr} zS%N4~bY##G%g3q&`9Yu)!`XfM;D-H(hnRgJKvTt!co0Of{xG(+wM7Lngsxj47S;g^ z3v2h|5ky#!>gwCu=|0F*Z7xvgUnU5Sf>Pa{3R5OB$?DaL6b2DQ?13w^D&$?ZyTgK- zzxuFJ9$siQ(%2z3i9!Rt!Hw6u1?$espj@3WkXm5lfh@yG(z#+kKwZ1yfApLQ!NY3e}y~B;3fV;yb)hizgIM!g>Ueil9SW#AlP3>7vc48$jJg^L0ul&o8B5? zKXp7k2tVlOUE2?tI(b4SNfr|K>4G8M-CbQc+^fZZO+<(-3|&eS6PVUaQCLmKJI(&N zUR5;P*`(44iAbxs_BOTmd&<--ae83d;YW@MV0tF*X*huW4jx7r^0sRkt<_j;uDdtsa7n4-v zAlm8~l=1>D(!e^PFl}T}01+uuAf~1!+6kN(xS3kZ2P2_rmraO-w1|!ldcS`Ll#f`W z^jSC8(#)))e7_{AVq;-?j@1$7kY4t}*}0a{GM!H9B9FS!#jwR)xEnvuH&01Wb3UKi z)WwR5B7+s_Z$3tQhEtM%>RAWCnez|vdK}Op`%d{1 zBZbNkIVxwNW|_P%q~RVmtOoN5YPfOQ%t)|mk5E*;5-RRXd`NSMc%xl-t<`zpYux$~ zo2qm3(5O19h)p2<(vP1A6p6}61zyb6+~>h#fcN5p_RNy2hG zQrImTF->z`Dt&Z~Km~aBroM!~n16^>4Gj|g4E%8NND}?C6N_pc?Z{>&Tf;P=zrp`~ zR<);Xdp*TBwI)|%znzITrfDoA70|6?7A@n(cF!4KUz(fZRVj@rC&{w$)!22gOBJ*C zy{V1s%#-j`oZ)polNc6>PmrWZrcu%zl9_-a`x3$kk}%ze2^6F0UTCVTtAn^?MMX%F zZPVNhH64wm*&ZBf`jT@n#{{dou%P)ug-3{VWwaehs1)8s?)MNdInE;F#^fq$8YzwH zfrf5s!RE#+ky=UMK|FN~H5V-&@fUW}H{>GX>2y#URtDtp&z<8V*PbM%6eN$Y>Kh(n z!%1mDlo^nDH*_6W{~KX%85ZZ#bd3@$IKhKE!Citwa0|iR-DPl>K!UqF!QF;oa0sqJ z2X_hXZr|+veD8DKbN-y4b6;~!_ubP~U2E0qst{(b$ja>A>1f5OWC}WYU`ALJFri+z zdYX?N$URGJCmRzR#qc-V!wuCLP^U*yH8eabS4|9RZ~^jg!#L&l<{q4UBhWX>wQ^7C zqoMPngB?)1;k@$isJN{Oh?Dh{@HaCHttstYaVL1MRV($dUI=}1c{ zkn;}@^nYWfi3$s5O-7&nwv5ZX&hA2FT{$u|j5=(l40rIyaED zt_xQFDrX;5t2N}RC9a*{B|q|hGD|_N2H71uqDWvECj@wdQcG;M{4juzpJtDOe<<@{ zNG76_q2r>`6FL{M(Zx8?M&AQXkFu@*WIYYRhNU$C+ZsE$zh#THYx32@w(ZaxKH0xP>nY+CL~ zpZ5gcTM1Q?>zbSr5?v2v zphZg71Lx@H-E%rIT?VvDYRDC#h|U}pP!@=;c~-|>cvE!CbDb%I)xXH?*-Do(K7omU zYYb22Li<3Z%#HWNVr={tDMNy95vHyKgRDY2dL1XizmqY<)(lfSAfDE+CWkoLR6*E3 zPp+6jtq=EK>vIT69X3BYI_jg*xKCdJ*0Im3y~_yh1Uh+!-!&vYZgw&i<7VnC3WS;Og@t}lwOp%rA0~sP zO*z2qm8-iPcW&eb*0~!IJ2inoq>wK*G zrpy*sRwdojo8OTnp}GA%CI;cB^bC)&@5vGV9^C`F z#4GruBs`qA`DAV6je)8ON(9XwM;@-6f#@Su3rMntE*rec)M<-%R;FB8?m=^V1N|T{*O{bKvX6u!3aZ7kK#?z9}C`F=l>J2Ktl;%-zUz0!m_G=7e^(C z03ZJ&&OZ;1|KH#J|BG7wjedvfp+cGIf7K-X`2URmZzwznl}7yUkV#1IouQ772_+QU zpSM7anDMzp;`e`FUvn36{S#;{qMUD0>3sYMMf9)*--go3b|V&HFS)QHB@qVJ)D>Act+u=m*2O!KtQiR9V~T@co9K`KGW zlNv#y4G%_qiH2WCQqQzux7FWi?kbFaQ%e1t5||LE$2ObkBnnT|2Ft&%@C!+}YjmUB)a+iytkde2;Y z^H>KvV1tiQo^_w|5Um6>G;UM#P`N|(UGKmw{ju2x>bUQ*>65nqN! zh-moB(cC>G5asQT{P)|*)6ct9$kO|g-U;dFPc7MT-Z%DROdI>E$K(NMZxAMq+Mv8q zns}`l>CuU>x0!>Vfr11tPj)V~24i!Zs5;r>i|5g5aFthA?P1?5$T#&NWX~J_uo{a5 z|DBB=!onkY?ZE4S?Q!LK8}`+wBU_`vowpX;o3^LnGq-9s0<_dV+}8|MdyE>k7LCuh z(GQMQ1eo@Ysmh)NbAcQS*4Tg24iY_`vQyMP&m_!aY0mhZxsH)D5mI1{ z6!AKf@>grqlmAiU7pLIe?0Pox!~W86c1C|9+sm7OPzt;7uB{faar%pf-vb176v3>j zua@dfUH45%CNxz`CfckfR^d>z#;Ljme;qjT`szAMF29E;(K_S!{bl{AuwZ60usz=4 zZ|2P{U+|k7>lW!r*?Mk-j|B692$J~cQP*=e281SjYsADOWcnNwd{eI@{aYWGQ^&xK9Ad0;Gsnyi~oXzU^?{6%q zvIe@Zq04iD)(TjZg&2Ua;roF!)#%8&yt;VLSxeO!IkT8Pv_13hH96+b{ylh(g;}y=ghoB$N^U4XSjY(;ifxZ4p-Q{S+Q4jcK1h6Tff*J)8K01E18+bBrxbKY}c`0nceJ>!0Tll6c$I_%wG{%5wovEa2k_#Y4O zgo*Vk+eE;|FGuf1r%nU??}!&31_;}B!_xyF&Lf>$_hf`2@J4WVTM3gQeyBpvk2#G^ z%JBcS^t{>Ryj7qY$Xyk#{8cZIHJbgw(Ud9=i{IIJF6{Xl(L_8t-^<7SQXy6@gP zvxqzyV22kcbA^8=os0aB0es(Q?C!oC=-pacae4V{$4o~CbxfPqu*V4tk49G1uXoBO zlRJ0IR|yftMTLHa|9MF#sD^8YU=$0!#oc*xu9Cw^Kh8J2ON&(+pb0;Q{1x$^ABKlo zKYu-mcu)*nr8wt0IOo1V^YRI_WwidQ&~?aZFG) z+}POedRr#LCU$cNrpMD-f*rW{H*k(LOpH}g<-mi!UnMFZQ8T|iFPba9c zbx)os+=}2cU*Y>L&Md8mtb-HOx0kG+83h3jXPlGma+S%HEKkRyK5`wv4nk_CPGqGc zuI*oHfVZ<^A-mehpLHvf<5v}Qn(f@$h!nwy|yy4bI|z-dCU;pwxI+MePEA@Li_kDaqPS z;`4z3pYPJlN`04}h!Ht|qy^qs#Dkrt?ia?KYIeO_Qi|!4TXte+(b=9S*+Lv(qm0_Z zVg0tm-qE$QzdMz$FFz$_ir`f^TO7gw3Hq*w6{_!dKF?COCl=BeJwLEnz+HV^;tP0w z)C{T|);DPAD6Z)UborYzQyT~no>)ct(sJ=K7|Ss?{ea=Ce0R0P>jvdJNiu#RpA$p2 zJ9$T82@!u+ru||Q#PfIkbV}TK45{h!bIJ*vr@1i;t9Mge8D7Bg4TqDCneO51g3)gU@QuwCR!Xv@kMRl#y>wVA4 z(sbVXQ!Buhc6yKTcmrjJV9g&LZC@nNig}q7_HtgZddm|(dic!m?yFJr5u=pUvc8Ui zwGt_=?~$Jvtkj1cE2wQX$5_L3_%(MyYWs^d(f+&H4AWsei0zeGNVH=?XJd+9Au(_MNTt9*MW(iQN=*GMaVSKYC8|J$f6CYB4o0MzLv z)xqH-H@Z3d-iT2rg+o}VtunAE6gu<}bpK14K6Jg|HYgDPA%4q)@sZj}(8N7sriaV)A$#IQw zjeAjXjKNS2qk;yizY0|ON&BP>&ypZ&;_eJS_M-BGF|AMM5Vq=5_33;u`|<*+b8gcG z;BkTzn@>k4etdh}kW*vYrNZi%Uk5;m#Qy{#&<$g_&kC>omzjBN|9xw$2cI1$nS}u$ z&GM5J!}pjRiSxjKDqkHj*SCRITYf2*{rxt?lJBEx+o;4Qy!bEGH$>~|3L%*GZMuin z1!d(9K_@Ipb>m?S?6dRip*h$Nj(1~KlNg>g_T}I0MpsYFHSlQz8R<(C1O-2+iEbVz z!td8O9lY~A4cG3~dncguEMhCBE_1r2byKOGac95xT=E}^*b@;qv{h8EPM zeqQ_RN!DC_L-QfOxj?CbgCtcd(Ym?RyNZ^-INVT6MZ*9pYH@KXE~r*!&_=u(z$R{v zWO;oa`_r1v{dda5P}I}H)gxFnf>LF_WHH&kv6?(lmP43B{lhUV*`8)b`|BxCL4k9j zag)TLWg^4nt1Z|mU*RnCuia{VykK*^>;&iN;)iONo^NUp_+@YWEFfLRUx!Um?ITN< zhCmaw&OXCql8$=JG`W#<|G! zD)X#RdCW=2ym*-LH{`u%08y%rL_zUy%Wy<9sdraVQA!V3)JG#(ciH`VrhKbMJ3;$s zDCaKFOU(azPqZSh_<9N20F1i1dWDvN8%HOrq(D}kiLt+X=$isE4ZK7-kew1hE{GjA z_71(h$|(e~jH&Ew6|{-aR|tVwWZSZ zk@Uqjs5Y^4lOb-l<78y&wg)st50dU#b6zlMo!vD<=$cuV5X=W#^wPq$udia#7TD`5Ef;>&( z#UUYsMXlLKNAJ?E+Ou{S>$)gkiz-x4cBT%KUeV(D5z#d4NvImB)XkYV>DgT|{m!U) zVd59PL|V})8ru@WA08gMw^=Gka(J#|!$NlQOe@_=i^VbN@$o^CdvzB`kF8FBlvkTq zBSmf9!Yhm!y%K+Xc2a)OS5H4W!Y9Lv7B75x+^HsH@i_ceU5CC{7j4w$oVP_cX$w78 zK-XMwJ(F&Q1av*>>Vnb8na}&a6*BASBT$#7>L|`ZIieajm(G&u^h@eDWU-Pd zESd6}`8Tk3?fA$Mpy&u^mru)It0C4|z$HZa9NDRJR#*V+H2s-rCq%hX_Kyw%Pcb6M#Y-u`R_^!?;e%n&jw zzrOJNu)HCjxy);imz=a|C-f%~ZcuSHFj)bGk8ddQum|TS(Q%~)Tas4h|4T$VdqX8;Md^GHX>xQO^D7r9AE*9*2doxbi z%6^Ba4@`v|aMWD6^S2rWG!fy5;nCL=jhY&_n83-T3N`=iG}B@;EL`Hm)5q}?jT+^z zUFCMz{U_w>g?`6ML?yDEDAE-LmWL*eq}DaafaG116ItX>r@rA~L^ieb^p*Lr@&k_K zSxh8LWzo*0m9fRk!mH>tJo9sH)&_{)ti*J9nk*1E2|!{U#Sx9TqtSGFxx(F9Y+C6+ zT1@&Hb?HZo>U8fSM>O0^23zmUDw|*UU-`zFBDeisjwwj{rrZI^u7Gw9Gp}4TpY8c? zx#TpKT|wAv%9?%g#1)lT#x0}-XiCIp9iu;ZS)xf$Us%dwUTqlg%q=jUc2+tIPczt~ ze7SD;mtl`>x0ezWV|jpavon+jy#17Te~j(m76ig^iCYK6q_yU`NTGcbY(fX6k?+Rk z0hH}ikqG=LgvN`xI53)K3ZlaPuC@Cuuuny{j>>cf!yfe*Q7-dvzYXA8@GE#HTuf{p z23`b>*LDu}kw9~UOtamK>r(4(Kx&r~5XtFs@4~k- zoQQOwbkGAAdJf6uhsj`wcLsL-yVLS|rVAvW< zOxgrQQJ3q>y@#}z>@s3}~HlnDDEa%&8b=kQmA< zW||B~5Hb;UD{3l8n$>WeRc|Sa>CS(laPFRN1`7%x{vEbnb)>kgDoG7&I)qANAxLrSz2k`?JyRrB@C-xpZih!K;JoSjZxE?-VVtSaBcsaN^H z%|5$qsHP@dPepcWyK&A9^qM9S{yKb*t%S?OC};OTBPU_o(&(ZiCX<~>ezNDN(wJ$D zlv>g%EjI$qoC5frk1V#Y+QA7mVk57E_Mj2a~q zEvn7HpOxU?n;uDzm3Q9`{j#F~z2^6yZ~%%s<8ek+;I-LpQ&+Tb>`zms67cP73>_lv zah@T|d4B}Eyq-XB=WowOoeu_UcWe0u&Gq%PdB`4@fvM^*yAC}9QNJ{h$f+v(%ce{q;V_q8VOj0^i!9EE zn-uXnMQH*2fUAS$x(?gK+rf1|cKw~zMjFzSDuKIQUzWuh#{!PrHLNe2mgecT7VKPK z&YWQW!4y!TLP)lDELC@6e--}pzS!sri|9x!wlbfhLY0C4LC!Ch2hX!LJf`vnNzQ?u zCB~m~$@@4t*jk*&J3DoM650z&gzU4eC&?ld&v=!srV&=zYA7L-l)`MFH0qoB8PIhM zoJ^=)TIOI{Sk!L_J^rDPM+eTiU zQ7&Ka_Nl!>sQa1itfQEaJ_@RX*tLdbwz_e=_iNmI9cJ6wzvU2(K&uM?|4UT-2LrR% z937n=ma4aBZDu<0NA@2jpr?sGt{VmV%5g>Gi^mg;K#3o4k4~dElrouRJKDb|!|6(c z@)uB;6@{~*zTEzJo4SV~Ki-ulR+64StB@8dA0f_k4N9Af#Zq+lG85}w(VUVC z&5D+)eSxUKLNMn&T1YMjJ^5(?Z$W2%wliTai>}L`ve8S`Od+e#7Si-M>=(Xr|DERe z)hi_Mr1^QTocr219E~xEpCumiHep3NIdDL!uKTb$iCM9ANBvdxHD| z5_I^ApzpK%e8ktt+BxO_RxS5K%~K@s_eCSbYvSyOO;_pDwjKiC8f-moTed6s)p4(% zuS9X3fzSVK;8ShrXv2e`@U3Ko;92{e-ML4{E<^R?`uY9o%}SKh*g|LE-4jSGcX96w zBePR*<34z<*z>wGuyS)CE7Zpcq}LvJH3MN0@pkAxH26%7a<1?mh5a2=h4GbH27e=+ z+z_+ne7+dd(5~aEWaVjc5d`&(r`0P8PUeO_p_dPht6H_b&*zA{H^EOgo-G)qBwYbH zXSczBPCEoD)kwBM%V=vR{DH;~H%F!rH7XgZX;TnpNSCkw%7#PdeqK(e_v+gqUv`(b z(yoi`+G+AFrW1pKvO7_S;P!2B{{slMreoLdalBo@NmfY2Sf{J&uXDxLtsbrA*)Nzb zw|p2J=qar1romCtQD(tu85ZjQH-j!}QCJUG&u`#5sAkV`VdNpowb;ueDWf6K&g^M+ zS}7tk(J9&`L*qgXd)pFHl<1D%k^jLixvCPWNkcfhEs#KMbu1J3BY2STD3eC*fjs=O zBq1eCMyRr{(t_nBdiT$))*rj|iou0Sm8q$zdUIyF_{@)dz+V0P=`CHOt5f9oG_4_d zNnahEQUZJdW}Wf~o=kUdOiMqhS^lq+Q8daUzAc^oIN#)XQ00Y-YD;5;*E;wW@by-r zlu79Ctt;RKyr7a;KBE~rRya1!YQ6l4iQi9`w`D}^?jLOg#?pIwhQ%~ z`d9rur!H5e_AwhAJ6QfSeVI(}IC6bdO5HBEY4l8D?cz809oc?@Fx;tq7477(2#j>N zs5yE7nLCy~*K{TQx?)B0_|^YJ1;K3p+BIeR`r2|K_|lG5ln zaV-F})p}2SmM$dEz{$fysE@td|Fi@SQ+3S+rqD)xsvM1IcDXE0*3-n_`=vk>k%HR2 ze}1WHSXGBr2zv{4Ua+$b{+U&kZ~a>1q9(9xU}t4$lAd0v`t67}pk#n98{EToCUB=oqsO06OdR~|6)0iW(3{^_ZK3kRvY0w- zXl+2CJi4l@@078{1Un;JjfnIRKWioxfA54KODz{0qc|`5_90~FXU`Hhjs%=+@@%eD zn!0LkR8vc~3J3n~{xM+&gDFr@ur-ODAqAMB<9(;^DOC~1v+~(O*1V}&S)`AhV635G2_Gvtag|HJ9GWLB4wR`|Le20u4@d$6W#rlen=vz_ z2bX83`@b`Pe|^m}T+W5H@+;GNdITyO`Ivf2HCv|mc!n~GtaW<23qMz(|KeioTM<|A zjYCIPsdau&Mdn0H)wn?&738&GIPYGI^y&4)jGIRaXzE@Rf@O?E^ON2v2;6V3RM@6mrn+5| z7-`EC)qXYH3!vzBR`j*|jR1ER0+Tg-_PWm=4i&UZ+SWl(E8gU<`YU;r{hf z7>CKOA>8q^jwKdrY7Iu~;O;|K(&dkGqx$qgmf`4+3+g}i+0kMA4NmsYJ}zbvPt7L_ zc;v^pm@`HocN>{l$$*{vVd2y&Bc#Yq7S`unUJ-Sq@(TMNep9KHQs^nz$qUz7?OIy7 zIXPApbhS}3GcF4YsWECZvB_Fz;*_QdR=8QHpjAZrZDj%}b<&5m@Pi$e#zf0tVwwVdwoov&wZerY&U$QQ$eu+D;S zw}-baO5#*kVMYq4R{N8kZ8a(5%{v{3cVUV)*w`!u4ij{RmUe}iHAtwCw8%ub5>RtP ztJbnA+!2o4<9mSwZ6z(NRR_82nwb?`r!#v|HrGLhIeBV5@ryw^EdsrLIjPm*A;e~U zx*F;5{1rWoj%|=qHVMo1P-IpzXF0N=qKU@37?V!##ZM?rpTfj-)a-OT-DUN(ys&-Q zx1LFwF?LD&ACW*W{DRyQqdkIIu|HFhp}W##9(D|-{m*FsX;oMfb30)N``qzGHCuV- zVP4BZfo6cQBt!^W<%ZDo%xI$3J?5jNSqh6(TLNJ{D?JoyJL3HUR)$I&tpyD zpGumXRud;?lbf1&K=JcZXOazQ)jvALy_5N@g7Gv2(B_E=oEioM#%JWv*~a_nmY1!) zBVJz7_2lb)2Iv)8OcC~Zd<7TO!xI|eP8NeZB&fqiub*^LYQ& zJLn)gTflSGzJ;OD(w4da&_kCSZDKY@Q^8QI696EUoLb z2Gf|cy8a{rhj3`QC;9|e^$d0IpCcW9g5LobV8TR7lWPQ9HKkNysi*=g%1U%3y0&gQ zzvu?l5+S(lA;z4;UnrsSs5laHxht)P=H<+V7&Oc!B#*HE(rXP33x1K1&|R}R-2-u3 z@T3$-cvXOkzw}pU(K%V@ByVpF#T!^3jO%&e0u2R*+syFvvCrfpwQ!3q{%YqOH?rzh zv_H$wQl=%{mlE_*8cNIamsGt0043*92aB`oGS_bFe(lSu$ zAIc60RlsFECRdau7)2(I=DuuLrF^+se7K;`+j;j6zVH`>!3fG9#G(ENwVoUPrJas1 z6?@s~{h?Z1ILnyw_?MhHE*#o`hY2u*rz{W8BS$xlpJ@DPminV0eVz>!D~*Kdw}~p%xBYPW&02_ZoR#CIXX{g#jG}T%_*OkXZg4 zErwl_x2#x9Y*L3`kwFK9rH|fdfq1r<<=LH1i_-Mh#Hl`*yiBa?T zR$8FH3rt>iqY8e7IR1(a%$OKx>-D$rXE`s58zA?UCBY%<44&KjkG?4&#nVyFEOfBD z%vsq0YQC+bg|vVaLi~j335$9ApGzW7qzM7h<_T*5`2ion{M(M^dd@$SBn#7uRNmX| z9x^3w3)pdjf}F)*YU&Qs4^pJdFqKGSTLCyXX#9U81nh*Uh3N6SGV5H93hFh^4X{ zjlYGXvQ!g{{aY}nmF5=tn)&rPIYcRoZrlL&UP(*Z>G?Abby3-)zrPS;tL5iQ`z-z4 z3)|h4&zqH&Zx9h`Q!Fn!wsBPr5)^KyEXLQ~DO>Ed9Gry{r1 zVBwt`H{Ha`Ji`3XzK4SD4Si3Ag~O*^4QW9S^ZVe%om}vduz~5hB4dpEmTkkpGJZjl z|B1u{mazv2-Lq3#VDNF*eT4&q00Yl8Z9sLTjr1&MHJce4PF9t5`OC06of4J!Uwu`} z+IS^mU{>JtCn_z!maAtqWm0^y^yovAhk>1j7kB8K3srARE zoBvVbWpGLz4HXM=O%Zo~>6wY!EwA}cISqg58W+3>$K(E~RH?Aa8VvsEt+13B9=aA@ z%cR&pmUl|Rr%C1);}u-3-VzO9q)6D6XF2jhEzxl^hl(RJ5{84`=xEmn#?AlQ?}bE1f-%uIGg)#6@26K-I%`Th7-&O&{!s8)eGxRj zRa~R^~mdCTwn2mMB6T(TN}6DBf)2l2ZrF`Ci?|d({=5uI248 z4=Uyp|2ENlh-1BU%cYm zWDpE=0;>D5C<5nwe2@b)Q&~4>=e@o{-0a#c|5O|Me3jzwpOq)jmEi|y;Oy)%Lc&d> zmRGM?8L4 z>F^W%R~h(_AtDX@)vn~uR149(_|AQJyLu}wE`s5%Ow|Ao_|sJU&R%!_i;+}v`rPMQ za0K86dAXX2*YNfB@q9?78LPON!&~0*EK@RhtzI2l*5?(l1%< zsxrP~>n9Axs$a_uE7*w^uyh0M`7O#Lxz4LoZQZtno1^ENtTuVr5ik*uB(#FU4j2yQPxUPzkm}m*;FfpKi0Yz z%<9S0k$)vP_KYHx1Z-3@u*aj-%{29-37r<(9ou2#szGLN2s7>{54^`Jr6#V5Qu}?A zQG{7NFI8R8d|kI?$i>3RJJ8FgH%XVeg)R}Rzc7lB_Ar0ldpVLg8^q60yek$?d|(8g z&fY{vG|v1@%#6Nm%UDSkzJxl;#mBt*S;;2ZF9J@)U z1+;?zFTTL&;E;39lMmT9z8d0OsFHC zMzA!db8xJAreqPvz9YyiKK89m(QU`lr+ifJk-L-kC?j1MGbM_tqSPE|irvjxY92kF zXeRWKej0I>YWT%KD8a)iei#eADX*O|%f6`bu|Y&*bZWL@(vY?|{$ZF>o{k$?77$IV zpy67oH|ksJH`XLwS=cRqtvFs?$+9D1&mx-`0;4>k3>sq^kf*i<40(~s_`e`&U7?Yy z$x9!eLRbyx)_4c#K*=HpIkN*B-N$a9e&8k-W#2Lo0{bn*&6&~URDG=^X!YuWydo_n zvA67cwjujJR#d7h31lgf<&SbT{SCFHk3y=!HWu`_KvSPQo-Ei(%w zou3rPHItJ&4QPb&GEQbVfLyy+7>QtMpQ=nBJCW+J_HTSK&!m2ERp{K9=EemPzU|gU zUTPz3L|Z(43Gd_ZH^z)rgJ$ZHO*{$4t|Wni@SmB2&`Rg|0G!QkKjfWUw_C*I5HeR` zWqvv@=1Y!7;sQc3j+LNduK$~rONU|mnt%^xnAm%y8WyjRM@_-y;g!uC;@$g^<(m<% zIWKFqPd^M)kgvq&&weN`k5uJEa`*DlVbBdb2DCJKxXQtR^+xYaef=MLOQHqGqs2(c zsH*|l$ebIcz~*EoRaMosjlw#s{4~|`zdq*TSO;)Ip9e~IU^_#Ijw!jUM3Z4)-mc{& z#nq2E(Qnx^)F(e@>*{L5&)L}~aT)5Xs;>SS+*h1!=Asq>1891;8}0NeX>=I%e5Ff2 z+YS$;?%AzwN#30wZ*dwm^`_PD$(gZzQeJzq{=ntK-u`~ANA|A(_x<>D=Yd5i7BKL!;yom~- zus`0<5x3>;G2ATf^hPVno?_ZL7Bw8T?O)DR4}Hd-I@lQ>et|38l)lu{4e7w#%*!hs zb@%P8T$+PIRDm(9Jjn#r)|oBDObYoM96}tZ;tJeS@xiHw2NtSv%#}yxwKbS=U#eyS zc3Z_4H3^HwVeZH)u^bo-9JqT)sAtEsRenji8glQ1%Mj_A zDX0UBh>u6;RDxsAIu&pF<9KcA}@jSC46O=R6vnd3l1!dgQ z9!jntBBn?l1nhIV9l7%Axy6!PIeKCHX$TCaq37=wy2KZWA_s|~94e4D1MW~6ST0f1 zK&{e&r+D-lo)C9#O|$}+wTEF~<9Hf4{6JekG974c=Azp!m-~=_RZ>WJT*y#9vHkgr7=)t9P`FXLP|>S(Lp}J0&M8P*E2zwALP0f59KCEyoh=jusd1Dc(?zw7)lI zTT@o*;*l_l6QL!=c}wK|bwO=sp@AyVlu6-uttWVl_0-yG_2=Fb#-DHKJ@WF5S=L9} z|4-UaF-ZCIF0G_Ld8pTO&voi#%2w0gfp@A0lDRl2uYTlDgqSS8R7_kQSQq9WZn2=U zx3*$d-OuU0%!GEzrG~wU?T4gX1RV3Eh6#p_5_-u zc!R6Yd@Ox?{0%vKt#>Nhhje*2GWXtOH4=c2Q)?#-?ho7N>@%np=pRS-*E^o(J$LSL z;Ql?2`ca+5E;{Yb6ig4(F@`IEQyP)2l@cNoa{NV1G0N{&)t}n6$r*oIQz+%cmYYKl ziItMUTSKsC)We3%)t-#jkmy5ZacE^mk3mM}rJ`A@74gJs^)yPuS`f7$e^ftpLA?~!c z;}OyR2Avcjkux?PLyekScR#2C@6|q{bycx9A9EP+HjnQVR%p)OBaPs{6VXwPwGq*r z&9WHjZ;L}q8s}sZ=r<@Kq_Xmv#s92U+TSJCo*&Qe$nM0JZ51>-y4s zif})Yo3S&G#%9Ozk@Q8}?LkE@>!Vij}#)nTpQp9e5dQOQ540d!mF zDyjJPbW?GYf3eOSmwYSt=aLKP_>-}|D2kh?Fc7IYTbis1kxpyQ1DkV-&g!o%*f{R1 zVVgjf7nAixJ@vFan*_ksZ4jQ;g~g4pO5Ua~G+;I#=~Io|JFk2JS|zMGF3)PA!kg13 z?m4N{1gB~D9$q})P5d{q5&@oK!V?9(^=z=NZ<$(*VX4NaN1fPw3Dbs5O-^4W z0E4c_WMyb7D~)&|c;aKErlZj;!V;^0$;>(L(y^JCj@Gt@CURNdsx;p#jFxQu z$z8U$axw9)Hd4Kb6E#q{;+P*QTH>nSezmGqWpq@tqV|muY@t&+qEYs;X;Cv!vd}o& zG5Ar|v(z+SV_5q03%TG`Y-@I`)PX@`{FZiYZq57xO5&x1x5?`2>O5AFXpg$X)<)u= z0VaV3Lj{(Po>6QwGd!ddaX7V@Y1|%}i}9?k$={C%)0}L#_Z%v;)UpMJ@B)2DSCo!? z3=G^&f3Fycywy{zsZn4ZwSKaESh~}cM91(TK(AU{cub~4I1eLU<3Ip)m0IZ~X9hih5waI)v&i!FsRc505c#-v% zg0nRMTf0^4x$ZyC-{jgb>n%-4CJoq<~uZv8-mY-daMpOvc>L z&2~M}!F*iT2-$qF^Wxz_xM-kZA?ZDKb*&w?3cuGNV?M|!=u@JM*6k+*Z_CtV#Bg|f zmYZ4$^VZ8&Tdtn2wKxb%&X*n-{ntGOD=WxRvs}U6Qj@~=tdB7(*JnnC*+I4h=2U{h zjQR{=&_?!xD$WV}pLIbI5w$ErED}n+(TJjQu-ZBtDCYQeK`qEE^SXL75xtfrCE~WDpxyT^JpHK zlfgAHYhRYX95q!s!Pw$BoR)`2^<#Z|H*956#5`J*B471>ZnxuPC6TTQiriiO=9j<) zM+wxroZ=E<@2e&W^UcSV{M=alRZ-g_;BjX{PRvD)p{(%jm+xt6_KMD*WIpH#r|u{X z=&+16l2TuO=RzON$3rO%c+SA&T0QOGZX)i zumD}FvGXcZ!^QkbR!2w2mBLOiVfEwe^tx#_Y!~W{-bV(p>JdIkubJ+jU+cg)m8KN*4FuVOWLR!W@QJp+Dxc|M9m;G}W~Yd1k}Mkv>Zt2$bXaVKtKrWd7}*AXkM-%- z5U$oQB=l;id7j0K%M64+)=)B>WF#0n4#lwZ@Z#B)v?^Z%(9ohr&hoC59M(RThbc0y zJyP+f7q&>?(cs}`ZQ_NpAgDmIr=~pa%FANFm3gqdjR76(hP~Myc6u+}FE{%4Z7_>p zmUqGvRUK2&af*jg>Cmk;ODy-A&6UCc`x9#&{s0S$iJ`G7o9{&t@_k{W<_y9 zb3E+PV|F!@NH=KF=fn2Vbr2QgG;}nj5#Rj*qDF@t`__GK9+XY>d6;!Yu5X_@{D*ao zn0SKz=E;y8NH2fbKRK}H8p4X^+yAmbG5wAqCE0aU=rd$>x^E&1ZQ~sa%W(#@5qjMn zS{;fk+BH?>jYabW-Fto?fsa>G3S3#ek(7>1gkIJ2d<`uX61bVFRUS3pPB+b^C=|FF z|6DK8jjJ!bg2zLFn3bjP_-TkVrNaqtaK!QXloYQG;AGpRe0dx1RgG+BXG?m=W|=#G z+Mv2OvtPt97494%hD$rlRHFLt($QId`}p|0jCyyv20K;9&W)s0iKVQ;Hno~g30xg^ zxVfU?m^{iv9d<;j;{rL)&N4Fqf%OT#+NrL9fuW%me;?X~H5z82_8efs6u0;=bZ|xK z&wg)34b|XVjTlqqd70lG^IX@OwHT}pH8D;@DDPz{gZS2+?CpEg!L}sSA7S`gp>nfY^{TnisZmz#P>wDWJ8J?24 z&>Be49@NRK|Dh1ddiZE!<(R2HFQ}PiVQLSH6~Rha^_4=7NKM3Jcf>&rm0k^n*izD6 zj`HX@0Eg>p7|%tzE~%c7VNpAa=wQ`C*ZPH&*+KXh{p(OwNn=`ZXo(O_`o|^p)lNCY zQk_*Ahp8Oe3#hV;!S>T-APlsc|2c&KN!jibv{KZ+_W+)wB-)MfWM{8;iy03$LDQxE zy+cDQ(cColjUscKJBO*u=YFCfYTy6E*EvSl(e`aWR%0iPZKH8x+qP}nZfx5&8ryc0 zG;VC{B=5d@J@@@QpWZKft?adu%*=Vt%wNavXt*Z(BTeu{9NC~ntLGoXYPRZ{d2113 zB%tUMlpxE#Wkqo!B7Yy z|AzBew0+ih#jv;$QngEfG&#DTbM6}BS%>p^ID|}nm`km^>5nhe8RW`_yeK8=AeNkZ zxj1FdO<8Yl@_umWS(zy@Nco;htfLR$EVt}mt^|U-gau781zbmek1Ec|n8_-_jnk3K zl1_OIjyXC)fQAWwR}i(PLvzjol5{4~Y3QHIKhD_j!NG;wU_j$7>MdNw1RBxNH_k6L zGfckd44J^O9}xd1rj0g!XkEcDdR)G!tXCofsx7v<6sMl>9w^lEx_sL(&u|Qq+Ljj63#!qNot~``$uG*nJodNj za*fRPwx;V`U3Q+wdZL`0Lu+H?AwFEW_OuGhDiP8S{-#kK4a5A(;s^Onq+*u!>5}+KPVh%x_+FaXkk*oW7Ugyz1}Ju$>Ds@NWEujyosQHV7{9q`JI3H;bLV}yf{4ji=9_~BB#Ek<%;(I&e`JhRERx`x=2wGgp}0=X zGO8@C#!}9&v$Z74$8}(3grdaEqnUV-p6FYLH8ao1>_(iX+y2aQGzApYSq(7Abrt45 zHEmtXsUTGIIX*%Nesk|TyD+*!{cZ*ex&L+K$U8bY5kcF!s*u1W`1%qtO*H{@d z{@&fGkpsx@tJcB4zC&<`o#~!^gH^30siBOwSSZg|emabcC&#iuc(Dz13NpK@NjOC7z~h)!t#*R@?6BC6hto zW~En(Hr3kg@H>i5v`{;<-py#{2InMH?C5&9=$zZ02P+rTqH%Dn1ZQLM>5eca0VRJF z@)nM7tx~Pz0baEd)qilZ&`i`7)Y=+a5nT;(zboi(9wTRQ@~x#}9WaQ3?jZd;KUoDz zJDibG@zmoy^**-M;kzy)ub$_^qCwJGS=H%ZM9XSpTaL%#$Z9*;$tH#YpOc6WCQaOC zi)YRvn-Wr0V$0Moj1$~MdUoP4m)*Z#k!R_q@3aY8uPV)Kr z!RzuWuEmSf3WPdW3>qdaKTdI|Y1pR{wN5qElyl8mdns1;sI)0b zmVG;l#c$foYdgETQdE{Wr)XE8;108t@04grhS=9KpPSuaClK9Q@1pV#?uvMoz~vB# z@I3+1&|e!R>`Sw&tEJ6)QyGe(?fssfGd3w|nQBWL|kk+3GLA?rhiysFtl} zxlNAFkLPgTn@5B;UL;NNThxw>Ctf;4ECwR8p zi^0B}y?1yj)QOg*k-o9XHCUv`)@@c$m!ryQ!>w2YdgY>)J3V3!Rm}QjItni8SBY2bl<^d$vT{Fym;7 z(oeRW^gRt_n`-noS~iImjHL5CbZrxTXW7it*qhtMF!Wb%ijsLp=Ui<03PZK4TMxPu zn>thbIVfb8J4m-$-dY3YN;`j>P8CDD-qc=f=h){hyDpH>UaXP3VV~hbYU!6Am$&;2 z7E`b`2lZsEb{wE7A}~zP+liW*_MXae)>?5UlaV7ZWQ3|c9YMFbxb{3;EE_adCel>e zG4Rh>RnW6`m2Ytnk&eBN9Qn9=h!rHHq|s{5id$Y{{4uOm#BUiJAl(4;w)(UN*(FUQ z&K=9JHJT((0A5?TsPg<;^fFmiqO~C5w}_~WqGg4-P;hH4^E2If zjuX60OR$oOhl#^rwHWg-@&1MtG?NwOsU4Xfd*yVsim2Cd^LoMCVuOsOSh?J zWk&p{k{PaP5B&os;OsOgzkc8GO@v?*1`GrbkKqlQRCmQXWd48tloKqF7C8HZ6sBH> zp^W{ZLV<=Ifo2T+?=A4JlpzQN++pc;@p?$+2;y(>^sj1S9^$V75fEnbS6lyIw8{VP zC!jbP3G3A#u)O+tU*!*eH*o%qFJo|bm&k_e&N&I(t!1kDg;FS>`;C{U5H(|1A^$#=mNDdGgwNHL3nNB~V7s!aE@RChhPUEx9!O^b2J0 z%Ksgzg`K05#_u?+#)X74o-Qz+Xv`Vn|A?BQChopuj(#&Jr=2ydk)VeBS>D;v+S=CA z8Fa38le93l0h@9GPSXznl$w#40g-uM#Ze5X)zyD#sIO)>SW!*WnaHq70iV7Zfm?$@ z{y|k4NB5v`m*1b@^BQ2xq`c)%qBQ;u!KnLSf&hiz{t=W^qiTgzHC^dC*~&P*oD2#$ zt8slkUVYAUc0E775o&}Vq6jn|KJ`8e6_)xvU&?%uJ}UA)xr+q`kw@_V$R*f7-KI%(DfB;g-SpBIbF9r5ygjde-UM4k zJ4;KyJ^A;12aI7(qu#pS-~X{%;Gr;|GOnZ=mNC)HF_a)4u3)IM_P(11stjsYMF0)E znV#>_`llYl2}N?K|D4eO032ikKI1?C_ygkopFa-~sfe9r=J9n!xM@(FDohT>kff2EjwVTGi<2D9#(WK+NHdA;B$% z@PE`sqa=MmLl_`rQO`+(F7??H%!-?vdqM*d8jppUxqs;D`+sID{!zjJ@V*D^k$d@l zF9Fij8hAlwCXa7QSVDy;471%p!t+5sfw-T4&^xF~{y-GQ--+HMCBANVamGcWn zv@5Z@pi)%&(+LJGWVap-rtj~?M`9&7*VSvWgAE&t=vY_^Tk~YQ7V*p?%=Hj5pa3|D zNd-nSvpC2GVy|vQsS;xXu?z!*FM*!nGM8YFs7P#J;1CK$WYG#*J z6zLP?6;9b(1$qr7%a208b!_y}(!|HWNykSL9!*p>?E`cH-xp4*z=NG_=zZbTwHcA@ z{h1)3UtivSG;ZT$oSsmbpAKDmPjz(85{u8$Y z8tQ5yioj!Ry@nb70|vy=u2yj8^7rIGvjViU`_C6yPuWa+BN3SJx(EsTKx9;FLd7j{ z2#pFiN%djOO3Ks2B3?x@5HW3A<3PZ}vvP4X(4enT$=jLu>ksK~En$Ln9?fSyXIZL^(`Cay*4* zJQXI294zoVEEXBcpdwg-1O++Nd@2MU5i+hrK4f~s7g2D}K-oK^5eoE)r6p*>?80QF zkq;n3YFGc8%R~_nSsJGs(AF-zYJVbZ=J{*vOSRV{iXFkD!S(dz^dq?^w}HWd;8(wH z2lj8@zLmJ73#fEdI^J;3UrdrZeNEjIA3rh=xt$C{><6`5^ufUCoL_?J+7AY^b#+M| zn9pnl(r+?n$XhBNa}s;QS4*_cGDxIk^C3ODdBLXmGzI^VE-TFqfZP>qeRsHVrgUU= zCciD!!qJ#hNmboP(6=YFJw|5g(*BB4#s^mI{z^BrMNd-4GLW*5vICVMUFo(JD)iD>u4sVdpx!*Yuh8MIK>6kF zhE`@4dh)lTq>QQALBq z^3hR8YC#b_mG9-)rMcxH2vnwCMaE;aa;%82vozszQ3 z@wR-YFz~yiU0~jKc>OttH)& zKpV5v)T#?&wG2<#=LMX!L#H})Dko}V#qcIh4px)Vs9pfH*5|w|yxJ;CNVBFld=zv* zE>Cd;_rJ@I^|NdJ&ToX9GMI%QR}aIbTwCRT$IWH|;G1cF`Jo{gsjB=wxEPzU`#fy_ zDKfsQRP`n+W|O&F4+pi!PgeH4n9Dq*Yx zY6mpt1+)uDs|uvaDdMeK7M`Z*k|8P4LZMkn#HHz76;^etm1@ackW_^Zp`lLUwomRf zlgJHaCQwbTEKFAM>3XfKC^h~40uF>wuje$Id%cB(`CsoLP4;-wI{T99L^?>H8SS&E zptLaQjbbW4$gsoY3=?v)&W1-j*v_Uuxn9rhETn7_GYHCGY%OIW)%F&5O2jw1_on@jJ~#<-A4hv(H>t44V6)d6P{0 zeX`m$|<(%cJ>@F8?z|%ULLZRyq=yb4|=*73JaQFJzu(3ZB5W# zQj)CmvRe{l)l1!KdOZ7w0B>!3bH93A_dbqI9-4lAyy%3zXAJiju2t?`Uzgw1mYQx940qxRBg#_L9 z25PWs-|={{!Zb#pAdPZFTZqXMxCBgmqjbP&lf)q$mkMQy)Lv>a)zl;5=czuHXQD0A ztZo3cCt!2@tKX( z1@plM!Vd>`9wXHms z#nNund!42H*&WBs$Hx^r+lp9xes!UV!hi1jWE2qYdFKhn^)NSwY|MoRTuU^AP@x9L zZ^a8}tpoFmK&(A5=%t46D0e2JB)8ElR)akn98Byt^)01rD^H*;%zPWAN^ua(KY(Ya zH2s03n54U$U|1|re|k}+h+@*M;Bt{|QSKlrTQVwspyD1N?f+z;V8V+{QdDTAZN5@k z*2L1ds2m~f>83Kc)@Tyyy4Urk0f&4y5#=l2NT|vN?zz3(L={BZbNX0NsUee15;odI zIvYG<`IomP>YTF)jzVTrS(86`;;r+`2R!P-Fsh41h*QK2#)Fjx)3v2~E&d$L*X?IZ zP^$fLbj?MkMEoo;w@vH0jqL+o4jJc_F%cwbnwu(VS`sStwRBC*m`3Eb)|FC>B)>Fi zol!|pC9!V83ZGFIeyS*PO}R`F)JBycRE#$W+w|M~a&Yq#HNri`&p}7)B+BQ&4FBT1 z@OtcFyxsC^dyd+c_}4W_QIQo-8T%-+M+h$qX}DG)B7@58EtQn$i$$$nw>-Yacle~= zXIoMac-i`5fqACPri2x6Qn=;p=b#L;Aa?!tz`*0f~n&tU%6rc#oM z7Z~H7^rZDw6r}8Q#0ZTnHFw9PzZa=)hT20a;VFs=28u{{!czCVyx(5;7o?VGL{&@< zo}*&e`4Tfzk`jwMrp6*X6Rhm&Z-5vbQP+cth)5XB3hMD!9d}(-(Lror!AVREseaXP z6%_ao5%b{y<}ZuwOsV30b6`_zgwMc)iA#hC8SfT@CkSMa_&#z)ZFN^?Ygv`4uDW{A zEoBlTnw)MW+d~>cjX!S|FZdj&;s$DQm0%nqXj$7I7h1X=5ZFJ~2UGQa+|{|bW32u$GEI~ z!_oW7_(k`GI-xF>!P!e`;;YU>T^|FbF3Xx(D|10(@6PVIW>n$F7)jaTVimxZ8y>3_1Elx{=HC7^IaiVJ)#KapZIPG`&h{Y<+o_ zM8nD2ZL*O_9~u^NvhDA_Ox8Hu&mjpy;|7o@_IB=SlDa*oFRUdEGcDtR&eJb^qA0Ep z51cc8v$n)=7gmQL+NAL|YfXeO-Z_7TME@Qgkf!& z(WyQJ^$`PPIrx+&B=)ubfEY~3%dEHMlp!RC&~e%5ufgQIq;)Ah96F^c*WF1Ii9Hfl zTiunS-f@dDR7D}m#G2%fZYK50^3o|4E9~v}OJ-(@`K4!P-eG2@^Pr@nu-%cJkBvXV zUSG3*B?y{wWGZf3GHg6NAn0dz)EO)<){rYt<7lSH6J%^GE*5D*U2`d^tBs1-t`&+oq^1d>{=GxJ2X`S!gXz(G?@Va$U)aw$~Y!zRerDR%?oWns{9(4O< z$dI;7Gk~rKlp0ES7G^w<4<5*@??>u%mwjRU|Cz z((IJa9&R1I*5V7R^ExssxRtiCW;hnzIkzXfc^MoEIbxT!s~z)4tjATz7&yod5w;>k z#!XFzno}`YS22Kxn2N@zVuEG*w(G^X5iF=XRcORk0eZr1;Z{K%F2Zh8rGW&wHa;B1 zq49z`9xi=7ags?z`8&Qyn&P#oC*Ln`UJyxuq~Im<2gwo(HADl?;}K|U2U81;k_goz&e=x$46$HASmDq{ z{RTK7e5tmo3{P@zkcIxSNB=A3;fn-Vl6R>)PSG@z~ZyW*g*hjWH6-EyK71+IJ? zI=+uB9976e%1ZNlKmF#5ATnTVIaz}hG%l?@nq@%ixtwR`%=MS)M(}b8U zq81q@R_UWm3iUEcT7xK^zFyl^Qa4|JXq-4PrEl zD)ND045jl-^XY1v2m?mn7#C|_Gc9Eoo*!ji|1dv*{Tj#_E%nSZtL<33zSth8JIwZ9 z9RM_58+Y04L%5XTZQ2ETme(kL2%sy{R#xykIAA)K{=>`D z^QBZFhJ82qZ!NBS3h0h9IxATXN{EQQ3;vg_0(4s$o82pht=Fp2)2H;!MS=p9tNcuc zs?;a?x5&9`J5d$KUyQ-kkj(}P^*wm+JB#ImaX?RbFZ91fx()~pinMsyIdJI%Wt)Ys zYPBjeG4cIfJ6fom%z|o59mhWwvd`$l(r0BEzL@;br8?a25M>FHXzkbCr5jsbTG`k? zS_vlLDR!Pw%ddHiDwRfL;uq}PaWF4KM=w#J`8Jv5e1{~kR%!AlZ6*h5@KplC+;@?> zJ7SbzZRX4ouJGQ2|xt@IaXyoEqbin7uX@nqzlVavx%WClA^OTG32 zNw|+QIC&_nBoqta>5MSJs%h}b+OxJVH83w!cqOrN4!bauQXMw7KsJ`6_hl~8h36|N zMAhJ6syB96*%N%5)V!dF+rRP9QuC{~_sK4!9F&8#FYA$GREn&!^^GI0PI4(?l%iI?7IB)P@sy)rTW#$4c6FA}*)H}f5+9qWOl!ijx3L8mpY7{oq*F-5 z`3j^}-`@SZhjhRIFYMrB9+M-_W^u5|UL`&<2F~yBJ=Trcbl;G4dM!_Fyy7|3Llb}~ zrJ_o8p0Rd~x~&2{LLQH2)~;0RqH%>1TPdS#%RxSE7OGGIP3Xj|b1S`Ei$!hZc4jS- zT{&_}%29LVlnd%F;kJHcuv?p9bS=_~g;QdwKBh4(oeSe;of_bas)5aTZy5;%ELsfI z6i;K{$^(Lk?a^2+$;;~(rLY*JOtJKiy^g`!e`F3y@$hL$%<|`M=kSe#Q$84Z!%6gC zWQn}N(pVK!#VFCs+1hY4L0|-**GKIY6n;nkAwxKAK)~E(B$WPJT+UrJOC%+myjsQB zK;u+0eDa=c-gKEVa9Kw_t#HN28oQ^t6=c3dtg>)HY0*c?I{ySzP5Ai4q>RUass0NC zJXzY0)z0jFxzeBQ)d-edvE5cN5rvWbk{X|d1&P%V5`7J(dp+8ny_atFjHD~u%flF` zwA5Rh{o}exaw^3@a{T<}=<0GPj;H9|si~7vJ49acN@yy2t`BXGZwti&gxnGfqHKVAXo0 zu9|0=+0n}`Y$Wq$hRQXt{r>xEJ-a7qEUbwj_tWxS%Ywzk|p zxF?5PBmg>^#IVX5rtZhaMihM2L&NG9c$YR_AXZ(BpkqG)3|Spo+dejUgQLN;mp?&?e!8{} zz6K^5*IP76ei55#U9Y#^DtRyDueF&M1#ZD*eWA-OXpf5yv;i^Sj-w6ll;)O z0&RMBxS%AFk%c0kzQ&CY@Z{i&4{UGyg+&C436r4uaUDUPI{qcnP!gt=*wA9gF^wd;h z9(DAStX1;v`vh04&9HRGN}V- zMn-ZKn6Di}6%?scY(@rGX!|F~=SQl@C_m2Muie^1lVFE=>DkbHzfZSQ1ap8W=U{|x zAD}7(B#{1_e@a4Vu#Zu=3fW3erkATQMRW{C;y@Z$TzPyul~+Mm9D-swF0=@#8k3AX zxgfXVZtY8}o*r9noJ$`XGiZ~AWM9z2%#k=7iY7Hd6f$V63*~^fTG0fTVnq|fgj5cu zpKN;HPr*+z3J{zAaheQl-@uIBt-rfwoLV+ygyM2Ct2edcPQUU-g2?Ll=sbkP zKsblJUiWN;T~@KHfD^ zz|2z zr^tbpCCoCc#7;9IB_$~(Fl%8w?Q|uTd1+pO{Dxr5eLdXMi0F7wVP7*T!)nGMc1pg2 znqZI1>X}#y*zy?ph${k8@Ikdw?}er_)$Y)X68FNQ!cHi0suqV(zw70~i0Au)+`ZnF zm7Tbm3cp4-JtZX{QTz<6<|2-|*0g45GRh&f`v#7+sf!bPs%TjQEuH_n`su{{Si$G>}lA1_gBWgZNMH{ni=y`~cDg{t0hPu?$k2%=M4VVHeRNNsK*!CUe=}LCsV{ zd!73u8_q{ZBn;91B*cG3Ia;*{-kcWrc>4VK_4)Dn;$D&I6hlHQw*YtmYeF1_{Wr~B z_);%*n(=ay=@_(kod`QpZD<>F$_nWK8IEzDurIM;ExIM>i6ASpMrsYw17hWjhDX|H z(d5;eays=+6}%i9BT4?lVgltoMP6g`xMM$Sdn)}S>{}oh-~yVEBHafm?CSIR%2ZNt z(C73@|8wf*NHx^pGFN{jJTJ#muJJ~SWYR4*W!SuQ$j2PF;9)RN8%lF`zruH7VBmJE z%sv3b-wyqKyzY};V98al^y4&a*}RM~aZdiP1waV!QU%-A&d||~B`0?X!->|c#wCTX z3A91CJ_a&Z&*;>KMBTYY-;)V*xzcT8Vjc;)EAi4{VM+|CQJih2p(kshXRf0D*#lWP zPuKWrR3$lt1 zsLzvK{%3{Qa%m|t>)tgqTH=mZ26eqvXTPo%F*a}E%D`c4-s%2026!kk${ z1N5nx9mrFv(|As!bLP}^4XpW%$4Ad16)x7ZQI`rwR#Gw1OVlEguS4OiHdjya8VYy; z%pAUwz4f1ZCa75YTzb!d@eq9`{omv|S{ht4b9V(iN#VfBHXu@N`D9>0ywQeh zlIu9zdFG#wR#VeuUul{UCIfhm_JUkOtPy>XnVb4lJxkAA zk>=1tSE=9HCDV85(ow~&3Qp-)IUb-3kOt$ogr9&mB!LfTo*G+U=l&GCR1Gfnb^S8m z<0%K}%(xudoTJ7$+*Rr>9Qv^%!Q-Xdwlg{`SzZHDL@UZxP73+0fvbtP^)-KA-;Iny zWuAuDn=~MX|H0G~ha~_69u)h@4sw@?lNXbOZIumPyW+>T5Y3l9CF#1Mkr4{ejT(Wa zqO)zm?O>^c__P5huA%6_hKK$UE)@TEBdwSkcT>At^-j!&P8t0e&dD33eF%uij^Civ zC6Ar6uzfE(&sjUlI<^x=!Ej&CxD1C7dYyQ{u8kN`Xy9#!A9@xNfECi%QR^%h>P=y# zMM`?Sk!+_D24*F#`~yT`rBzy8g$*>Np82shR-V-2?h@!H!u&Ctu_z(sQ7mH>jt>WT zJd}VoG+cAYqL$6V!`-Qkks}W3Rz_LO-PN2Q$yXF^(b4uG!L$g&v9rMe=> z&Wj2kHavHEqcHN&-lq|S|2i+OCk5eoMZ+roDlR>bw;RdqRSL10i0H(OZ!c+B5b`rH zwoYO*t>iRT$*iHdR{qtyJ;)cj5pp-oHFV{*c_-U6o-Iy+F@ohIzh}90Hqys#W=82$>NvZWhM&FWR&190{2u8b zqh}{SIKELL1cU)hU%NXQ$QROy8y?3b;fONZA?WsS=ulUB0~EoXPO~LZ0<~=1)62`& zmTzp$aY8v{on9oY6Qi*g#9}Cxt-*WekzuzEC5qU!RMoGIy1w8GO!G3oSXQ*EUD9a$ zr{{+=%%X#~N`p%p%G|LxQZ%woyh6$H^M4;q%v7A|o{b54W$d?cgulNDJ+MqN+Y(67ZoXRYiaE_H#|KVh#3ic?3H?58OK3Z z_!Crb2wuFn2r|e>z|XO}omNxhfGpShw#i*mNJ7Iw#%@wXxD?=sqtVXu(TDuAn$q2p zln1Qd9UeuVR+?<)29*uAcNo=1n|omR1T?WvBhmpaOE2lMR+9CtgxS&qXZWkXzkoy< zXmBtHC^i_=<@Q8?e_P?;wYhN*tq4H&%S6&KUk`hBjBuCn^K>8xydL;JEBFnj59Ayg z7M#hyv)9bRx0PHuz%UkvAR5)CnIB;=B+SbT9`PfFb!c)}eJ5W;B3D0M9}bKO!T=A# z0OT<^1T@{s$kNatFl^@Hu%rFidt}*bT^lhCQjWpiAkp;26Ve&~&!q~XzP|d;?n@%h z%$CR-8-JAPx(G8no6<6d;gAiE<}NKWrJZ8-(6g+0UA65*b&-zt-Ux|Fj zVzjaQH035upM_pKI5g>b65Mf|4ghvUIi!QH3aE7Y5QgyE_tc!o7XDpj|74#;`ca zgkX{pOH)_cNW1f?7>E^YZL9NFD@sYN%<37=1WbHK{r7P!2eJE|GWy^k0xtK-J;Y^ZvS`??!m0Uw;L-O0|hxGj77N%1E0JrnbRL6t136a zs2{Xo1sz}(`Suhme6xBa!Ic2pdQ|J%p%`eV*3bX^F~HiFcZAWWp9#3wuXDs1PB+Ox zL!E_-8Lnq14fA%=>u~V=M#4-?ay-5$pyjMnn24(RvHmrQ{zj46k(~a5{RMYqriL^r zf&I5Tp_Mvi*W*gDh)77Yyp3vD=SVTx6C)60qqQ|(dNAR(C*rKwlOes=QwVsJGTKq{@!_Q>`%3R<9j0xA zXNA0|N#KY>9u#W#v;4X|rju9SCmX)f*|1zu$jHUP%UIR1v^7V3^f{@BU~glo4(Ylm zDKmMjz1ZbR1kgcpFd5Jf`rq9`gtafWQ{}!41_q$zIkFVYpdwkBHHf)Jm*L&)n)+$I zyL)xa(;ApU=6%MqyGmw0riT^3HD44)KB;$pc3@*1^%G&0hgW|^{NP-Kb-sNu@0e35 zuZeG!drkWi1^cAmtjG`DmhZleZ)24xL7iMoL z40Xej`;o@OPoJyyJe@|W$_43~F)Rt2QsL3MksRc&tM&EcRrJGUFkC-R7$GqwE+C{h ze1(`4atOa?EDq${Bv7C~c*aKwWE~|Sp&5~P!YoZ{YoWySES!WtW!Sk!Sy~y5*U!*2r^g#)G^qx!^WNeGy&<+%4&-!`T0QyPffPU-$EU^J0bY(X&MS!ZB+6E78F^-mcX&5J+ zM2rkw)Z(`bTGX&2WlhZliI_ukb4oAn{2X6C6O zd-X;x+*DPstF!eTnfQXU=9*Iq1`0C=qv(a3EDK>xjzd>lrT#{H8!;t0<}i8;guTtF z2^V!$SN3T>1a^I{PmuQ-87CosS=k(paGItlDP`$vO8pIuCa6+O@N5@_>S73Vb@LER ztYeIpSuBSLLXUMXB&L293(Ynhpe>l@c1Q}=3=J)P&JJ=5hsrjmqwb;cMeJdz9kYd2 zx!K6DqMWb%jvC{h>C3G!V*wSp)i{>P9ul92O-s9ZQ5zdN`#i6(Gz*JD#(=|W;)0h< zx6mx!=fl)&ddS!0>?;v*aSXs3luv>!0%pD?t4h;dBl-4GKm@FqvJv@~hB<9g|heE|1qANR@@ zb=ek=6(nrC4jLw0DO}sk^4zN)iZN z`WGpN1;7P&Cg!h+hRvV3LOByOG^c9vmra>AQ#AC{9S)P|_ktS_434 zwkRB5Uml(vedaxUeDnNqKp_mSasPe&PJ&_w3_^oqcSFJSAqO}j2Y{|2!SwC2fB)YA zfEA>!j#f9}vw8Vp`ayOdv2R)y=3o~1J77$4GN9=K9aCtwGdGW}LJmI%aE2gFC5-Qs zujnr;Bg}{Qu>{(Zu}n(JP@nQ|&AYI2-OFaIe_SgmFIq!gW1;tQ$q?@Q!b4XP@sP8V zL$ZfBo=iK-|1tt-HIn9b#-6n#Fn~z6ejLuyjC3N|?bbmI7ZzT-XSi^tw4@%*L^DN) z3pngc38OVCjt)%?Fsj()hmA=9dIO>=E3=2bEd|)plbP(c5#Os|+{>dDWZL|D%4nb- zolQ{}N3Asd6HSdIV4A?u6Wc5*4ppKqK+QUrh=G2hyUiDF2!_PzHF{uXt9UyM4JBG*tm!HYnw`HM zr}gm~)bzz#Iz-kjwOA}<#dX#j*Sa7dS6w4sQf-RvdefV1)7pk}HIo=XK&ng#7%>e= ziuozoRsrl{Zv0fH2B8!$du_~VCDZWr!)68f^<)|fDMm>F%WU~)Y-GWJJd+eQ;e#0E znU$mvu(`gB(YbbZkUjEx z(My`@56ejE+FiNTtkcVpuy}bN9T$i599Zt0C}9Y#2VGsA*UWSzOaY>!SG^Z?a>kzf z?x3Nf!wdM=Z>3fXXxlnBKt7|=fbVryJ@f36)IAnuCJj!%`o@%n`&Ed~j!&MzC_4pA ze5oOSuH(zYer#lWd;RV~cFWC5({UZ-Zri66fLB*n`1+Z?jf2nQX#wd)6hY*T{|7zD z?8+!7uih?_oL|I;pVw<`*$S+S#@kKVQ&acN*X7=ByXv?1vhuwoVAs&Y zS@NG@hMU|okd$$`ntx`rbTRaa9fqAsvbG(l`#dKFFNstYgZmB1IeHF5Yzm8slqi?;6|fFT6EH zB&5p(l|^cs0Y>+nWZ%B6uVNi)aFlxVR@n+&O^FjDV4YZ+hz;8h(j%D9$S)z-7-DWb z`!YI3ft=$6{}MaL){BEJ)jrDQ#hlp4Ob0)sh$;V`)=%%JvyBcc0(?orY^IlGC(r*4 zZ|xS*R>Taqf!lUDdwXMyZvS;XI)@T?}jJ2a8THF`Cfr7+A@9EyI_fz={X@x zI=xCeFwfmzP)0k|UPYyNMHqmiAr=F1&zV^fOmWu_RB>IpynshzzR}uf$m@RX=2#&< zWTdC&o23dC?oN81IrL6QP_&DbWwvuu#CcxQTpXDH)m#dBJjb$xti&<_Lz75I-u{Pg z%obaeRey7ZbSsOWet78tAvnkcOKTFm-eF{ferR>vq`Jt-xgd>Jr`nq40Y1`+#e?kd zQ5LSg+5u2Na%6VPGbW03^@sochw#T(W_dI0&rz>DU~2az?Njy;Z*+SPtH z2aP#`Zga1QZ(PotgyA1J=JRJ&@aQiz+S-5o-|l-yo+vS~MsIo2dS8#&a2p7kPS$?K z&9VF#chvvp%*Gzx^@U&qDt;s&}BQhFtVX3Z6a zNdu0D)>c}}De>iV@xWOXE5i||=ygqyWYOiC84TE_?N`+(GgF!Fpno#B7c)GlSKG$K zPs<;=F&J#h%URR6n%Wqy)qH82!<)DoxKhEdf)Vz1Fn>+rv70oynMhCXlHn|6xT(Lu z;01Jvp3YD=t&xDc_as;&@}bX zCrXfU+j*pmBQO*kme<8~{Lxak8of;-oUWO=DL{6H`lv@yA*ZdI3L^vL^zWPkQ3T*@ z&CWvja7^hc0Z_(!ikM$YHKXUV*YGU*^Ev~k*@y3#&R>^*DO?gze(7_)c^2lX{j|dU z?mltra5@36nP-Kqi*~DiW64?kDn+(%3HX74(%RaNbG{ z?ny!(kZ$ba+-<1cr?0C$Xl6|zvX(-tRhV+wO3oa5Hm-esqJzA^6rdwoLQhT1(+idaW2Wt-Ub?yJ*`&+LdgF>lf+ElRi)m(5 zDd<|5P}-P>jg_3l$K2cj!QU?;kM9FM7F?tgBu1hgJUIAvBn}Zk@ivSDP%v|GaWnQr zq_3Hm^eH(zAUuI5}-TX0CYV8jQ;I+w3}l{O!+Bp-~KzXf&SW5y|^AccH9Q zTu+Q_;8UtN9lMT$Ik9Zyfo(Yb#ki%B5HfE`pDIg#B8do{pPe>0r}KD8nMQ326~&J% zSW;vF|7{YBKJ+*dE446yDvQQiEB*S$#)IX}glytVLV1S@f4c&en6vguXu6E)trtyF znrDeuFDeU^LB0LIdpZ^b-i^}pb!`v7AFI0}|C!^TzyZ8pMh4YHG4o|9nEd4#zpCU34SdUvqDuy2%n{s_S%uWzn> zM@0y@<@EB&flcYzNofc(R7s<(djWI$d+bCY;Pr&XlL1&>sm1B;2FN4$d1!|G@KNR> z++nabwiUp!IY&cKK#QUG>TXOc=;t-rrNuO6nCQ^&t2eNTzflIh6bNSYFmU#u{Ca2z zV*ZqwAU?d;5jVgcVjYa>8}i?OgGdfS%f`-L@RPv?Fpr$LT+r*;UwJ;F4AQ3!0{UG4 zHw1g*gD^;bI@6rz-Mudb<)EVCITVE{CnBL2?7)$pMChPFySD|3o6eH z^hOXtJg8y%!Xf{LiF;56A)~)-X^A_*Kz4Zl`*i`d0Z5-=Ac&8~-vb7&PC&CBBS?HR zI`=|ES`e?g=$(jU5bgYJ43j>0()dZ%s66ku#mJ6OF%#}l-1UBzB2 z^o-;Z52rtud&^Jm%caw*^3|eEfnN%o3~)>@yC+W_#7E`Pm$CL&Ssn%hIJVMfSmrlr zcckXMTyc*y=JB7f|Bt=5jEdv!_CyH~NP-2o0KwfM1b6oYCrEH7IE_020)*h&NN@}8 z?(XjHG&HV#oBWgayl2jxb!XjmX07=!^@XCV>Zx7(+4|d$L|b`34AmUdR$VniP8zFa z33@K?OM}2{ApXDd@wRy8MJv)!ALYk#T)EG)OB>e*=aAc)5f0VTE)_-m-Mu$AyCAb7 z)C_BZ?iEJo9Ti4>qWr!z*9A5Br?t8)Sh^w}cQ*Y=DKJQ!T#+AeGC^UG= z9v379QE=Tq!i{_1A4|%H%Yr%x%P(R6s)y9U1uV;~;J>I~{M&6$$lvda-qEhQhyCEt zMq!Ei`ttg+x@^~oCGbANSO7nFaUq_Ou|Ku#Tk3x`@WeO54&&mAgUfmzl#s)VAtx=f zH7Vn5+!_>R7+o!`9Q=cRsML2EIao6_+hmgUU#VOCDk4-vAJSS`{DREPKB*LKA6!Z6ISnf7EtJ~p1Le(viQWr($j zd^B-g*O4HsC_YRie&t1dFPRAr=mYE*53|&w>_||M`O# zV-w?Yy6fwmCqLfh7n-+kB@%sgNF34TXEo5J7AxZAyilvn4i!8DlQZ}{U0AIMfd5F z)q&i$nNOaqkw8GCT@_Tu+xsH!ah*xuX8rV$tP7H>KjMvvhEz#v3i~wsm@P;j-FrWr zdOwUvM)->H7W5enwN9*nz5W`y-(2Hcah80z?A~sS@O}LG`tEWz-+@{IiS>|#B(>Rj z?R+$86S1S!fm#q%wn*^eJHB~tju&L-uz6|#m&xO*OVCXwOI1Nn!9=%{rEhOz#XA>_ z9d!D5els^g^57(TS-UGMxXz3h;aFSNEC5*`&%(r2nY(S_OaC%is^jWu7dZ3+NL1O*v3b`w`nCZh52>^d!KAx9ckkL*}k{wW3t=Yr0mc`|zBcjWHY7qOt6?>;9+kC9D<95DZ zxJhc&e0CX+CfMS2;Jnc(>#PQP{cl9PY(*k!D;~&IX->{VCcxBJbMfNyyd>TC+GvPI z<2=qpzD`o5SvV)&x9^)Zt$ioHG*{vc>SJN2{XGPk}37}H0fo5 zpRb;>!z%|Z9G{C4qMMVB7JNXb;bI**(A(+q-f2u`rwn-h!Gods9{df4ZT0HKKM?(s zb^L4Wp*}@O>puz3^uhDhYb8iT2Pgg@uW;Q(mu{CXcUSiL%K& zn<%~WSdXX(ecf2pc;4X{P+|NBoQE-Ql7P`ADTy`E_*MKlllpm85;sCTyxYDK(UzyR zwazArv&8j+-_rWN=wV(?+8Q`wF;M}D*Kkr_zpb0)v)e&qBk#+9YfKk`Z$2gWrh6@_BJ0Mqe<fZjE7r+1H=>A(DgMooreJuoo0R4*!g;xIWzyE98fbt1O=+$=^xTh27 z@%Fit&$E9{VZOsswEj7Tk$Q%q|M&bS%uANP=O29F@&2CE3c(`(IrqVO`|PPJo{s<9 z{1X@cSC|tB!F{^*f8Wu1mdfMw>Z6F`^V00f%9w;mJc$gYuO+L+KAbl?r>Knig7<4^ z+uPe^Wo4$rDWp8lU|JhsP^Dm82_+;YLyoM_L_|d)M=OuvcwnM)0eOZ3LSXvMH_eP=D=sb;i{#pi^$U9=GZy082Ev;c-a9zRs`{#7#hjCwDS~{a z;JbR^UIBr_fN33|B?-td2~f!WNG#gGw*~tu51I9zR~(>aG;wRA$e=7J<#Q#^y_~}1 z6uMiFxI3FyT^)yq(c#KRtQGk6LRzBvLvcw-Ka!c5*=tc)%Fr9p0?wN`|6z5RsZn8W z)`TBVtPlfn`ClikJp4#XO{Js@{k(gfwtLGVj$e6$nR+SA?VP?%d+ECf9Y^1i zyfP*iqdwWkvSiE0(7&O`5|w+G%xEi7qSGL8zKlI@w0S^0pGymxUOpG62b~L;BHjeN zH9Mo`Ir6tJ7juMV78=Z1IoL|&WfR4E@K%?8pCC zpbA^JKFr&pFktbZE4jf1)Q>1Ei6NE?caf8O3%!+T3x%?^rGq=aHU%%cG|w&6U%7IG zROV2|%O~Ph*5{S&vGL@EoyINWpB~&-z9}K9kNAGO@M$~g+kBzDVC-#uZ$Z_=DfG(f ztf?QncB8tsfr5E;F2C9iT5EE+c7zIUb6nJ*Chg=Mjjg%ajF6*e+3c)FCPxsh?R|es zLO(ON`!Tj#uY;|J2w~lNeaw!C=N06Aw11L@nBCjjh9-#Xw@})V4pV;jXFtfSXSeiK zlqHVm`roVuq-)+TT6V`|oTj(zwh|Q+Hy}p(Yf+A_MS;uqDn`+Lz;d$#p`^J_qU!(I zOqI0$ctjxA4I=9RBxLjJzMr>bD-g6050e8-xZ}`4#>pceN(If3!BbASrJi6hJD5;s znf~Gz!5vZY0Q4?20Qgp~!C8Je^w2(W-PdXlv3x{%7Q*Jnw8g#;=9E#mnRRjL7d;yD zrD#Pg|Mq=G!zmUQe%>pjgxN<;IdgYeA&aOtMN%^u{KJz8OY_npIRxB{+QpW6&<1G2 zev~h&xkJ;v%b$9jIa3e)h{y(qW?_1<{aZ4(W9{32%m0{ZyFYjt@hBOKngc57W2djl zT3)_7BLDh~_-;2VGG@e!?=CsT9!0tD;eOFw2{SB6oKqMxaGjNadLELQngzS>=Y}rY zpN?NXfY!%*8B|wSXNGL17%CC?m}zo;WH!vlyB2CIj3P!&*^e1!aknT-k7gmFw1idm z?0K>2NL-eqI6%b=(ma67ou>-xq>f4fRz9Nnw%raQ6cFa z_c%hqpMxY7`84BVtI0i2Dm2R+{Uv6LKN*krXnqHbHmjzwnHMX3&GS=@ZyDhTN6AyE zSP9j~t?81#CR7yA^~&EQz7ffR6snFkr;Ka%n5p)@5blzg-jNz4CqGjh>jVhN-<&^ zP-(CLIuK9Evns!sXHQ4RcrY5>uOwev$$n(^lMq3^*P?GdzN~0($+&O^wjESiI=wx( zq3_D~9B%cW*UUIJb0_WRC!UIE&nw`KL)sTPhl6>;uqE#j&xms56B9X-_R#mGhY7)Y z$9>Kw);mb-PB`;`eYA!iOut!m^#YNz%>C!R)5wFS7N95ea;DUcrT8mmp6@P2)_v3N zuhlBk`1WH=zXJL5g$sBrzjb=$<1Wd4#44He+RTKSyv^e?oGwy;^rosQuGZInPGzAr zl%X1ariq$5(!*wsvG*ZfZ0?KS(JbU8*ine!&~<=_o>7fI-z1TWMfRW?DbSgq&wG4T zKtv%j?`sjUqaz&R=;9MY8A%Ne&8{Fn{q7>>eE3Rt>i7V`{_R}~S5tMCrX=#&I(|7& z{;@6wO?xc9`NcfXWdcWY@9}_{U||WEnf8U2oLFQotyhDvu47S4n0o4&849UP%V80N z)^R`m;Bg=@+hgiwf9cl}#5EZ8YkwVEGzwQz#AZ&?hSHr~?XOUZzkTd2RJ%xzThiuz z`wZqV7OX4r=>Nv=2c~!>)h&Ne`+Wsss=Zi9uD9b#AUJI+`&0rDc|ss~+)uRHc^n9~ z!y~{RyI|eQ3ZLN}mT-zgiy%;cX?3H{waY=^!$(#JQWg`30c!XD?w^DPtVkcSMvCtq09a#gI=7La$FV4I_wR zyrm@k`Qq34LfE>NUr))Tb&}=h=XbJ1W}FU$(WV=8(&$3Ryf?tjXJv>YR)&e`$#^_W z#CkiUm3aKPxrm?`RqsWVl%(rd_P%m3Yj6*LsVq?1a3@><9-DITmRo|*kp>qCpU*BZ zTJ&R!mO*_v8Z%FttIccvynL@|O9uH(Rjy6APtjLD2x&;(9BNFVeNmtjWKl#Vs!ey= z<5U3fBMnjBya%T0Zb{FUanf#|RjAWt?)|tD(RFjAymC80pd$y}%|m6brkdV;kEf_H z?EQC9ITd~bM?{ywTel}3mVh7c=YX`>f|!CX>eaZV96QPy)S<_2kMfD&>oF=($0fKe zy;i+F1O3WxU)yx6#WBN9@ZI&+&^($vr|F+F*LhCwA9d2!sTb@EGxBaR^T#{|Fb*_3 z0q%ld0VV27B(%dOG@?DK;H7@1(Pc3Kgsr8{inJwj;?+(v8in+Ej4XG8SJ~hKjH40v z#9!de7K#3Fn(jz~(YB$8^gu9t=HkGigUIWx_r5s?bL6p+0=H7=)T4In7L;y$){w%0 z6mZe(fS;Of)Mbmoq0fF!3LW2_!-cSX)#79Pw%5B&&yqef3G`H5Iqql6Wn@H$DPl@F zw~Ka}Zkefl#2<%DX+Om55U10Ve5FSn`u1B>Q;-agD_g57Mb{rqs$n5-1JdWONaP_2eDhKhQcbhWI$Jaoh-_gU{BJ_qSdyG|f`F_BDMdUS4cAV}>dw zV%4EnFd_wvPp-4|-Qu{ellM=Ld{tXpkR?!It^pd*blIR2^UtYdIUUnT2<>q4A=v=(>q%;8rG#k1y&m_*h0GQ%`S%A&D8Rj59nMy-S*y8b+ z4!Fz2JnY{BHps1<*Oy&+4lig*FzW=n41Uf$5TGf=C@p*W7O|FVxocTnr;9Hp*Dp^k z58o-~%G3Hu#o`pOmd-RawP?;#~2>q96 zbUbO+$FpeL*+R)!9F#JBfL zI*sV6dHNi53tVyA+kVDB(p3}#ycD<+Iad#ShhyOA{{ENO^fRWcr6bQN)si3U>!y=Y zyASocPQ&ygv+;526zaVWBdX0<^LDh6@WO?!3)si*o@2#&*nDvDp}+Snt#L1NKM}dq zE$j$~`ZZ|S0M(V6-wYYss=G=#Bw~$IUnI#O%3RkMe-`d5l9A3xLL^O-&SXYiennyo zbW*}>Fw_g83n~bv+Jx>=!)_sDs5V@=rCV9*J+_&}FEBsVpF`;FK;BQIq_TX+`NwpJfg5PkOzTSB>N-^osMfy9cMXXXYJHBum;gD)fVOIO@!q{pa zeys3P2nHLk$r#h9z3|ppO;%liM4&|8`}CMd65(LfJRgt27fB_!4?@2nPZB46&YO+` zV74p=`!p2c*_%C(hBm*Qn1!T>_2q&MR8vMpyGAK!Mod*CmMuY}$fO9%7X*A9Br!9C zJH)Vb=`t8wy1%&IpEzyQt@x!|fSO0579ec%M6BJoGnjL%eP$U0rUUqMyoJhe$~Lx2 zTOsIu!>XCnIy5He7F0ok>Bf$~pkCBIWSq?`MJ)0GFvT62lS)J9e+gq&{rbU3sSs?l zCf?F`NR*_*JFX9J9chM;`ArJYO_rz1D$cC6g8C)Ud#dj06Cz>b_okVBp=pPJ-K%qn zO59Q&XvjU+wD;6Qh04pnp!3TztP}7CN_yTf`&E0NANAvoHT7D4`?LnNY|79h0);nS z*KFi#XohEDBT^E_jn7C`PhWiGN8epKQAao8N_EOted+bIB>ZnC1JZZ1J&0{1oi$$} zmdm6^9e(BEO+Ou=R$|3ea*RQ{`#=NVj|iZ}8Xq-_jZD-v0)A|QWZyWy+a!YWIp`*{ zL*V%q+(*YzX!g`?IU?=&UGjVuJ1N**GkxTPuC+5zqstCb5oV6aL9$7?mFAw}_Ex*T zG5*ci9>95JhvrT1yGMp|olbo=v6&s=vrTb##>p_6O0NEcljWn?g+mAYrVv$iWndEs z?`oZMo3DS)Ig#6*##EFZo3&L~$UMWo{qjRYX&z!#JIK4q6SK_{R3%b;r#TYk*_}U= z;EPy(I4ZTg2n|bMd}?IuBKv zUB1`4mq)gk^F!^Am+3+$uuzyq*LR(uPW=HJCpI4Kda*DW`qLYxu0)SlpMs$+L(wqY z+iT|}Q|1rzU4pbrE7t>-`~~nZFs+2(V8MG~J9X=W!bYs$n9VBxRn)jUxrL?Wl|5uC zk=+z)4par_Rsemq&w~)}+4%T4kqh@_bKgwJZ+NXSI?Yoe^Zr=~6m0=7get*VsPc`% z3cqC8mqJE^LYcoZJUPq!<6femJTxs`Aw3aua%X=uUj>C1y5@9@3kwTr=p`gom_56h zpDzA49INJ?vLb)6Kc6dt|C7N#Dk9WiL&SeRdM^XcaQ!v@cLa*opZ@QhGJp3R3=D=p zoFRrEe1fAs@1Gle|NNj^pDO#V+Yrt$NIgL8j=ulQD_sJKRLglP^(fy)znO+o%Y|!7 z=V(Ku#vxtOMAaH({e9-w`*DI*=#olABA91t@M1l19GbDNcSXx@Bh8-wCL{O-hW_u@ z>6WL;PHS!#ppoR~C$Xqeh}9egj^!MaM)_!ej7ij0sw#-VFOhRJ&dvP^U66v|Y)i+U z55(t)+(pqC^dmEhvZOKVi(yV?c}7h|YyseO14x{+gH!VL*U`;d+@*p63v%*qiLA5? zL!Qk-qH77-rv}&IEd2ztEyevu`yT`!ITy9u&+hZtuZqv;_W|WG8nryi39(5@svHfZ zaoAlrlJ0H@RPj{quVm;EZyWk8>#@jzyLlxb4?YDkzFhYsSjx;av)Cfu<-2WP%U5Il zIt)Y7@_lrP?tCUj1ufi+oV5Hc9=-`Ods32TvxEIormCNv3Z2X8 zmK$wTeF*INL43c^Bv4YN2T4kH2Uq77aa1q-UgpAc#){3Ra$QQINNE?Gp{O3I#;jf9 zrU+h$dQ33v)94;?w&X^AV5em!C*K=E>i z<^3VMYXGe6m3Q=@$FVpDUCnjg>+a0<$f5jPx!%b6jyidiV6t}dhvRXs9^p37sG?WH zseNf+=hz|(?;md%HQ9d)>3h8IFww7}dQvgqEbxiI z@w|gPN5O`PiK#?^3g~$c__Ft6UqBn%`L<;37awF@(Xvq2nYOcG=Qb(rcH5NRotnCS zqUlV~T)Q(X0^kb!hJrp+`~!&K8mBs!mC2lYfcb6+rCPvrmAoaOj!4nRX;dRQv$%!z z)PoLRl?;bWjJ=$1`hNA$TtbB0!bFR2^nz9l<=`Q(#_J)&PFM}L1AZeLIz>aTcUdfx;l%LV{Fvd(Hg$|_UTV8H{qagKbfD4!d1*I)0K`t zCsJP{EOFB`NRTasmb<&&=31hay(o?CW_wJloZ5=V zg{;H^@;Gr=8D%cDRge2ZfpZP!Jzt=DPf(BM#?T^4tz z>Nlz9AM4|X_j#Ug8<_?JcvG)Gb+Nz*q7RMn8m>lB5Ry=(94WP&gva^Y+Ss55=UiQA zUNochc{m+1Qxl(~zdZSIsxEnyNw54-w&0FS4|o+eEEYJ2ih7z2XRus*ITu|c|H=Lg zJWkH~7^HvlxLz{T=`?%PR-1M#T0i`tUzuh9`P&M$Ho*U}LjT2Q z{Qvktw=z{xLE#+-2QnI3-fNV?}xzt5L>TH8FQ^f3r^LRiwQJbD;+~zzz4Z{ z9gGdnhujK5y}GtO^TSewy2ppp4Lz^o5g8lWFt%U%--<%2nM_|Ht8MnC&&ExCihneZ z_e1LNGRrRT4MzhQjz0tE0%MTlli-=B$dX1-aJMmIHB5&Z?+5S4V>jU|J}PYV|2Mk1 zGn8tZo1x1D_+O`6~vQYroOrj2WKH~TW#yH&QP*;zPqL)#b znR)S2U{@>*bPL?C6k=g`5JjI?r`Ms(=&wd+Ys&>bs3cIg5{kP@Y6kuzi?i&1WN}XM zPj$J~9q!Lt|B?aY3!e}G?e5&u%wqAC?w>Y42U#$Ft;-|MB;3E9oe%}Qp&`{aC!|(Y-?$5_t^=~Ni4NS z9S28k`b3%ZU;rtM{(y|Ox~YthhmDW5>1~Wupa*e0Uf(6p?Q$$i#%rL42L=xA%)2^Q z#vZ9K-5B$&@EO3;$>@u|t49*EL}8`AHjGmoR4OvXc}mL~ynHHA8r-!AAgWh-=~I1M#r%@D41 zjl`bXHsA;ek7^xBiJ&T+t>p2?cf{`DXhO0m{lfR5*`^27tv|C_0Bm&F0FqsLZx2 z(nP0OOSWYGHLA{@;~H-J`A4=hA-l!Zp&u}un7T@u482(1W!_vcw2-))g_QuMz)KbO zZUIwI`MoAAN8Ay9b%>YA0kTC3k(GRCSRX^l3Wg!Qp%X%lO@-*VC4oh->AQf;;<)nA zv@-FGuQN-Zcv)&_KP59sDSnk7CP>nW4-M>CvQ~{X<`%~`&VSr4(kBf<;fRajL<0wk z0FGGuOi~bsT7`hyz|j4{ol~VH1Z_G4!%QSg-Z~mdTqHL_8G}qi8A5k}!DK%upE)8V zq|gliwalm$CUUh}w?q$?nv2!TP6PDPnhY##rhL$xgwqd7DY6j9MuCT@5=|$_oBpJ@ zo+N7&#}5Qlqd(;@C#gFnOk>|!y~u74zlqC<+Yai#PMEDvljcDB&{zb@*Q!BPfUZ`g z9)q2;6<2aXS@94aV)p$<5DF_*qGj%f1R^B9GM^sIuYs~U&f9TQ{s##Ok!&oLKN~Ed zyR!ySd{8!(|19TdWsH=xkm<*Ad$bU=MPz73by5xZ@C`_`YPO5@zNs5CEP&|wnj2L_ z7X4yd#CGVoU*$cR)7P=Ol$G=yRc?_vrhJx0r2yBDIVe?Z3G45J{#l#g@c2{B$W(|DY=FDPyD6&RYyzC`mVGfl^$!L8Fz@Xh$qR~WUIx8 zZH@8RRlDR^H2P8;ok}BrP%%70)`lc8UZ!(GRL4mb8&DT0-nX`YWfQbr^CIB>vcEB5 z_c|%!bB5IUdJO)PmMQ)<(hG_{H#CJ?rdh-0K?aA2OLJ1KGZ~57F)$WeSr;|7SH#x@z|NWT#US8H*41`RD^wYq z?J7ye;lNoB$=u=Edkj`FXab%Gny(efw&0&LF?E+EI&EYoCb`z@&7XhquWR$v`ZDb* z`Er7{xsIVLbh{yNM)A#-0cO%v0+Ec9LZ0Z6;glUg654TIBGyGox^#5vYG=hUSVKKj z5r^*emeqFbc)(}Ah+<(m%Koii;dOndYc|#4b{1z07CNbkc!Y;WcmnCSomeC=I}p};rkrn z_ztPpToh&fMvWcQLRPX6$$#mF;@NR^O?f^(8HPSbT9JN%soO_c9LX6!){I?JV6;7?QK+bmd17pyp^8gsF(bCztU;imo9yAiunY)`?-;) z;1&q%%gbp%+E56tAXh(Qp|365)}F3?POBqej$L3MG-#HZg6f=^^Nuk>MFJp!`+1gX zpqHb};tfhFk&p{AQ(OG}G1CD%F9qR@fH3DE8q@hxjyMc4tGanEHIu zI1~<6Z^-DC^gJ#^bSMZPaj5bytfL$kMi-eTJ@XiX*57dP zck@58?m)U#_6^133ROh4_)gtAWG=wPq*L*$qN1vTb9&}%z)WMGo|V;wAf9n#{dJI~ zqnDH0_f%~Hi&&(`1^bX@Xw{- zW=vkLeAYNSi&%SZ0P_U}naz**Y|k&xZf#-)vrg*exxy~0V_B`CH*k#E6d9`U27M5_5BA%;HImn<=$~FrV^XY>z$2KkP8YzjIHnb!717g|6w)+yHn6~P!>eMPh( z(FxuO=td{oY<#ogWt^ozu`?_70CNmw_IDr9WleK4#inNZSn4g1hcZ=|3ALmm;5$sT zD;(uh5fSTC%o(!TTbHnq3PT^U%X}K@swksgu*1=rsa&{EmtZxqj= zR-T}&vsnowJKMmjb+S1V35xYPXfSkMy9MdGuHr;9pX_lzhO^M~I zW7`m|3TN!WwKK2e?czmZe7lbP1-ik#fJ{JqOsKesuSPxV2V*OJHLmJF={jXc*_Lnh z_2)vN>Qr>){7c(X*~ld?=4BlS5w^!}lh-Y*_R<34m`GM+pg@Dq6%Iu!1^i2vy*FyG z3_Uw%KqjB@zT&#RvSk|)b@iFa`%obYVZhj|k{)z>?#{(f6}l~JhZ~VHl}AlDR1<4z+3UTnW06DgK|R*C-4gnnCyjw zpH#4kfi-M`Ts6Pw=sTmO$}YP0mXC*zn=??-r0le*=xWQ~b2a?(BT!0yP0}$5o~P>n zc#|y4pK9$%&Ms00-{S3LozYV2V&~tZqn(tPD85o(SO1=~h2oAWL#&gKaQFC-X!}){ z$TM#{FE<-=l#4kH&4e_a?@N&ScLF@k5i?$vCKev2c1HjY0T=7f1{i`hbya*5W6P`+ zjg;s};uw9m?MCkIJNNU|VgUtjHIsp6wzj|o?XFTEoG>n&T%P&)ASzsC>B-P5YfHjJ zO$pDj!OmQiH6)gNBQJZr3xc#1Nm~5d4;&>&7l9=amr;A-Au9bVTEMhK-Gxrm*7n8o z_Wm59)@0%XlEj2WAW%oE%ROD#^&o7?>^rT&_r%0Hr*%|oj>YZ4>lZR8V_01lY`{#hSCRa%XH`NX8PY8C?B1+~V-aj5u%WKl4Nlx_a zdAJ2>8f4p9Q%K>}HJ18T7It33dqKLyzy@C`9C=J{cSC1;wd$NNJEkT$>Re-)Ksu4x+cZ0gx`ar$uNJSQcA@Jx{?#4MvkVs zZW3>dC*R&NEzgtfSES2Y2=UnX>m}4D6>2a@ zaQ_)_-s13Y8FFA?AauJmDrghXWBK{NU8$<7%Fn0G{09;8S^0|r{D0=^{|)K>e`#We zNZyAMBjm*sk%;niu^45}wn_j4DVSwVgEEa~0ntB6BySST$lxFY1H)@x#;1GVz+*i? zp^6ZV2CiMR&sJ97@Q8g}Uh^2GCM0|>9r^pQ$5gG*=vVA_fe;l|22Pj!nM4mV^ncLX z%3)~JCeRyE|Ec7C_lL*(4h8=ypm^xspP~BPP<-PF8?}etHte1V;}Xeb33#|C--4&0*nn+p%{+H?eX! z|1HaHUcvaz=kq92!T#rI+S{r~=_3)ayA|%fM4n@&lF!cPlwmxbX?+x3zxDg)jd*3= zo34oQvRXo0_R$fBMV5jhk3XRJi{o+&d~Hs{uKR+wC!W*h=gr{}e`;V>=r(T5oZ+*3 z&{LaPtrf=3ShHiep3YdVc8NMjVjh?NM^T0_1^sSzYvf8>k;Qkzt@jNZzR8cg|?$2j1uE1_>*;$Vn8sxDrK2IVUMw z>?C{baX|!=cPxUj%?P?uQLLex+lNJzPS@c&QT?QSUrNtYGA_k`oweX9FVKX2U*;Zb zDYaIrHfN#Cc{n-!wXuXntvfNfjb!Zt`F`MtW8?Hl)47{V@b0na!UxR;-s=nJDqN&* z#89?tl@A2a2I}~lmUI(hl${|aACfUjV@w({_NakM88?;F7 zF4NPq$W;H(!WcGpKu=k3w=z>Qh-l(%tGv$6ACIGq%f+vE-Fl@r{M>uu7f+(xY{7W5H15tGdgLe3D^w9k1GR?X#jU1(aLErGhE< zYvtZD(Lw?gLB%7eqg5bp2LkM7Y`w9t`WHC_oGKtHmy-1D>}Eeb@B6-GdLT1BvJV>+ z(uCF=#sPwu`Ul=knCE*A0=~dZ$5WZ!y87&?wJ4U2-j7Mjf?M*)r6W1qKNCmncRK8u z@+5R@bu~+@RKoU)Q}CSXj&Hm_^n1LUk@@yxn5(o@VjE(hz1>p#{aAOmww7}(_BPck zX^YRBylOKzuPvg_&UWfoDL5wx$Nk~x<3*e+|F9jzj&pNr8W;tWXT;Wqnm|O1+1m8%r^z2p#6XMkcieB*YZcen~Xwwd%1LP4s zWJ%vMo1B`Gzyo`Mcq<8g&T{u_%AGSsL5CN`1PghBdS^Y<);paDo^HG+(d_@Qy`m-w z<}BB#G==r_#q{GA2YXfQ?$^)$i7B9#=IIvsN;1Req$}QlGDDqZD(Np{x0lWDmd1B4 z$@hyG;B4egh`7P3HX|4oILy_FiF+njjIy}}BdHL9x22)>rw1g*quT&iX_&O<{~_w% z>;?Ijy4aT$({2e*_ELQmZLS|LYGAO7dqI`tEp;TJ=w9y z0Ir~3U!xLG9Cj`VP0C)r+gHBk(n7!9QSRijAeAg}cyuEd5@%nxEbc9x@{9a* z_5c&UV|SBFjbnR#{cQ-c|0eJWByUY??1I;LBMi7Mh0Y-oxb5j7x!;QPzQ1z`(-tqiQa8nS8dN7C4EU|9?p}O zHp*tzRh92L&rxDgb;bpzv)e|_S#s7YVppW=hq?s{SZHplnaS-Z}n`?g1 z**Mz>&Ix3*eq@CtDAh$u-AS$~pZL0ub0yL_Zthh1_|EFzy_K%oY7U8v59GyfbItE& z`SOcr;CnSlIu z`-71y59b}R!TY!^kL^@%aXWsh<~LJ6-hv=KkjECtnIPm;oqUJ2M1xPw4cr;!gK*C) zRxxA>xdjR01FT=1M!}>b|C?*H&b$0J)S`Fw_+l%7i z0!&HDn9F9&j9YC&`1?BJ-}M}ynUiS@{d^S*T%}Wz7JGqaOpkM~gns{(rJdb}(MX%; z4_gJ^MmE&S<|k=?LXJNn*4r!SgF9c7T6EFA=O#%W2YS)DyOTcF;kupgi8)@O5nNWd zXYleAEcP_CjJxWd3-{fu*udw+USVD!fXM#{#-EVT-j?y%y9=h9Qp-n4P_UOh7e}Rs zzK2InlS`w6zFWHYHxb#Jp5pI{Ab9UD{HvuiaDvU4Zik$(HA7Wh3$m1rK`#kRG&lfqH32L3_c&-KOs? z5S*_9c>}>UqAJ9hD%>%6$wjTv)5(g%vXH${Ju@|4W!n>h|MAN&F;^o&LB>vUMxD8k zNQX4Yh`3-yz;NI3aB_}x{!mtzv2}i|ztcsrAfKF!Wf~AjpeSXFEDf?bZUf;HCns=J zNZZNa7fBUdO8ijvD;2Af`$_pN7Z1YrL zdkQW8MxeYg@b9aP8!O6&NPoqkf4Usyc^u(_b(9Sba^oTL8%SKku1>i>z%k#G|2U?r z>D_P$33T?eR8s`)%4usyMi~EanAdlb*a}JhJpJ?cjAo-Y zb+9jdBSL51W*o$1j;5))q|!x7ob8n~%|0?SBFeqoB z^_;PCoHcLoTk7dh*7uQPVc7deX!!XQ+!B4DY(*(^hMY1(R=lB0Pi#D`Kk?A=aMn`r z5q9S4MxZtPr3>{y=k|_Vj(+BOJWxTLlPQCHZKM*plz_|)sthnK>cKx?OkEUker`Q( zn55sAER7t)duPNZEV2nq3eL~6FU`yYH0imE0X)mp2a4)`3_lvWsdHua5qJ=TtgSvK z!scPv~`A@KKIXxWtZ@jsh1X(+{=fqEB%7PkVoFhiwRimPW4|R!e>y;J0d4uPf zM{r+rXI|x5aa!HZ_#oOrH9c0-R2WQUdY~O7(PNs`4xNmSDgbNhBMtM% zu1Lkga7k$9f0|07oX4s1x|x5Mm&3WRaR9Qx=6Y9a`KiH>sH|%8VJVozVl0!6U6hj~ z>B36tw%kL27cA;3kx_9xVoFla$b7YOf9MY?)y7eIHz;4Jb9ekvVy{=9=Rgp$pl8KR zE50Y3E69JW%)+Aa#u0ptF5`MS3C_E{QACdB35>47jqozric(3zz1bMUJpU$eYIRXV za$j>`a=3mU1B|$j50ZSR%n4=gDobM({A_0-9%U;y*-EgP=>9Y{6|MaC(55$-%m2}f zeK)!xqldV^f3bs5Y4|=;+x05aCOAFdW`eg3Qj6)=@9jbVA{KI@b`o{>xyQ(O^SMAB zk(^@>&r}Fmt+QIPlb0D5!jT_Z}zBx&tosdl$l6w_7%)jRNe+3?ZwwuGHU2)7mN(OIKsy+%r$>aovGiujtIj;R z4M=~t))37t`T<#cwD$TrWnlyJz{PC-%I2Lqb4THhQ@eVuh1d0CVL}87hmGmcL`~`s zWBw=PspE7SW3>|O`($*=H32_v8Xi3CsW;Dp*HSx>#G2af{^nj#L5SounM>MFPDmiY zCzxe#H>riyG!@pd>3wK$kuQ3no;hWzunwFKLOWhkN0Fn)%!J43;E~02I$oM$%btc7 zBk%DAB^NRk=6+hs-<2Oa+~V+Jrg-1)Nl3lFThqDtT500(mX<#sVJIFmmoqHrMI~boea{YM-{OPt@b-*1E6@y3w%7eeGO{yXpdpECVq4z=FF~U=-eH`O-Se3hPppBdxd}mx zS_nd-?Eu=VVRZC|D+As!>U6^|WNi~tqOv=WsmWJU#QftbX9^``w}OVv4ZZvn#t!DA z5|<`sti^u8X`5DuynDXq<|MuR!=YX43>(hHCC98cZF8V!kUCvA#(K(>lN*ft9VH2+uxU6T?~mu0*WQ z(TvZD*kP@zW&-!P?u^P>M)d)1Qub$;Rt=?!{m~CaUoy&nzOY_8!p}&Ffomoespt9h zVOplLQF*~3yQ|6;;y2cH?2%;q-ePwc>0O0m7|NNUc=lm=;hWNt(@(M{bVJt=>~WoS^aL-_b5)`sJ63X3%F}E;oRz1An_NvYUFz=8U51ctiygP-gPuYHt(UXNa>#q&G&gM5Bu=H2d}?e{OxlEQ)` z5hunNT@4QGGRd{VFFubhHR;fHV}V?K#m0XSnt(djuWJ{$YcCj(W)S)r!Y`JZ8W}4= z6`B3nvj|7ioQy~f35VTf+pwZ=p7rcHiUU83T-Xv#+(f4sW@nDZM8k_r3~a+DyIh}l za>~G0=w9Yv)rU0&HfPx)+};jnzJN27jSGuTix5A$-uBS>5%ux@_ETwiiLTnhq>*+= zYH?F(d_zX_XLGdEuc&MDF%|n;vR8x2-P;2{JWv=9b?{U?4R2d>YPq`Zx&xDkm)oqf z3c>91VJc63>>+4AY($A%vU9Is@aj38$;$<8w9Rg&8-nTPS(pdhn z-~J!6&N?WLcJ0$|LI@#PaEBzgyIX<=26qN`7zTGwAV6@p!QEwW_rV8um*6l2ce0$b z->E&j+kbaeSIg7YeP2J3ZJD(0h(A+qq zDtq=+bz9hALZ;3wfhQaLuuXoI62}7HsS}kaA-)Qo%u38%ECn5|l@p>Q1dQ~B%%~lx zP;m3vYe5o&0GIvSF#f3+r@IxM=wcFtNpx8O$0`gqr=3NvRyt@|&~x|28<$I0Iwtv| zcUe=PDXw{pQxI7pn+-Mwtu_ahbDT{rUiir>ETf5#wd94cg&cgtkh4!PnL5{2^2H^! zgj8_A+My-#Cx-&MjhB%FouAbuy_#f_)r*?{-fkCcL^zp*74)opD2$Da=Sy=_f>--R z2pJ|jT;2Pgel!I5@_?*3{5xO^gKk9YA3VF!k1lDquyDIb0HDNiPX)b~zyE4WAa}G$10}?-M62M4RPtk%LNd zSUW2gcXSZP+f~^fzVu)Z&9q)j#Nec<@vNzx9Dcbt+vZK{2LecR1{_o>-!EH}Rze_Y4p9a$Fr^|YZmZAou zlqT-6tliP;E0C~j%$&; zp|rPZ^7e+168+q5%)^m_lF1adR)sJH9f&ouRQ@v7Z?o(=yO>d%SH34!0jBNyZI0IG zhyA!)b0VdZpdFDilo89#kKd0L?{yHFotS`+3`iS}jB!aoU#^niDj8VV$EO10viDp_ z>H z?e&-QTw;s&MYDS$X)SMM`+CZi-Rbz0?An@l+c95Q+ zItxG=UP+>rj!sG5{2^=L0h`*1cERqQeALNJfB6v+oaDpD4tFtN?@g~yQ0YNXySBb{_@WM^l0Wq17wM$lbl z9npV?Lkf zTb4BrPIY(I=4{LzQ2Mo2WU4bQt6d~>_O7^c&qf}LwDyOl6O^DkJ7AQp5V6+QL?>i{ z$XKHCZ}Zj7f9iPe3<`cIHBHgXB$h-Ad&Skx17FQ^wKfpdISG=D>hL^AxK4sKeXNa( zWqi8-0c8}+U7n3tk0|Be5f0s7#0wwHN}QY0s!*@e=D!hZq%{D)$Oehy3RD2S6~=y| z6o}0GLq0N7o22`5=JY@}>Mrs{1Hx15knBYgJUkqnIl-0)#}INWgotlN)HUKLrBB9C zBD$yF8|AIE8QyrbyDFT_`>YB-WD1M}B%ovJT}7HwdC*g$nV#Fvfh75>-UaVFQuL5t zSJ#r_8p+BpFEHM1l8nP=m~*TZ=OTFey*UDR)avjDFYU>Wojq>5mS(Y74mPs876O(k zcKoosWz+@xH4Rr2SgT|`fCd1mu$=m;sk^O$f4nb1I=hTo6#Y(7C4?;8+G&%PiHZRD zEqZtXVNHyU$v*FA5dm5DGdgJ)tl_qRly>HOWL#~I3% zJ5YZ;9fNU3fZ}8&0yTB@jF9W6=B!gI-NtbS99%t{fQx2ByPSfp0q&Q1cG{}$0$8dz z);8M&PEe(kpwVbQUPlT{xvsz^kBuC1Gi*tOl#+1K`({2gHMzjE6aiy{kyp`}Vdx67 zN=7LCY~yZL1|7XUbg#1_%7Z&PdbDlkCDncE__z8sBD+4!FtO8fx3wiV1&gyA6xe*p z(oh#?m*A^sC6%~vhd)1ysI@fu1WQ^Zm4_pqFTT%_&`DA`dN$h*3w-iFp)7$Mwq;*$V8^bCtWzNH=6v(WBj(S z@Kou}lj;-MXD1sIUwAL0jLMO`X$u-WdH1$zUNh&S%XYY9TTKqG}s|a91mOerDr3|DSM-Wt^y_?pX zC?6)K)nh53Gb2CbCidt^$~B#IH&BvmR8LJaHPX8ZTl?JtL2SgU1EvxvEkVTvIrcg; zybYq-=DiUKS+ZlOj@J>2CXls8XS5i2Pi1z7I3RR&P~vCzr#pi@0(uREWN`>lmGe~`HAZAGp||6 zuBwd&o&h3M4JDy1+nSB=g{c|`gj5u!1{Q_KcZBL+{7!01G4t+U9_#B_4BYO{W)Doh z3n+av9@1iwX~&G@n>XCCICuQTRlh8z*veg~y*8Tu!e)97NNa9-+r4ZhkrbN~N}6VF z2G$kh#0A;!WQ6Qdz(dyrqt0q3w@ay3d~y%_+N|A$Oi>8kTQKCTFy*KP0kkEC9U z&WMDJcQwy7snPkBP{3+O3Vz7N%YeA~+`XM8EaW--3)a==Ymk&4gZy}DIU><)p6*E8 zFByTYfjYYc+znMl;TgD=;3vm^27`0Xx$L{WN;VfRcw`E=Au#n76Q^Npj9d`FcuZ5% zC8;&98*AO_vK&wZ;i{kINkt%%g704~DwqtFmUS>PwV640WaL)aMboY>C2XbDu;3+1 zLlw%?SJF>L$)5;3+a!Zyp}x28qxrj7QC*yV6=TEaA%|-CSb%u2V$CSGt)8zbRRD#4 z`(T6(S(zNW%e&saZN0MCDA&g0#z20)if|D6PK9H8*_Zj4AC@OuIw(kaHK>!45~WG^ zR7oKr%|HCC{93i!`X)RF-?QPHs*1JS%tr{TEPlwNtkT{_IqNC#OA5kXO;o7m&JEf9 zMXg6@nm2>#6F7Y1nk_ZI-HDb`d~f!l=*og*3n5mc2DT4}L$&OPN8eTdIM?gujjr%46q!#6)UXfI?vE>SDWs;ch>#!Dg z1Ob6r*k)!X0~P`~V!gHTW3;r$NVm`j7v0Q`;Fj9fkVxn&x-w(q>bZ?rh~*cL1j_Bh z@%f9ljTR(0lxw`;RP74ctJw(-w;PAqc|MkX2qEj$lsx)ASm{WnQ@_1eb$AEbfOn&2 zXecvurVM!s&6@33PSg^Vcc}>esjW}_6brpE@_vzhJbma8wXcRp;6Q%8(QXr!=2K}j zbvB`T&0VQyR#b;cKsWU?!bewHQSmxcesnjbeK#=s(yNYD1?f+Ge3|W{Anh?r2|wTW z`@x0&)yNVXD_ySqrUv~D`-_dRmei`EGH9xPFA*W`*nSc(Dv{_x15* zk&iS1Om;}c9a`quf=4X4T(3?93mfHnDk^&a$c^#9N`V3l7713(<6F-e6K(y?2poU} z6(3duw8QV)b9`BqP?$K6Yh*w#RXcINmYv8kkk+qDo3xT=e%{Q}Njr+yAT)6$wV$ao zv(dsqFP-_gZ7WFirF}~WAkho!oz^pCqb^cl){A2I`kwM3%HeP;l^ zl``E5TKeGXO<5xO;lv`}{$Rg9_kegBMa#3cqPbAIpTd9wL^w{;%+%?n4@@Th^KE@5 z19wBdo*jCTxmGUSGs17=mPXFIMs>*(30|BLE` z@^CWVb4$uyZTbGpS8BZX1>k-Bm(S>5#PpNlYxFLmpIUJnIhCgqp5Jd|18)Wj)1U_O z+n*=hvYi4)epT7EDw2EX`REbj2)6>6*O6a@9T60lP>jYvUM5`QkAg(uU&i^y*`me)#IB#?p zm>viG$RzuV>;E(%(k{Nn6JYy0W0pm~vhz>xUaUe|I1h#4qep@5=9$Rv9-7vptiRh@ zf#(efM5R}|jiFD~4r5of(b2`8x&k@IY^Q*?KplGLh;>Knx0Bt1i#>l1i(58()1Dzl zG{D6*GPr!oaC#x(#L5@Z%Jnuqfu~@^rsu@(`D>skFE6jCsF~~0LoG@7a#=;^(_`}| zn9laRGhv;rS5gptB5QmbF|ye6LO$-wEj z;Z(&jjBO$XG&0-ny*cV`8F}1G&}guOjJ9F>;v4$+nE!vfd_LY><7`wIZUU`hd^Kr$Hvya z*7JFH2%RFC*!?0@=xsy^1}d-C)yM%=H@=6X|1@c*==;QXb9rqCyu22KoqxCN*H;d7 zc6Yr+ z6wL$IQU71+#rA4#zx{gEUj^qZB(myq_g|31Ej)=D$3AWS_D_^9af9X!{0uALke7fl z{jb~Bz;5$^<# u92hOzmMDNqR+plm7ZVvV6UP{F5kpT9#&r5VM*WOehxufp!9Re zGcDG=8YR4e>%CrKem;rzuTet8M-)VVn z8QOSavvB5~^;C7+_8Q2}O6CD#DUN{e+$tDg?GqlU;lOPJfLB!8L1oFKokp8V^`WIS(sfgWe0c?U_(i=$Q z6)$9~;^g??_GF#o44>sb=31Yq4cI+ovo7~HvXazrz9d7alrjhW8=XHOY-zh5uUE`N z*pkad4GMia!2Uj|?odQ#E35I>B=^l{$mGNBPmnUPea(=(nn*_zXRP^S=y3Be6eIWL ztp53v`2xHDxJmI3Ba+CKScNhJ#w)X?0drYkb3t4#%(hqmqpgyt;p$3I>U>-p!u9w3 zI55xkk>66H+Qk2KW~dAzPaFT$-O25S974`mn0`UuOQz4#9R^?luX=-}3C}ry+}NHo}7Sf5hIQUeH3xy0Mrz=*Cfa<>rrIz1&2Em3{iuQamOzLc+ihz-w>8^sah5o|#lc5;* z2O0&O=Wo?jn=yre$>8X66j5pmG7qHx-~x5j>hG<*Tp~P?Z!=R(Pq}jC z-N`=v3<;_hV*G{f*Trkic`8eE=M=^1ns=ib7m_*mdtV`Rk`ZbgjnTyET9ZOWaoPT= zU&MBN^@F^wQm)2juGq*)tHneteS5CL!VX@Fo06k>meZFKc2bWNi;7s3CRj^|GQ~jW zM^Lxn65?>&T|y1*`6!Y5vtLJn+aroa%Ahb+oyuO>;YF$+ErurL)5{UlL>CErL3!x) zxKy-;FYE8usyV*CI#UK4a)eqpU-V9D#!8*ofww;Fm=J$tWB^pIh?=34Z0%FYR@T

    u{L|Lwg1q+_17ELy)Rr-kTIxs3-IdhjEASd#-v#CJz3-6kD zknsaAWZGv!88=ZKVi-BLyGUPRhySe(%a{9iL~(U^W7a?R0$GT;yT@}a87_>@QD2AS z6EImyV-xI)q8PKeW}ECnJsdxj9Wz!Eww0_ zIod{FnPFbc&go!*`>Af?43L%;y_=G;QkVsF78J4Zdt4(<)I4OU#LX1QBjE-4*}3do zcm=YR+xh+ga_p&5be2jU_#HS((Tr>W9xh}MS!y}@q81k;DrIF^MZ%9Om-lW66U$?v9fydW^?)&_8{6xLlcpZ0jzvtcJ=|t1(&Qhxk5uk}5 z=ihFQimWJzp{STc*ZjdA9Iu5dKU=GlYW;6d`Y0)7TsmeNvI zov1tY&@J_@m*C^Q%3jC-)2tZZ^ObhRK{7=rMSZ8cPoN_SO&5K$LVH23@4C~ zd07S#he)NHqIrUw*YY!S%iDMW6SbJxQu1geF+8Iv=G8qYG-nMAo!r@ zrPGJsf2)=~a$BV_>OfDBS3>B(>A(tdFywV*dgHG?G%42ITxjC{5H59?%xf9#B`loj zbh?mtG4QrR3G&y2yZ_Hf+XG|pe8&b^3HrjiTMN%J$rk5719|>nnIA>E1#v|Ke=p}xj?1b|smC?X z&;G8$K2>59hslW&Z*G6RoxZ{o2|>+l!&oL`%p+>8e8*>s)GM_6hfwBI7<5N+iV7f@ z*y&TlGQdP_tM=0!Xr(0JzEy1N(A-8Cd{%>`e_27qK)g8likZhY?+{vF@k3aF>ToKa zC-BVsjf`MNf%4w3882_XU;(XfHP_Q*>I zL_)~dN)>~xgD1sZfKErcm*fCZG5!L@7J*Th9IUGFoecLcSEXSl!V@(W2%=9dgMZaL z8g`Yu-BuT5Io?ikD(u;LAUigFTqWY1pR*xKvk+~{1|i6B2u9D`W}BS(D#>Og(aWa{mrsaR z(C$@N>WFsLW}QThXLa9QZLgxx)uvnD$RytxYp$QJMf&j9KALxe{uP=W>Fu^?*w?vK zMGKm3UC&L-^z-iKvD`rySmC|uROq2guuaYWnKnLC+vOR0vfN!PD=n}t8!`7D4dZH~ zJU9Jk)9)HlPs0Mxpe&jxl`{l?(oAN3AX9&Md@LL8*V3`tB{*65CxF95b*+wWq|!62 zu~s}x7MGav+nq_eFu|J;wNyyVTBL&-TjC2kTGiG=r#|GUfVd zi+pd@FN3^IE#|zpKQ0b1mP%*_)RxDJRNPu*#oz_o6~(WvdLD8gKU|p)h6xP5=ij9I zx}##qZNbfGGFmf|_F|~W80fO^lX}@v48};>+j1O^7c{Q|Go$)y{>K1QQe($-AvX&G z70&U$wrW_E6@9|fn!`>^j+W#&E-d%bMOTkkBfXraN0r(BN+siaHmZ3oRV>698m%^G zo}nnu4^j10FhgZuL3(`qKRR>FAsi#?*UQ5BJ|-1h3d=ptY5Tv@DgYf$yLPhc3q}fU zNxbI9HcV0G2l%?YA_4>m@Nh)gIvERJ!IVWZp$M26Fwn5aXwu1lZM)0vUnn}q@G-A~ zUVMDT)ySumqt|et&)3*y@^IMoW@c$8GLl~_Sl3KCCEQotpqBY6elZjE$|UJ(v=WY? z?8<%qF!%O75)ZTfgAASA)??tbP1&@MD}6_x>2@>r8g_G}`I&+G%>uOKAiyD*M#!(c zR#{=h&BZv6hmM)M)-IPrL1Ww+1+Ub;%oGt1K4PML|Wu7J& z6s4$$A0$XBAYD~~A$q^*q^xptYZMsT;s(#pr&?Z3!X3xGAab`;kvO+ZZhS9sAYJ!? z`u4%ZN@GY388g3dg2LYTNb+9+u3oWpCF5RasD{coNY)ZO&J{{su+@bz= zls6Z7*@Bq3h&z(H1;UkE#+yusB(ef2YWS7elc*g9Fc|rLzx8HXS)>%4upcF>rf02# z;f#AFn`vx4VsmsATG@YX{21woCNUkwgRW~^o5LPL7m~pu&jos*3lS_1ZV~XU)p)*k zuhS1M-1Y2Jmu1S;M=yCr6|c54X?LHH9eE;Uc@pA?-y3ZRp?RN|#{VfB8*Ui7MPpAEL*q;B}T|2Px6co(FbG>WaI4x8D*%0Divq5R{Dg z$$B1x(kkl}uGTeuf+O5`ChFjRTA-7j0LKLrX?xID5CH-(V%h)!Nj*7V=m&v22YD8O zVPHjW=%Qb5G0CbYXo)ssq;EdFaZiWVYZHGPpuhOm?YRDmququu5Uo{G;Bm@D6p3-eH#Ul0U)>uoQOV+4>Cw0#n?u{d?W8t5%^26-Bn19bsazB)0uun61K z12$B*FyC{z2E_44a=Vm}z>fHvyURup@y zn~FRi;SOstXg8l06V#y?V$Tj1MTA#eCfBsTrX!rEC5?BfJ0XCX{FQOX(8Hmll@`!k z@)PiNK1q$fJZ=f;Kjdsb1!>ERu3f!AC5Fe8@0fke1N>I59dQLA4F5}z9RFJhFn zfBw%O_e$E4`{oq++Y$W9CcnuU6s1qU3qkSqEKg@#EGu7~k$}$bX$6@EJAan$@9%f- zmkyV9=d_V$;pF(*h|!{@iPwRjmw-&Z3vRqFr)L-j!tpqov{-*_%pQZl&)D4NNsq-x=)hzn|OfA096KLLK|7Nq-i34c%EHY&}l-Gqznr!d^9bghECS zC1vwFBy#!QGFp{*7vGwOwu!~KxOF-JX0rsZ^vo{8!Wk(gh!&_oh*VxuV9~?9_iNa)CtUs0AW?vM^5F#dQ5PsenqaM7xc9ErV#Ms36CX zug2g5AiRS3bC}73l@4pz2fkLWv|=!-=&qg@#C|Y@aS#9`RZ1TL=Vd-j^)LXZg6VIVNgs zeHWxyxOACM;ORbtLenLH!G%PlLcm)$__MCu>e|+q05aBGsBRg(@kPsP@`HP=hz@+h z+QQVC+*ebJx2a9fzfeM(h68gYDZ1Vqn09Pd1S5O^gTSlq#gKYo~kDN`c@96nJ75sP-HPujBx_j;-6V`eB-6P2wwA@Jh%XGoX zOzeY;*_+fRi(F(GQvvvf^@`gsAuev_nOUaCvpWyHq!0nRdeaiF>7OK@PE`qE7Oduut51iV_j?hr7tJzkj6kZE*@7kRWDSsrfjvk=OX zumPr~EWS*Smo=V#_ga14mCQ^{Fgoz)+(drz-J=2X$knnTH zu!)Pir>8gzF$*TNHS$~azZ?vE1XeVgf05KP_KRDiTAf2S_KomY1{Q%ouIRakMmB30 zN&2YRrB_B-0}PAWgH%Rdui2RA*O%CQOxwoSccfTtvY_H({n>gYQt1^MC88|F715f#9{{yi*~5b=bR!f z^sFVnPTK9*>$W%Ft5=OBy+GsS z^R;H)AJ)A?aXja`Hca9R>e2bqI!wEJMhV)>dRc|S|Xl*Qi0{=+99krbqY#HlIGq;R75r)V?W!rG0u-WDFE zIpep8Fs^1!7?$lyGm{>P-$yJKe~Pgq(F*+gX9j{BW^dzoAi#lu(8^QLzHexh11)#$ zf|y-xCukE+_l{Hb4Dq&pCow*F0-Cf{)a$=KZhS z%TljuVoRn+vWy6xeN+{#Z1e4;dGR$!d$^(k8W?X!VveKPgnUr5GAJK#0lYE<6{4F2 z_aAD}+lc=&#LIl6UA=I$hs#@b+fKes`=*)DWf(JcGS=JQ_KO)srp_PB&#&`jcsYiy zeG(|A=YqFzGh3QiVEHSTUo0*37#LNF1~BQnqG8UjeQ*K4lTT37-fxi=ySdzC=g_#Y z*OA~8E!KXgyi(8aGoRUhDdR@}bvL*Y9Uk;DTS3MRM zpVs;#8Kad%AfB^uC%I>r4U%ncb|lj!6(T&H$T6oV)svOu4+8D|-d*Qvj0|l!-wHS` z#Q&&rfo%H zW3@;C)nwe{_1YiX2jWhq5{wvUqjm_nT4}@s^Q8+|L`0+e(@qs4;mZWJ{UMT9Rlf)y zK-w$LJC8it_SN1^7W^o|XFJ7n!tUH8&LX0f zif-y4NoktXGi(}Kd|tx79GZQ~#B@AT2r%bcR(`#8Xe5%&3e3;`ZDRlR$ly2BC`G-P zo%I8-Nce}X_KC7>7Vuk$KPJ@ks@PK3PfmO&-jKsV)xgt>h;eg^lqZOd&cMRz%gAlK z=|KIE9cG%HOiplNl5Jk<=gnPVgQ&n;uK@VXd=tlU3Ho>;ws7r!rF^0Gau98Pfn~wi zg=C^EhbPOeH20h`5kxiIcx#FX>tTc2XK=^DRfEU#x?&=QI94O7D#pf?#eg-+?YeIC z&~GLT^e>3C>Mbv*bN5A|Rmni-OjAYmBQS5}_10d~t(VYJ`jL?-?uYoe%vA0U1}nIN zVkKDuzOS6OaY~?N*j5|3hONlYA<@cPzDHjk?W{YQd9@(lH)5ZW3P`!fezJYE^d4u6 z>HdtRrHGkJuu8vYT^_?|QILIGt@d-TxRAx&V>7ReH)PAneezm7PHcKEHZcZ5j7<{! z-l#3{_Xi~*A&|PF2;_Ugvr`yVnYj;?Mrx=ctTa`P4%9^x{~78bGv%- z>N9<`&lgcY8&in(Ei6s*rG^S~$5UoO?usFtL^X&l^H?1H#yu4SF9rU7ufhGV9Ip$rt>Z{57iCZwNO3KNU zC1@;4T}JC~rjF0aei>YPIXAD?{fHk})u-cVeARpFbWr|Hf%T}1Iw0X=p*={!*V;>y z2P$_nzq1j@-li*k_O*s<%PZ-YJkh!!F#JNF#t|7K?LuVpC0kDYLlv!L&}NYo?8xyI zbBp))$4m=ZSB-t4W(F}TfR0e;l0@tdQVeasuFo|^T+{PKle!z z_$sfZko&V;t9jT2px}QLY`k@FmSS6OVT$&mYm-J(xwk1(&q0%i>HEUMB5P#!XIOA` zutiVBA`zvfF5P@zUBtwn!OflefTomTKcD4&R`{<`7|KD}n8QoTr$bwyL|js)y&HxteJ@4kELES1vE?x{ahwrV?%N?Y}-1?VNvAiO+R_9 zhn!T6jKlCggRdui5)0Ab^L z3w|eP_xX{{s2WO$k0Mq90$6C|7Lw58OZX|!U#hJzSZAbe>*sH#qd~0snVLg`pAt-e z?t?*G^hp+)nn`v)teJ#P>j|sfPX|`FfYqfzTsL8%`f2=d|DO;oT4jY3ncjJEjE+SJPVz(TiW|&6C5`tzMX6 zdjlWySfrR+L}2|({h2C!zYLS~(uhftYA+NgMIhG0=J%GSDf!US*W^Bt^ZBj8TQ?8w z5&8U|i`^W|i@6yXWX>GQd!Zb&`qL4HPLF!a@o;p_+v#~`N@iIL6C;CpwZ;t!;UP_h zuROpnaj>&tI<3Uc33-_xGT*lRD!0?EhPb%66idABw=T5m1-C5h%PaCO{&b5d*sjV5 zdZ{Fmdpf>qw!O{Bbs7o82mjsI68husTGl&@@QWQ6xabf-5R!0~HVxhfHF3N`;6K%n z*12nto!W}$FzGiu6*?3Jmx2r&58hb{WFjPV7sO=%4}TbGGtaLtNwnVcKP<){CmQjH zvBpRjXzKz6QHr(*CBWzp!9hx$!y4Fm8qJQ23P=j6!4RO}63Gok@!_EjDN*f?dyMe7 z*DuOiN0WL^9^Q)~=L%%vSYu@UFd-p>MF)Vw-olTH=Kl&-_?Pz#8PR}63GsyP1K$Q$ zii&nrax1vDpXa!~sL0YXP+_6Q=Goi$hAc1-@a!_AKPiVHu@=eIj=QwAsHnX{U%EHm z`y<^Fptu3gosSU7H@+qGY7O20=KJdzU+3ZoyWYhFu;9wG!s@R>={zExmIyn*!}Jrv zaQ^)Ij9cA*KTSQv5T1rF=W6CvlX@-R8S82s6@9jNgf;9v0Kh>ianVW&3<`4I2r$~y z2m*)%&8Z8?IEyqK$12|C@J2xsQ+_5BZ^@a~tfrG|cM~7A@nFT!zN z+#$@l+-H<=`q9U%kIEEzxND3iUT$gwoU09XpWrQKSby_}jcufn*PVEACBhWKMfE;` z&3c7|kpp@Su9TmucZeq^K6_p6;!~4Fc7^F)H*WV1kefQD(uYwuI42*SmX|@AW}8z* zt`Q-oi%*wssSQa~3WdV@%Pf@&u--#wF}+MLdfIj+S7jt6Zf*7u!`&KFcHH z^Ll_pe3kqrs8*Zk?upSiSGPPJD^j7`DnKFAy^@jj2PY2 zw!P`xFG39Dy3@h{OZ*Dubl(^atv-R$YRSA`o}PYXSkpTd=@)L(Xsbik5}A`pFswRJIg>ECEAD!}^q5np?^J1`1kXvvyIoI(Z=j+9w zx@J>RUU*tb+w^A?K_fprQDmrtMGX_=#pjzjz1S2`(XTnvM=LojkU z;e0jthdK$&<8qnGbUk~<)8q_5QX7b_P$8m6OmcX5cjBCv_^I>pvP{XsytHvqsT1`3 zhLwBwCkbT9qk8`kL?S?rmSV<}U~LWBHnPm!BhcquNU__a7}6)p-nS_l%nYHXvKxG# z%g?zu=H`XhxM=HG-sxL+ta*3+_+_9;wcDk)J*^YS@w7!nb!qpv9JDJYEWAHZSMBcR zTsJe1Zgwcps^C@wNpo$chG*0-=f-QVnP$P-k*?${UfWQ{LPWAVo$3(g5` zzZ*>7hWX@|s;qR@@Mwc~jypSe@sH&kjlCCA4m}FygblnF)Mavzg0{LX4v9#%g(4%d zqnILL*JcaLKXL^wW`YA1#!KC$rVKZ{?;4lU8)G`4C71uuNdOpUdj==P zoGqH9ukNK#l>AY+6r7W*d0>R)7z+Z^GItBg=D8iQLACMil{v1f^e@7$TYlin$IP+3 zi+)dde#+p;WG>jFfMWe)9x!%ZV&HSsux$8y>&oXPW{)EW#qWJxz0kCV%(z9GS4dbEGHo4`m&n)%A_kg1ZqsXYdnpqavIY(Ov%e)E+tS(CQ zAI!X#`#|KO5Xp@*~5X!L`o_aS^p_NuYj#hJvY+hK>*6)5NPWHl^K}z8F z!;S@WrxQX2KqssMKKg}@OBV%2NX>LFX5h(?_`if>|I&EiEO+xX+(!)EN_@59 z67Uni*D&aOsp?`UWg)uC zBISN6>acg~$WLakr0DpxZ|2Pj7kiJNa#~@rL{wI4^FWhmM=t`DvV$_sFO1>O<}$60 z{5s6SJ2=jqTu7#L+WC|HiuVl^3>gddTISrQ>7-9^DIw zjElSU^>fbxYKRo6xb5uy?4@ z5#e$XsF!2lw6rq7ock}>PiJPrR%{O57(&o-T*Ujoe-|Id_obt_*Kwa8{gy5=SKA*D zi;L~vrz_rjWAaMlb!zT_RnCeeTTd<3M0G~{gZ7)ukMFPovTxSB(Y#Q;fBY6eK>Zcv zR3v6MQvQ3PoW@}iur%)H9shjLp0&hkaP52y3iW+vcayXzfC z$TPu_F3YRl8Hv#Fy7rkuW_=T|6S;@83W}yQnhJ4wYcCe+6K1l%OL7+L#Hf3^W;rQ+ zAc^|~8*@izt4{} zn4!PHkobe**S(ZA7tC(-rb7y;?I^b(yz(Fz%vd(j! zVlAw15n$N5aIybA%-Iyw&KriN8s5UQoVPioo=tM=>x%vL=Jf5rB{Mjy8UfYj$~e4R^KW5APk2e{LlOI%hw>c7cyiD6Y;2nHBhjTP_Ctcc+h;q~#^le8w{jX$SnDto-mC!<-jC{KG*u_lHw%c*qEf7fxe`?m8l zpYf{S#=f0A!N9DWt5IM%84ug#$UyljyUP)x|0FFgIUF^q2_f~LQofoK*qYc2SRkvtN#W%(^qe)O_Y z(eWEeV{)=8R~Is2i`Vib7J>H;*34AAzvnU@q)u>mr`Zl{TNe*JGm!Ly5_vRW$72nG zAY)wgl6ce4^XLd{);u2v6jy+$>6Y-@f^g?tUBc+Xv~z3Q3zWw~ZO&(_sS0TsSY=kK zRv<}9Cc99D!<4^MPi1(vKgxT?=0P8dmJssb>s4m30vX18Vo0!(kA+t6CPnA$X zM38atdOQEsBXY;J6;05vo^EE8?9h$m9Bcg>OXx10py~(*uHi4~^b{GfnPW>S+Rf{W z$<hgX(t?d*C^g!s6$F+zf;<$mfqO+QEm zS3u+XaH>Y2(8HBW&f|>Z#_u1x-iW^Y^xc<_&e2|ptaiL1M9 z21h^{uBBS>Q~?+J$D=75qdgRaxzX*UEA7D;l9+Eq-0jv!EUVS1o@6xwivrYF3_bZi zhUsc1VUtetH`@yQ4q5B`YC*6=i}E&~t2~Bbd#dPFC?2l>7yD;5kSp2|{g1_kj|*)a z9#3v9m_c6QTy{aUjzkIBT``jid9L=CV{jpna2uZdzCY+*49VDOF|9dJHrFX2U*}i%_HrWECn;HUrpBWzO&kTI=?d{C%LF zv#8{l?T@2n?MEAhF(m|=4w9VViIm5LW6N`tQCjN}8%7d#8MkZjVg)`gZZ+R4gSgS{ zpKqXqeJh_led3M2BxH|sk`Std1g8>VC#I_z42NR9R8J7Up<08U_qntAq^8ElLm={O zCkd4iGWRHxP3D&oKOe)MYbOQXJNK^pi4?y9PdTzS6ao7ny1@`V^~w<0uN+BJ-0ZCL*< zinHrH;!SkbxA$tfTjvWj$aiNYqpP@8HM{Uln?^M(sQ4`PZ4gE!MV<1NxY_}R!j+1< z*n@C8nb4N1w1LN3bkI0M^UO+q%*0PJTAC5D&#uIc2s8&9YSiaOC$!UNqGN__pIUrtGVBwS$9UG!{x_RuX?A|Qy7*>lJWzMB2b?bFROA!RV9H+C|F z;)F6ox^So94J<^7nz$F7V43yffqgmo>$ew|gORv9seHU%*<>*T0`Ja#6Sn0bATSuMr`$(dR0xGA1*LmbkFK+| z6}NHour~OaEEgJtwz><&kA5tWq@GBd34`ZCqJ%(W`u`pv&f~8Eq`6M8$cv5yI z(z!6HK={7u@1L_4;#Epkujf0gzKy61q1f(MBZ87Ma;+rNN#H+uy}b@M#_U`I#VQW` zDrt$!{8VXW7>Z2)PN;1&~YstvCKQr6{Z^rAZU*}Gt z?caUG(dDjtxlqjx>q_>2>OI-823b~PVpooNV% zJbve1`Ff-3KY8-~&tXe&z{(#iw$+7cBBw1oEW2W0s=&&o8k-}gqL*CY7tROt0Q5=F3 zB)Ej&?gW!jru3Y zTm-0Z3N;)GaZXJPY{ovH$hO+L>mb=7yP^<)nu_wWh-3Td3`0*e+q30`Kg8zmqtF_$ zg8HKGnI){{1E?7N$r`pFH7YNUU0_%(R6Xk+3~lFWx+dDzuMh85JsSuK8!~-~uYp^& zygHNm-}`L2O4xZGhMtK6viN>O+&dsZo;smJCHwz}I(yEG@6P z1YZW;Z)W1*a5-RFA6C3hKWU8ky|}%DF+0BTM7X~9B>BGNysxKx5;uv)zC?R}ya48P zru=1kKkj(F7KtZZ7!2jmBMVcTV%b+5<(2LM$00%Kp`~e4Mr$k12;YN&Z%+qR4xWYi zbYX#kXW zY1`@j6JBbK&o+FcF0a-rryno9EP5?<;%tm5<49MgM<0jBkIM0l*o*}ij-i)g_E%o4 z!DO4Y7MxrKMH{!4yCC>uiR92=UBVWVo!A@ZEZrL zy^3>pL5R8GhbZENtP6C|5}ePP3Ixn@Y?r5&NEFQX)pedp1KI9iS%Ck3{lnb;t*k>b zgWRK6a=yJbkdsSBzozS+qe*6XX{d&1Zpl1hsA{8A5Nhb;@n< zA*bVJc{t(i%^2ssa$Fz`nW`b0T_VifINtOuIO0Z{Qx1IOrg}m`nu*i+8lu&6^=tH$ zuZ+IUNZ#}E4CVbTBAI=F^+}%#?+nrvmy5H&HR(L#9YVy z=?D^9v$Q=itoP-qt(D*+7D~L&rq5HE) zey?ANUo2J|m#tzfA45=uw)`ELYB zNF?gN`Cc8!i_}c{8=vGI_{twIukP%DufPPX8LV498?Bd$hspL1-cn6ff^nNLf-E2B zWd|K<@!*mL@-&m6d}3^f(VEyr=%*;a5vn1#GP;}oVsb~YqA+id6^9~AlRj~aoM3VM zqsN^WqfefH#qcYYC*KnSYG=F;3)`PX^Jh{&DP4hEMJNP5{?$ZgPe2%baUrkl} zi(-d;TS_XC1Wna}5}v88miMcXKw^Ad$y0c4pYADbnK785!E`kit^rfET(*|lV{|$g z9ET;ly&F|dIxu`vbx+qF)m|8pdGpPE2iA7+rvUq?X`xgBSE=d+9B?36S2dXvzsJp z8;TG)Uejw=)<@dEx(Gk-)$YjA@_|uVyn8WSqyK#x==Pidr?zgSxJX;`~(GU42H{|9>3ILkDpnD z{bKi9uPH_UuBzv0`B!5K%QwjaN^jiV>7PnQaSP6sIoIK@{gQkE@IU$HGv$YADo>_( z#*wVuJ!%8v({wdvY@NGavYV`g9aPWp4R+e2rKx7P69^D(ymw}Yv}lopcxh~j9lDCE zDIOYt>+~dAFf`?It_s&bDI&nc(CqzS3eFUjxw*cdKZ&*PB7;@a>WF$4-I@nRzzrFT z55GKVvbaXFi19PES5C4Y+kCg4XP4z1td!Igbz#|}v<2Pu2v4sEUO>;*&B(4|Ma25c z2MTuT*wcZ9jlrR*QoLjNdgbY{kHwqPN3o_4gOs)u1m~x>ZU9q8W{WL~RSz20I;1w`!IP&D- zO~841b=Kbyvcup2=6fs}<9Mob|NOeg;d<+aa!tobgp9%lKg?BUNo<_s2a0?9)Jq2(;XNvV1NOS~7UUG=W$5fhK93Gso zB>wClu%b(NmI1dEybq5rJQoj)z@4brbxw=a9@hNETHt4hR7LvGErj`23}8>`1kHx^7mKjiNZc7vY~`Z$F==aow8-x+z-ehqoQL4-?@8yY%GS^J@2EjE0oE_h9{q>vZw)6|?E zFAX5Tm;U~pD@1WV-?b9}EBKYK zHMcTY#%vT|fCGL+5%XyJ1OXm5!XS@QQfOxM+ib{F2C4TH?8oBmJkCrPE*8^gM_(^x zN}TkM{&2IigXQWdcX@p@D691!tt6@M*<@*$om*N^8W=JUgohnWHqHeV6_%D)I@$Z$ zm>_?HZSG&Db&}kDZugL1SlL2jxprDgAd+fj_^zUDTHkuz4=}TmyNP#mkATz`*B+M4 zUv2S){4-!T;kVbvRovh+Uq|VGep$K`J8hJ^E6IBln&=2& zw7?~J1I}>(6(`jf%p}->nbu=cQ%lbDeln4D@;S?uD?e-N0qy-v@Vqa8O9;H&g;oeYq{R8MS)LgBLP_rm}gJt&jVK|Pu=p9c;*37>4x62 zT6%a`b|sPM6rbQx74%-;^N~9bo>wPO1$R78X9Y~NjK~xTAsR;e9kT?uMt7Hm)J*+_ z?-AGML1MdBNy3n~>^i+Yk5Kt-&Sg6>>vy{(i`pcGcX0edGAmcXq0F}AlWcUl)9d5N zR@z#g8=nEbT1o1!7DfxUv}UIP{iM{E`%u`1>=w1Nh6_~*%VoXamcC%gX?kd;y!S<2 z;}=pLYYz2clD;`oodr%@U4CEHfU7f^o-*R9*s|dB_P$B@0}`T;2CbbXt^E z;3~VHw=>YRo{od`tnloJf>5VpojB3%lT&E6KEZ19#=hz-Kc_M?e%(PJ;XS=6HM%}d zbdMk_aanA)Zrl5bt#1MY|zX^bVUD@LT~GnDWW(`rXngy=ngn9O0B6}#qS;z(XC z17MNA?C&NT-Tg^j*y&dG;vq1a8RpBYtl1u2efAL6H{^k5YYAJvuie2lc%#j!Tl|Q=UUPABku+_{n8P z!|ar|Cx+%p3+yYUvl=|Ek&M3{x`LirK0&pBdR02K>-mcP*M&`h(n`!Jw-Liu&!)Q^ zl|Qp0Y?u}nGPJp6^V_I5hCw|$MUkOVePpb5#M+lCTAD&!YZvLZ+fl?(_Gb^Z;80~+ z=CY4C*3#2gsfjV?Nu?pG#&*vBlk>*`M&gw@YvY=uTjMnAa`uK|7svqlkU|9_8b6bn zmJzzh;T!xZ+uR?!4etDAD~<4a9uG5eF`r#m=#)fn()LljkQmzd(vaqV!o8mVs4A0f zJs01~gmhgRRt~JAyE^VvQ%8kgMZ?#Cg*7KQwLm{3Ff3}|rioSw(VTsu{o_qWO=~p6 zMgxeW2o4$BDZ{a%aoEG0-V=~>y^HpCA-!}}@KFBZ=dorYXuG0-#>+uXTjt~sBvWoO z5cTXdeTQ-M(Dd*X>FneEBsFN-usjNP7M%UQuj|)7Juec*MAAh}eiokG3U`sQY#X_R z;|T@rw&lc4M3_*@?Xi=M(?F$Mde0ejB#hBK8o4%?gKSozS%-s}=2@(|A2aiT$H)6p z`ZG)?M;kz{n<*&RqcTtk)T;-qX&X*wSa+3>+QEKzAkl3F0_=^625q9H%mU9hjy2dy z3bls%vO|breLctofDpYhpI)!c=ud6|MA+DSb&?pNtZ5_`O2c(zLf_-dOKP1i|$vA$zJREd^yv((D~epYe`-M*od{JXa$94^4Lx1X68S=@(!KT~T%Jt0lbav=Xmii(T7Obo>9b0GH^+kMhX?J4gdq!s9DcR!w?uvOD%t2&R3U1=FUmvR-4YNO=boaDqtFK_Cg z9f=bbN*j4;YD?T7y0hVa7c69!Vm0=>qn#x~)Z!07Zg;9O7lQ@SXC$N_5n)%ca|K5% z{ovQL>2P3j6*YHDHNjpL`8&-UJIT2St|QZ0bppBvAJ{BZq^1uN6tQpOEg%wNc@J>K3NK@Y6|m`l*EL7FxW8G~`& zoJ+&dHd_#KaQs{(TcSjZ-=2GhKIeZ@D_BO^??E^@*~1-rE@+tv>;MKgg*B zLU}7E5lhLP!qO3BA`qA|I(-3DbVG)_bqgrQ>EYJC9#R>Kvx?|3nv6*dK~JzzcE!l0 z8P4x7W8HaujGla$Ze_-+;Yd=NbKehm=(GkFs&O(&h{XkEhlgZPD>I?;l-zs=8&2Wc zM*zn(e|&gbJI@q)C4P?+8Ademan(8+=}!JYoG6*cMczqB$%5Ta8-2Noi8;ZCrsJqj ziTbp&HC%q0I<>aM(}6G@(_cMS_IP=-iP9tK(!6V#vt>MR*yZeE0SEtk`TjuU0``h; z3H8<*lQ?qT#8lOo?Ws+S#i2l>O#6`3T$P{RU(6@{@$)H;K^{9Jb-tZg<#GlJ(jSd^ zq1a!!6P4>(>wL4;bNCrUd(IkT**>_-7E`y!EC(s71nQPnMti$4wr;Z9Q+d}j3aHa#Dl{TW7cIzUVwyDsuhjgO8l zoe^}EKfJ{W_=@QS2UsUY36&ARz=LSYz6-^Gl zF_aKBz)H?JQB_T#I~j^F7yLz25j8Z@Fuj1GBd?YH{pootwtn(fYLW@7%(%b>oOTnD zRQY>YM(zyq{W(ZJEy-EJxM6BZ7BDLu);e*F-c{|@2xq?`>dcPlLmD!z4C z3AZh|O$eGv+d1Js42Om-sIG52TdU>0UZ6>0c{WosvbLBv3G#3oxk{KS04U%$&c2YK zII%e$SIaGnOUf}0Bm%=1SS4kpuY;cD?S2DjTtdQ#3^7t110xCXrUJc$j&q9?wDw`h zWh0V9obt2qFnbO^-`hid)`WvMSxwndV=s&1iWPx+=^fzNy9Pfna>``9l8T6{iIBE= ztlP{3>$bO3))@1?aZ-EkIG=S$r?|gM;n|JYu&0a`9vz2|2!GE8p{f+My*)06QN&1{08Bz1rOf0}_b)FQMIyJzBL zE;CFQLgQajW(YLVHP^Z;$iTShu0tZk^nUmn!tohleAn6s!HX$OgQO)h_?#m3UviaD zzsk}zntLmK&VLZNf@dUK*~X31JN~SgF?;H}7$2p}2IMfN4Vn13*J2s4;`2%0b)Ic< zMP>!q{d!;H#HQnSa6hwYqwXJ?!W?(i<*Yl>ae$OG>QVM{1{e-l8X8HuV|KCqk_cR* z>i>>0xX0rshFo-F65MGzLlABrg0W~=7ogANzh^SMU^2NfVfm;$DxOzlU$e}ot|LcB zU0L_#)in%=gN`5%>kyb+(Rs8)U|Vks#~!>Q=+UB>dZ$p4s5=a z^`DDR?pj4p1KR=`7XD6}J^sH28$6_-9GZ1pL1W5OoGY3u{S)roM4-9t6r_RFVy+-~ zVIA=q=rR+AZ0mISep|NftSjiw0wPopYzMoA@p|w{ZRWjEv@O@6LS_cr_{Qi`BUR64 zd>lNK&FslUh3-QD&?(CE-iRG{e9Wb56Yu2vCqGtx1q8LYDJQ1I2EL>|X`B`Afu0vC z2fhQoC$mZ(nlRkmu;)(bjXK=jEE5*oT?ho{`W|LoQ2qap-X@9Ve-XkL!8ZND`%Srq!$L z++;*Mi!qQ`o7g9G&ZIiiT5_`mhu8H@GzuXaw#O2@P2uN>>j)ZmHRuzo;`t!Edi*)%5e)Q$(K`h~EmPuD5fs51`e+mN!!Cd-0)dJCA98m$g2L6=`vGB%A|AG8wu(N6 zf)?>-{-N9zG-SaYYg=J^aePZzHs;z&jz>V0vd?5Kt5&Dzr^iJwrk1BhmOylP=UHvt zxa=GXZVNP?V1&@=GxI{U!~W#^>5X_bg&e5ZThKLE5=ufUCgJFF0t# zk2lvdVHOG?1wG;*1G?hA*U44PXH~raNH+_bww^+O`qUjQ`Jvp5cd!mPx+`H-69g#s zRw$N@V}Hw4w3exDu8$tggHIyCZ;&dO_gZkVtg%J9-lNnK`0}E&1pT`s4S2|r`T5dd zstlVpgUSOT0DZ7v!GiAu(Z#CIa(`_RO8RG!qSvry*?hV_d8ryL{UcBmO-H+hK2>gViPagIwv+gKgAMss^M!ZBB zlV;9zjgd;^tw`XfO0mRwUCmJ&xYwBg-s*0i!dx)j7=dbML(q%W8FQuD711XQ<_&wD zg&;x>Sjlw7(M8rx_B~}4X(C9LCE7H_of4=;Q>SzjSces&^;w<7wealZU$%KRg_PV0 zmW_Dh53G~6ScrGfM@Fhg&Rb>r7`Qeb(?8g0n~!whgdS8*+K&7Ot5&NWtMbYpJASzL-EHsaCKtq9uttrM8h#x3Z~`eD31ZI4!`-5rZCqs~GkMd@6%= zPIQ|1t&D6Hbe^6>nxt99*Njf>itCD3j~{q6+6|mJZ;QJbn}8(;6seZ6rI%-kuVxFk z*l1M{qX`Lh@V>V~t#w<6!{2(JdY3)FuH^s{l#X0z;f%qEKe#tYGjQ6jy#4bH^fGweWx^;jXfgP6;} zs)3Jz`+QCpfKLax1Cte4Wi$BmSi6@#YJ7eY@#M>G>@R7O$1o1FoAsvmjADLX9)%bk z*58_Q*Q5khcTr60=i{)?Vijd$&tS`sJxuA^s-KbJ*gAQ;clIbsUeAPUv%`?$O3CEs zuAj}C7unOh`EuvTvfTrBzG0)YP>!<}| zvA?a3Sf;LRsp_{U(gF?inY@$~$|L9941?_(q$}PakKhI~o$hE$V(fsLp`QanLmC&J z5d-7G!g11?qFm^xb)CLyoDR>m1gk~cEmnVapb{!~yPaY4!bymY6mf+$^B?Zf5I!y- zNTH3hbt|71NsX`=MbXX}6Gfdnc|J=G%Z}ovzsh3t7wPl05?Vvsl-_eM* zY`^@)SW#GVzQ4F>ebItQb>%CJ;R3W-(IMIFlH-{uMjRt5`qt zfU<42zn6w*RW?)0kK--qY-4(1@5Qoxf5+IRhQz=LG@CZ#m@|8kVDUnqadj3?MD{w{ zG>FCwalMV(JBry&1sgw^h`zOH^cT8!UWgw?u6wldO>;9xEu+=uIwrQ+K{FrML5tMl zkK)i#9rd53^VH2LB@&GiYp7OU<9o4`3Bu2)av59loB>3HIy+m&Z5AUCnpDY^s_v>^ z<8XQ55wC=n8h90zE<$dKeT^^szo?s=!qr((@Q^0^S=i+ECq?=LOi3vy<<8Sr3#5hr z4yCJqP3_xfV%pH2)1cQ51cG-Wk?}ty$~qTu-+KL2V%)w%K5Ttk3d>Q*@|V-`d8+vO z5(;QHJMlr}O3^EYn?FKr9C+yHEY0m59p6bDPo6hhY9p`+MK7v(D`aIl#qG|Xv=3O?YlR@yg_vj`ajyv;2>Sy2cPoMs^ z>Q%U~wJCjE5_P`vmF*{3@d-QP!TF+ByVXOzD^GeCLb)g1<{rUDT(|vW-Vl_5vKYv> zjGL7Kko6GcLYbMHxz#inv&jseUf%*$+9(i*&MIeb{@Mho;-P!`TlUix2(W>SKGHB+ zZ5@yEYv(k~4W8mr3b0lVE#iT_M208kC4uPs<-pZq{P|gB66M{rKo<0UZj#q>#%}%P zH1K(eyi75Z0B4bA_1LVh2perFUCx1vio4`zLF}XcbE~)D|8WB{G6oQP1^73 zk;N&6He+_qSaRjimdM?KwIIod&q$wqgf_Q6AsMty842uefQT1?rS@9LO-3AxghHQq zJvdSzzxRoML0r1atJtIYbY=L5;@NdZ+LA5z%)!$f!RWsnSLmqAQgqylA(F<-759ljCYz|Ca_BDD za04bNk#c|gPpVd>mw<=YUyWNFsswdM>9s}(tHNchyXbX$2H1}NHebhSvOFp2|FlHo7`+z7~y*Ay{8O z^asgC?^flHas^M?C02u@NFB=qpI7TOh{ajHX)K#l3oAeQ58#s;p4U#o?zY}wJrQ=6 zFm!#LUtrmOfZ|26cekU}|LwsF&%Wz{3Uu`-xmZsaEWeg-k2NX45m!`C_b=jiiJ znV?EQ^q=@WSw#_VRsixMV&(LB5?%xxaHPGKnRw3)RBA_0$60LLSI6E{qLk56|Mk)( z^A@>U&dzC(^2Ct^>3zj9PEl~BtKEIc?rM^ACVDGL88B@VV;viY#kut)gyy>_@IsRh#gRxF)@;E_rTtFsGy6%B=* zV-10}Yi9v;>Xe2hVah-_rTHcW4dBcYuj!SHRWmYp%#_`=#{S@SOeD;B4VkAQ*8{?2 z#nc27`OeD9+eFb7CO$!yDJ?}d@LjukugkBp`|H|3JDKhYuJ)q z?I9l*Ie;TAV71uw#W)B<13Z_vePu*)M@e!Jwq0>TIfa(E^ zfMDd$LQe~4wS~je+r`c6cCAMC9?b14j1zYW>;&EJw7r{Pcr;|nx5LTLoZ4Xs?tx$N z)UJ&L>=c8C{O_IwC?nL?C-b^}jD~*)hKHIFh2xucf8}h;ZZd;*LWh;TMJXpXZh+LB zTSGBr=c#kUzd`kZGa&|)<+Et^K#fk+N!M{qvUyfMEA&)WSC@NQIvHCSd?8I z$qAAjRUf;y*_eH1SzOd4)?QS~2I$JWkd-xkR4ODP#)m~g`*Ryv+8sOGAK9*Vg`pPv zvRwnk6QMol>6}V<_~SUEt0w1dUdv4JE_0lKaVKF_jzPdJ4A(2St2^~P0_AFO7mBiy zFg52FWVwpMiiQ_Q#IOYcwt#!6Q*B+a<}`C1GZ%vhcG z+4YltXxpl0D)DY0!S@i^c16{nOeJR@LCPkMQzqPmxcJa0#Iu9D_8X0Gw?-zu*){&! z>r*ovjo$kW1VLk9*#g@*I_Vp}9IP9cvc+vQS*BkoW!@FF(L?mqm}mT#o!@m*7|o_M z3+{NWP7~2@6s=9kBD(OjyG{I^9lVW>daF2$j!pnts_p|D_$ArD#mv7f*lds4dFI!J_{12drm*g8@msM+%GtzSOj#MS$op<`Wh1G` zGnw5}^aA-_sG9H&E&T9`Y8JUEbQo20k4RMqKaT(Fxj(4m z=E0p`Jhq{58LSb6YY z1B5WMJ;K2F5&dfhLx7YK`VVbx4Ivpo1r+@Q@BAmg;$twR|Dj8vj~+>W|No(%k1l?p zi69t|g!}_F*?lqq7IdUPKY3krym!4cW3M$irFVp-Jg0*+`+hq}{`1cPS#TfCUJC#F zlb1A*eDMU2f^TS3tY|#O3-E{nkrRE#7HOlfdBP-i^LZ23^8= zYnoqc$}xoGg-iSW@(n{6{srWJmMnmT?0=8H1kd2ey=SH4{mJk7{jKVK<)h&7TZf?E zularn40W;L1i?1&mN`l5%lem?6|(_n%WbCjoux7$p#A2$>fJspSDn%Ca>UOt!X{t_ zBP0>uB;fM;4Q)Loxb~bZe+vr#`{|mipc*(?q2_p{jb%N|MY)% zRY29&&?keN{Waj*)%%;B;QL&a?_HSR%Yol3&|J#>B$J%7O}t>fsYcesJa;!Gt7D$W zZF6ZZfSd=q(IZrv`1x((UGRP6ohg|O?w+&d=56o&N&juDqm`r4@|tkI7>g$ibEDs3 zNd-T{)N8Xjt8I}xuTx}|vp{6;_7PcayzQ?0ebh!9I<2~=T&Yw>ZTqA!OWb(#L4ugAK7loAit*${-dSR_zG%+%s4--i^sJ3h0)%D#+>^%JZ zYU$6uOn8%W&#DjTy5CnAl-N{ddVX{;U>!#wkvW_3CM>vwo0k!|36 z+;8}*^Mft~Hu>K{8*_*e_YM6AnNKD?0f4)>_q_wVN{fs%evkL7Zg{A^6bRJTOK+Jt zgYv=mj<Cw(8THbi-DqCTy_n&y_T$%a4L-cL^;2T=hV1!BkbFfJun2`fJ7?Vb1FLC*TcEFG?=kAVBiv=VACYntwY-|T4#Ni+ik9>8w zU}{nVFFW0-om~n#Ne(splxD0f?V2iHpXgZgQ~48xqLc2;a!ns5Nzf>CMS`d`?X2Uh zf?^H5TW8ByX{}ibs`kA%>G8;jRDr59ew$O%AA@WfwxoGpmL;u~mV!>_vuz<|aVc@* z4hUX=ay>`<*o8q^dD6fND;t}I7)JM>W?+R)Y-hd{(Dkvz3h(NLH0Q4B7WzLT#{4+8>*z-U5`l~%RlYduKjKpaMJdD8ahtBV<@N$>InLS>cgzL};m&Dv% z1fBt0xBooAFfU#b^L7#Jz@QrdSFTd*;1~b%=JG$^RMs~CeL8-T`(GUUpTYkZlYbQ6 z!srx2*>;==>ofWee);)k1%oC}3e|b!%*elgW zckFJIV=Pe*M5eQxoy90wGG&uIfT#B0fTvAZ_Xl#p2*Ns)CP-y;9e*DHOa;V7-D_e0i&_d`@9Vs|XE@3X~-Ay+qIP zniLti*0z$zj4FW_$E!z3;#0Areyy~l@}~F_j4QT*4-_mr-y92tkdScj9<81d1QZr^ zO;9o%U<(kE%kTtJr?IqrQ!cy93_feFlq`eWgBDpm@WMmnC9zXTQWvoz(t9}PLo9-B z5YFb!5$EfObmITa&Su9Oq}Ytg;e|?8e5W%3>9z^^OCbog!DEF4N7noYw&!db+XPBe z4fnwYtOi5za(E+Wcm0%8j-aC)Y_<9UKiuUZoS-UY-ca~huxFqQCFUdAD@R(J13gYz z4{AL-0tbG$INv&+`|qlqZ{5au9$)$5$2}ll6<{U}?+60zUbi0N0iT*QPdg=HYb`fn@ZKa3&@vr~DF1~@~6`BV`LilbBBM6Gei22dA2ngdk${;Bac<}VP{idv2Z39wg*FX_1|_kt z`;gj1;%s-v=4-Hy^Sx^awJkynwhx7c=cQdDKm=9y2!7Rv7q1Hqdi-tDfOJ$4ydg;q z9}>RJ_`XTV7S6~XJA?Er^v9#^eLqPtgww>OHbq(EBT7t5MPqUt(_gr*#{yo|s?*)l zQ|l_K1`e8ukYhI1Q0~yn{VmTDWG}zXFN)uG>{Js%BuZR%8Ik>kp{aod z-kuwAlX$3BM(ejWcCxC`;QnKHwk~n8FhSe;qA|2W)Fk&kx#H8$!mL9vV^j^4cyj7Cf$5n@BT+`%sB@TrTZ3@ah z4{c6wVa$YfQ8xZc@MyjV5j`>2{+_dO{Fe(2t0tj9Y(CtuW9hYpuY;PAnhG?oOonRZ zZU7E1f?i(wRI~QkZb#(w`gCwH#!)yuD&{~~V19063!+(_y;kpDWzvTy zt%*j>O6|oOEm803iN-h4n7{NFqFuG3`;$N{TBXB`*7hr7fvW0wpuhrdrfvWS-j1h{ z1^fG8#PYnIk9&^i`J&TjAy%bK#dS(Ni*`2(Q{Auz)ZV6qBuT~8yY$ghQxvswB-#3= z*OrjJV#!o2VnM10I5c}Fa<(Qg7~BRe>SaahzZbK>h<#H{=I$nJq}0caGvorpUbk6( zkker4c21?5aW5O_%ufAv3w^avEEPYsI#+;7o5Z9%ewFhYms}L^Eff*uEW3}sSSkFn zWiyq+q!ym?&e&Fn6-7VK@B&Wj#K4gRriDTbrO6c<^df&=V&@a5xKfZPAUg|{%@oM=w@rtS2lwQ{(dvzB|!$rRuBlu zH@LIs$=beaaQ{aSSUYP2MOI7odnedVejy}QdX`mD!?E_qp8YbtYtf6ws?S-EG^`KQ z(Xh_LVYyzB#*&7%Uh?7L4vj45(X@)!#AVL>sXccFC%<27RfCg(grW2IQ!~=sF&vQU z1PPJGvT{!}rt$)3(MstS%B>yA$*GWvAl!$+5~I_ghhVo4DrZtgwV$rayD8rlWV=3j zV}PhR{nSr4ffE79tDYfvrsh+BQbaUZ@m0G7RkdEN2Td^gJ`YKJl%+eEt%bbE8DQ2* zbmq_7-3sZ^7oC-B{w%5_(C8;91W*1duy^_;y;B0hHWR(G9r?dp4WQe7Kiy8dTX(J@ z&CP(S14wXVbGo4mT5CJQX$L8#rT;!yRCeXkJJzAwe1vo_7q&$y`pa?>pJq9G^ArRQ zB?p5PO`yY@iSFTkZEN8nM-*h~6VT$(Q+!dctD6o6G9OKk$>h)9)IcYW{qFn?T?Wd; zirHxY?ZI?U8EJF*azcQwt*uQ!a2$M~{tJ;->T1GfR}^586B#>n2%B3T8L!r9wW@>3 z#axGnT|hMs&RNO{<^=*8u4*hhLxh~IbA-2~4;Bu$1`n*ESW_~+q9fE{sT{6kool~R zHQ0Q3ie{y%{e@q&7~0zLy06eP`__PsHdQdt7xA-Zs?E8HmGwmiqKDQ&2i5XjX9hZy zCS1upgmlkH!UXXwKNGq6F9si95GK~AUk-60QF!<%jpSfa^GHHwXU>5N95;%5rvWeP zK?+fW1s`@yEW&2f-qtA3uR^6_N=l{3>hb(@&7%SsIPTy6AWW?C;z|G2`hFYhfW?x; zVr(qB<5^^S0$pBhQu!%hR9lpV<;e`eNKu(8s-FKTrN_FZ56;Xs$-R(_sWAJCaA!kn zf*W;;g^i7crKPP^`Nh^4wBo!Zn)D4qGv<9!spRZ&9dA8JKP)`5jiy}DvLRS%u+0lP z&6DetQT9)H)?!Z}%IsqDxT@WbBQXQa;{YIe9N=W$N|QMciI^Q2OMsoKve;3m2k0P? z=Ge)s;dg-0Qnb_HJIU{jSrV56h^&{}`?NNH&B`QKIi!-Bt}89P%u^8d*4V56+)x=C zJIx1sXy}!DJ>Moo8HhDt(MyMCnO8J$V4tR)io}*1P-i8i;3Mv?_|EBi$>*vmWwKq8 zdS<40(m&3xcgpH%H2V3T2Rh?~aj=}A3yJ~s$?(dXqwy#wI8BfLga(u8MVW!!3?oG3 zSc6;nNPq7H)*c@o%3K{wR22SDgJ3kdw>CyBsAYevUS!ef#S*Jnet3mofFyA6cVbTfneqn_;G^`shC%#n5b>qdxx@hhhO=EIO{iMs zx_+pfd=fPgYFeL-i;$WEMH3nC4;J!2H#7)ha+L;>mF3@wv|!o@@1BUf(#EhQuOA7 zyr;yQg%l>tR#KYjv7A9`yrcXYnY1}|DfC)C@1x`$#SL`du!BtGRH5yhZER3SZkA=- zz>A2B$>%nw$-VtDbgiD01iJ;^z`oy7htcg_4B1q*^@s`PIVDg7E8GZj(p5{f*<0>yL?uUh<^cr-d_vV`mv{ zJEFWiHo+KTt4^Y0`QDz^QRtw?y(V+_UZ-AYBXt+mnj_ec9Ph1NOBD7=p?62IA85C@ zF|(%2n6iO|BXv5x5p%HyLY;%oDgOE`!Cmu9=CL;3mVozX|8EFnD=0Ap@Z?nbV?QahkB}oxf-;K-q00 zjV7%8R21BH&C9o;&Lg7aA{WE_a}bC0#3}NB7<&iq%DQe_I5sM_ZCjO!ZQHi(N>a&= zS+Q-~ww+XLyP~___nvd^bM8H@ecvBgZSA?{o^$j*dhf&GyL5PbAC9R$RB&9MlPDl{ zr5zh*r*h-_Chg=5HTgMTD5+oyQbYB zMnE#>M}6)M@f9_c+MJIYd|svtb%J`n4yC@E*c?l&&UCukU2o0^+Z-ihT^$En~<*WcCQUieHR@)R^fAPU_ceD~Ur=ahx z!lsgJNB@Wkli-^^a_sY%PR%TDU6H`=w&3HPcS++=yaXXXt~PhGh^LLOm$eFq&c~yT z8lkt27Fwvnc5vbGESZ^)r`KN9zrQB$@g!~*{>g~=2a4C4o`W&cFf_OxxPsYNcU8JQ zoOk~qCnkOor}hYKx=1p$5Anbm+}Ap@$<+1zgLZgL$fd0XelI{L3lm5@XBh|rrC`2q z!mL9t!M8z|K+v#shRAG{lB!dFFK3S=F5 zs?}F>Xd#pj9I8bQTe4Uk+ML^17fhM4F)&3xBi^_lc!zH#-nBry{{*vYZ*PYKa#aR> z#xA{#8^w;Dndw;Ajx$Wm30ljwjT91w5?Fk@TwnJ@UpZfY6;}4s;Tk54d|Z`0tM5!O zd)NOU2lz#9BXfpjE%tQY9zXAVog}9U+3yh**rPF=4PSrVoaqGkAGIN0GumY8X{Gvm zQJ}bL-YXxn%?R?*y8z~EzV;em(BcNqO}pPOT!{RfcL72|8H%%SX{jj?LhAqEng2jj z2g1U@!1&@22lged6&Uo@ME?Jv6I;uwR6s8T+=ID>VGR&L)2iGD?JiBJKKFXwb9%g} z6!U9WtITIkK^zJbE53=>c4KhLuZHb(KB)WpK7T zALyYnkf)Qb8qkRE*UKg^)ug_1jS}MA7`=x38%2i9Cy3$=@WEN`6~Z;pZw7Lp>Cx--r}vP zrN@Q@tLfM_0=eq4YFRiy#W{xGjtKZz;mM@^vPWc7M3zwNCkEf55VNFhDWQkb{Q#6b zshDU9>)Dw#9Ub0Kho+6wdKKEEmvDMfHuerh^ZxCUgFTB{SLTl+{2Vs_d(+jlp#2Gd zO>oOLPc!KIgiw=saepU)C><3w@mP6Tlq+vN9X|tZjQ%2u>nF4kvcSIU2#uQ$7#`qS z4&XfqfS^KydAgu+4L$4K3_{#!EY*Pe?BtDbv4mZ(&7VGs7bpePyPzU*erJC2hd>?y zDFa2kkjo1ElL7MI3K`!SuvM{`?mJ=4?F7-zc9N!c#Z^isszW!}W_K=89w(dyAM+Mx z7C~+!OCu@%dB@u>4~wOfD@|d3JQvuIc4Ra%)RN=~ClhYK@cQbO7JjAlI1Oumsqj1& zN@^4Bh7JaOL`q#>xN|@v4iWl{t(JbuC`a1B@4uOa2}&1nc3tQ70rgN~7&?3DVaZ(r zG-Q0`o*-<{UF+fjk5zbG?`Cs%<(q~QN~R*KEwzk^QetH!D2c2Ug;_Ys+RGYQk6!$4 zg&l$wrO1UE1Je$;Sklj&qibUX@8B&{tpYn3H-}BlV~0xsy$X0IydrdIOoh%4Dj-8B zi9)c^s~~%DsZd>nRaMDYWjBHU&6+PwAtE|wV|^oKQX#^fu!i3@nZkA()1K{_u2-9! z8PYmOta?PaX#u7RU4KJNg=UufYDJtMZYO_$5&iP|Cyl_(6N|PoXoDxrg=iFAZiKg~ z!OzXH(4zxt-_ZAEBHAorObSU^!q8U)@mVpFNg+{>=J;A$Oa0g%KBF0Zifj0!NyMNy zvq`vN50dCO*7~CAqBn0SibUqZz&!H8oPaxb`WCf%`t<|?k=(Hz{0aS5KIHbo5AXe_ah*zvq&A@OStETU^Y*X!wI!UPlL~ z!Pj&oPiIQrf>FwY)1qTvnI_jemNNai>&@#cSd@7l8#S}bB*<+%#N2xvz&GrEChdtomy@zd|lk{OGCOYCQIyurL7Kj=+>8e%3x2X&P8hww1W`N zI|NhutV8a38DFDY*&&?jPc(CpLeF4#X&e)|MAsQTng1wodS|HjL!RU$W3PJeMs|4q z&KjQKq~J|8E@M49_pj3=c%t$mVcZlHNrBuDB;bROuR{$o9g+b4&#a`BJ8hSngM)>; zxheR4-zD!Vddc=%rZyV_Z}RZPk14#}PpR|Pp-UrsS+Ei;_JCX8SWAiKj>#z4Uns_6 zP*|cpPCU_+`da#WJCIzEe6A{;Wddv4^O9zcxC3wnmtkc_VOxNtKp1B^2eRe$*KoJVB4-O7I zUeKNfA(&go(?K}3FMe00ZRAkY`Ph9k=KVu8Jgi`6rOWtC*mJtYC1jbk<<_=UUKJUd z1{`y)HLG(P@cdMzv*Pe7@jPv(MQ@(_OV~QM&r^kp_=PfXS@J)uE&n2=cN##NF^-R# zqo#+0-}cos-t(a)!oz<;NqD(9SJ}1GFab6qiP#N(B#qcme##~gKDR?FH z^c5}T*G6w<|IE%-eg}gZ0GY}T{O$NP5Ab2Q*Y7DKXjHX^KZ;ouLF3^hZ)okQ(P%w& za)FCwS3+~){_q38$c)HbSNcYNWym}cR4mX}RU@lF*--HY^^=Y4syPZB&ku5QxGbwJ zdvOn?!k2}m#@z;R9Pp-pd~z~7JA1QwP>i2SJlsUyLmWR&S1PKv$P|*`^}W=Bjr^6t6n z%L%rW=?}PE?yAu#%?Q4rhue5Tl6v2RDN_rw2Zfb9#Lc!UEw~+{UTa?{pGJb|Q*lL@ zJXRxTuFWY4(z`#~dW&6AqFDXe&B`jU&vpd~Rxg4p8BXG`i+@M0u=mZSQO)ivBirEj z97<}>!iCom5apt{f}}w$n+KE9YGn*IFEa=6)sv4$R%Ca#n;-U~4-nRZ*g5I7FXBz_ zAir+X$U3@s`OJ;cCO(!;<$gG^`A;^nuby~3I%|?%&R&SK_vdD;0LQVfCX0`#KMC`N z;*Qm2-6Qk)3Ni(Hh>uslj35GH4CP#H_47EIXVD}E!$UAG#$nf%HBI#QUlbwNm{NFy zTSmuT#k#NuK% z^94ZU^h6{fTP*F_P@}MiKmz#ZE8?8k=(x7VI=RNVtY<>PM^hiVgEvG8NA2F~(Q=3|8P&h=_n2QDueaP<2Ya{wrO?h++pT zf$2Q_%`_jx#BC!S>$R9x=a$^EnwnIP2pUuL=1aDGlU22;4-r2nVUM58(1MDv0?h%B zgC?w&t3LN-V@^#~A0k^AK`gMeSnC=;Dl%6wnv$KgHB=|S(ZwwkM2@z&X_059527V4 z2DA&4G;lN2-Hk6X_sBP;j2HKmYQ=3t6c?5y5dc2hI9!G{R_vTNPsz2ec_YWmEn-#b zGDXTa&k~3)Szw+X-O%i~fPq_$s*W zsz)Ve?CeWa)}Pi8PVrg5~b34qR)P~&tB@>k1#IQN=(U(<+ISy zt}5lFqXO{UY_#d%?oR1BGvW;d{`{OJyY&Q3*6rPmQ*nWM(Pzk8&yhHd4r;n`T(6 zvXD0xg}Rd`g!g{E(qmJ7t)_6ri9he0G0R*7EQgX-SolfM`-#2= zeT`YkW1IX`(1!O$CM-PRV@7P)7y$6^A!8IK?5GuS1M)Lt*I7e?#}!nN28dF$bmrz} zrt-Ut#Z7!a#04X>XULB+tMG$$HEE@2RCLln*0QZ8OD{l^xn?!{4AIfi=NHPBfJ#8U z5MRH9gj9IzUs)0ax`THs!U_?xqYR8RwA9pSS0}wUZmmW143sx#TZZmdTR*{M6uH-q z?D8}B7yxd$)Hc44o{iP5_TC1(OVZ`I(9%Bj-Jzmp!I)#k%b-S#8D*3j-rMV?rE80A zBC`EF?DN47t^B-AHefokKIGYdJaO%$-M{)x_|L(*^+Cu^zEi0uFH(|sz-{+;*%Mup zt`#wNL6UIwXBk7(0RogW9f7mzWFAV(YbcE4vedH$DXK^>fa41AO``8#Q@5(nR1MWsE?B zoT&+?A^;ZX=q_V*D4D#uw2wYuloYAM=2&qwdJCwE9s_!ZZP8%zBpey~^gK_3@r5pS zPGdBx@?qE~QX}#|JpU&Att{xp^nzsIOB^q)q=|xs%}xn!4=LxS2}x++vM(-B)0XDX z>MPw%_>p+34TDp?w>UGJ(qSXbM{%~atLx2m(n-c}NKT8mDdH{_)erHP>5LU0)2#UD zNJ%@~;`>jd2_qNSZOioNUqAgFRWMIA;VK^93sg1@kR*!T^xT~P!)~dwBc3YWiSPL7n;#uS< z606`}&LFTa5pyEXxTnKfrY0ZaR%1GKdLTVD7d*ZrqBHXQ1}h?A6vBa#kI zDog#VCFr}JQG9>uy`intIWkxwIbS}6LES}EsRrB0&|OUy=%r3(TH&DI7_Soj`mx&X)Se} zMdS;dGm`fLPR9YYH#a&fJ+elNG!K{sL200rFHireBLpfldy%F7!x;U|x$a}p&cVXaQB|Qq z&d0|5rU!z!gsy=s)9FK9Pj-@fV1|+8UPh2sN0i~;(;ktTC}ND&MD4WSNcim$Dr|av zS!i5#4sFDqpUtl7Tdc)U(Jb}@zw+`buX*R$8)W@z9+4=CXDyDvQ54Go9hsJu6gph8 zta%Mh&yGSXXzj$o`%encjYe>{!@}sz<~}q2-euiB*{QLalGzS(M?AfVwse`P(V`=j zQ$4Ur^WR&Js`|1sW79?{Nkm$8pj@VL$%Q4yb5^R>bEM{~7pMEo*#h5)A1N8Q0I~&# zhld=`ku3M>J9IFn4ZhI4!1Yjw0t#edVf=~z`5nlTPtFgRdxnytuaHH?(hasZ-1>r8$e+>uL`KF8v3>W#MI!1 z;>^tOdj_xn&MW;%otQMTi!MrTF(WPf+Dl-jMdH+!EOxPYGuZ4jnV;Y;Aqqss^oEUuz3u&^+(wr)mfD6NU*8iyb`yG<}ggZbL=% z_LnKB>=?(QK3dkefT?Mk(hI2cbo()KtRssss(QHbQ7szqh7O>ZN0l}S8!k-x+>y+F zVRvwG(Ne+7exUYPy8*Dc2}jsmq#GSAxh-(aYUR*K%U?84=2&O~SaZeXpwMXjvJ{c> zaY+W9LrE4>L*Vs*@~G%w${wSN*P?f4Y;!yX>5wxD@Uo?BYi#Fd;jFY({Y45LEjrKn z3Atu!<8Sngzp9yYGFe!Q9Sug?Wj_Pb7~)b{72R)$g~=*4!~lh5y{QKrRrd0yOJNLO z-s>EOI^uDAezsDa9%E4ou6?P|G)V3o-yJD@U@St`7QdfCf-hD%-`E*$wFok4{ffmg zRlF=B1AGsCn6k)~kudjaUzRme`MZKF3|&R3^jN{=hGK~9_lX(0+y*J~@yWj|aOo1f z74~{By-d6TC0i%Qob|K@2z# z`9I__6PqHmj{UJ8op+k}P$($eCNmM-ov@yW9ZT^}O<6;R3lG#E{-h-7(W*Ne%Ikaa zWN2-1Bb5ucv5rJ^ef3FbV25R{Z{sLx?sfN@%JZe{-98ZXKtM*X$Cz6opi=)zx=Hf? zWVF<+8p1JxEgb)$?yPBi%x?av-Ni5|H%W6aTNB_-(q_GiP|%)*VNRGnke?{oc$*AP z-xpq6)`81o;D00R2?x+oZf1l={Px?fY3IB4?Aj;Y*WA3l6EWF?9?gGs69$?eqnvWa1#L62Lq@Y~b-*L<5X>t6H zKqTw?Idt3xeBH{z!ZY{DzIxYsj`y=vjdwImkIrh>D!u|1P^WMz$QBMouiJu*)k$AY z74iYsa6Kvqvv^5WXMbr&O)z`3)#i+Zq%Q9(yAY`^9m%}eyU}!|JSChD1H3 z%p~8);dx;TcSHrsa05h{qM*%LXEvz|^UbP+3Rbpy=h1V>bth(*>v;(rcFu^zjBHuE zVcaEKy7cwHE^3~kT7gs)*ZVWMudDP+iRm=LsTD|zd47rw{RCC6mSuyq^sPXiDX_(( zA&du^z#mdG@@PV<@EGsIClQ${bnJ8?Vn$;Jxb7EkTx|UH!{j?Pd8S7y)N3prXp)D- zg@RlqW=M2Wm(m{coX`grh3q-1ErG<-zZR3Ky(qY84u@0wXfzM!?&n?Bn!Yazz!8uM zR?3{%vFL~#f{vMGUnc9@qqiYBV?(HrkrilyLj)i{K7HJdSNP*VRl-Cc97NRH2=qVwgw^)Kid15@8B7A8t`$Jb=An2uO$w|^&Q zYH!09(w8S73_O0uHGQMh6J|0@*kM z-{Xe!&nh;H?%DtGpS#lo;vNSsG~KK2HV>nPayYR!ZncvmAyYUzJ1;z&J4_?uxP@r%9osh69oOw6cV+TB&IrHv7K10Gr^;kS_?Wrz|!A4%LAe{&}s?9sw{Pp_Lr>Xp7{b0I`Rw#T! zGdn|PnU4Y6T7J}M!md`ULNoIqDzyK~+MTv+{6zHecgSg*Sf1jlS~k&4Wkc`DwCJq_ z*7kWOstKaA*??g5^5HN>qpYAJDb*;}I(VYAJUh+sm8^~^oSC;Ux%TgD z%}r6I(jICimJ+B&H1X9#M{lwdHMdu#F|n;Ey1m7>RMLB&UIF*y12e3aASfOlzAk!> z+z1tJ7Dm(>TShsH&~Vx7U5(l?=RIQ^C@ggfA9;wTYQ*h(1p$7l3FM>ofdMv5v8Y6V z*R}6Ok2x6ZwM978UF^)?d0%)k${J%Qt0q>amxe&qD3L5I0tz*2N!YS`iD61>^V7jR zan>Z%9IhZY+THhue2aNsk8&Dz76*Ci_2l!uYSThW&I&`&15I{5##KlXn-7fLLQH-} zBx9868Ag~PJY^+sOXHdR=L*n&;l}^w8T%L3L(2wLpIp%eNC&(dk6ojMkh4$^@+p{p zgVc*n`P55(M>8sA&0go+-y-Qwotvu30^c_*{nDEU4@L~U% z5C!fZ2e!(xt&fj_y(Soy4)Ef?(mRb=enRZQbgj^8e87qA%Dj%LYP(vDP_#ZA9U}(c zd*&1m`)d{*oC=uXsz85sq@vJgvr8)(Ok)N5m^Xyy_sG%`Ij@dVp*BaT`7h9?4 zOP4pX@p~^&#xHX$G~1i>=IKMm{5Q<61Zh5k*7M)rQqX_9Kfm;aB;3P%!qj_x*lOAS zOi~kqWG@kE$-?sc$ZFZ?_7<{}3;Tex^soqK3V0YcVC0Gcf+E(#^_;J_ua}h-Mu~`I zeZ-6AQaIM&ZU5u0isu2W!{W!?{NsRI1);a4sIelEY#3^5*^c{ni#o9l?D_R*Iw7CO z@=ZX@N>NEF5{MW7-1qL6Ilk*okG6Vb7hX-Qry(j~cJw+-3WFF@F4ST+fA9Z>K(TtS zAh!okRvrC#lC`u0Odw^$dcE+t*vnMb56~a?szBwZ@Jh>|48eODkqycQ()sWVqXnY~fi^!@3; z$ZJ4JmIks&AvS}Jp>eRqG^=hRzR_3*N!+Y~m7vg^2D6>TWfw_kXNUvB^Q-5i_&26+ zKmA!s<R>V30T zaaC1f^1qQ%WQ`mu-%2vk)9ex$8lSN{L-U>l5i$4jLHW3U7KD={W%+gPjyPLqS!-bm zD->~cuChqF&WZi%L~ZXP$cCa+!1X>VC&3|+>J-YE$XyijLC2J^S5x2&~xL7 z>?btvf51A5@E_pFJjb1Ok6G@Q@3h_IeD=+AAs<=GIZqM1iwwG80@Ro0HqHHh!_xKS zu!YC^8}6wm7xp@tU*tFI#lY4T(xoStJD1Yps*@|Rj4^y?3Er?}bMY7D`{*nJYki=j zc3d!tXzX)51IiD(AN3o%1epCfcM6dBSNDKh&zpUmx(Mw>`oHzi!#Z~Q^Z^znGY&vpv1?<-&L0bkc& zD*=%e>V8}neg5toZCx#z6XOP z5?vL%&dv_{>3*Yq1%OJ?Ll;g&0WkNj_m25i%Q*O%dkxTLW|&|gd_VaO9190ZVz&P7 z9vu}o|DCN6?vkOJ)_|rXMD6X=o-YF-q?4MW#d)+%Eg4dMj8?;1jAeow|3!P&PFb>! zN2fFWPAf2KfYRHJ_`(Z6{IR#kJzFYDT}@#1`}^wBje)Zv_75r3h;Sb-Ey8dzyxV^F zJikQADQwg@SY+FR2{gxLkbLcMwsMpVq_Km337^p-@-&XnBD5StVED+7R_YY(L`z*= zYAv{Wmv(Z>#i~(+Tlkm)`K*^DTx4*+B2Gq=hbcw++1Nc7F&P$T=s|ArpioJmi&)GrSDC z6aN;rn7}l5qLN{WnTeUsb6Z50#CzIXIXidbzc1MqO1lHS^`Klm>su}>+mhfNqe?wl zw=piIP@Mb8ca|3_A(sF-1}RVv+VJMyPfa`fACNOH2m@_7Xar4xQTF~^R7J+$ko_P6 z#6UXYHF+0Z>{-k$D10N~xBz5R{4W4%%O64ZG5t-pnF4%Xw z=Nbv{I_0HYS36i%#1(~yD_?gR)Yc2}WB2>u7(@DASC4d$ZW!16Uo|uOV_;j!gm+^# z`kl*M4KWfR*!fH!BSi?C8l76+&xbi(?sPi`KcmRL9=sj%t{ivAfq)#Nr7@-WV=tA7 zJt{VXl(E~L0iK_Bf${y+*t9M2q(_M7pX#(X;3e1GfAJKya2wP>&DUjqROyKBGUXrd zN{nTg{Ac}`2rw>h9%v<%#Cg5ADIK7MP_};G5H+RIUX^(;>#abVQZ?%HNhhv3KhT~7 zY&H`xU;MmX1!n#Q`Y*em^-3e(s3T4;*xmI}l zEb;>V)D>3G=aG=Cy{~98{Wx3tF~T_hNe8Cc1h>N!+Es%H0;8=9!9uC<)SEjRR(w2w zMi|77AkjjCgyBp>FkGS*e}1btf<#LglGqU!V#eJC#!?ywfosc7R`;rSjpUBm>%?l| zPq-x=ZXn5;!Zz`@D=O#7HqEGGiwv%+qKfN!2wbb1P3bU4*)yL`cqn%{D}HsdvZhjM z*)&uv#<)9_#e1!eW{Awtq$%-kXp0>h&Z7?1$}TFqz@Ca*YeotIPY;-zVN%K8-b)rZ z)fk$F8B5P6Jm3Hy!^AxyXq+$lvpHuG_os^1q&%Fod^%qRxQB$2`$VP&yu5~mXhPj9 z8e-4c1bp6V2E?(jv3BrxCwF8#vP@HXf@a9Eg}r%7Qv;0NxQ3%&A+a=?&w)KvyjZrx zoDN-WyaRSw$D0G$ftF$(4sQ;IMaEK{9`ORTh|S`(r&>T0J_|mpvumqjOw&s`lDPCz z3q~&^c@QWd+sD32zW-Bqu;Py72080II8pnyqnX%>UGwbwxlC@7{l)w}@JwH;-H0Am z`6IxPAPatnO+y!wK{0BHg}-rj+FiO4Cg{xr+6UZ!?~R@bY`ws=({KOWi(>)c(IA}} z7TD~#4VR{Zh|V|0ZA-4fH})4e#~J_ZReP%FC&T zZ{;uG;M+rp5hn^mGa9x0Zt^ZTKOmg+u9|+QwxNjaK>AsgAHmc9>Xy?d$eMvmR?d=# z)M@w~!U4V3302EMR4%*oPf+&FLeI9QJv~7dq~CkH_G0b=_U+!#Oc1>%0X73NwRwdw zG}sj9^&=sz=HMm!$pdHjfa$ExMTzlR+1wd_)U1NBh~~U@7eUQcgKBM61H`4K2n%-| z8%o7mF4u1Ycf8ilC8q?|*=WoVap*nIimo2&nnH`Ih7U_(yc8VY`@)Fn>If%BWD6aG zAv00>)eLB+TJSpSZ&A2@z&M~#trC{B+q*$DK@S=xi#G!SccfcMfe#x$!4Q=m@A|Re zrl5PdA#hBbou8Sde@!9#t^S-E%s_!Oa>Y#pjkPzL|0Adok|fgvZn{bH#I46BxX3>n z`IXnq%y@qXABBjc=If*coZs ziVKli7J@^xfV)^UJVhsyr;i8LZ@F5QaFI+&M0eNQ-8@Z2tb}%e`xPbC2|0y0Y{mW0 z@po49KfUcd2Od;n`?X4>4lWYRZ(vnkEYUF-x8H@)%b+gW7c)9>`o5b@Z%N+GkMs7F zJS5K8GnID|;iJ5p{v!e)FsBtnoH+ITVnP8JNo*Gt7QQaA!T5>Wj5YE*gKyTl-}q5q z%__mqf~Ka+5kJCn){15ivw)e>1*0Ef=c6KKJ(R-MBXJmQ9?yJ36zLi3Dt;r|%>ksX za__G^$&bK!Vg$Cf6P??(|2`6cLB`6F!PUA9_E(qJ=R{}Lt?suI_PKIZK8=mNv!T&y z43v&b&`kK8OyWeucpBYzZSe%+ zw_x4l_aS*(^2voLx_rSpzIpy}sPvgc`Szal&-J|40ud4KTC(D*WSpjtP?y^#lDG8J zVrJ_w6(qP8p`3e6eN z5~7Nusa4Z~&e*HpY#iJyZ_^5rjmgr_A{4Vi6ZzJ-*x!vKJ*1z`2SA;Bzqr_p*|bp^ zw`c9Rm=-x5U&J>k9-`ecSG>hK`c5hho+1>!X0A#ov)pXQc|U%afWqYqxw`XBb_zC$ zutXAb>+V7^IKb9!W-!=tDs+t+ihCvW-sOD>?Qx&;ms@`8_WdDR^vsDIg2=XJSs5)sYUtj@<;^-vsfs0} zj>A-=ycQI&R5_ z#7DNJDLFHvH?%b-h+rCmY_XdKt9j~{4e@=_C(adhJu3v!)5H^d)VT3?<4AB@+2aRW zj^{n%-PX66L($>c^1nyNL)wXIHOi}-xwZ(j7%9bTx&2+zA_)|Vh;&q3 z5O|NAsRZoF>0WcR)Oc@%Oq8UTFias`mmINl^pY*RUvn8PQW(b)A@h$#z-*G;`Qpby zyVQ8&vtk8VtB`)DQDyKeWGUI3NIU98Ul(_EY8(gB#5RlKP9o7Bo^i%9@54G>g%srYzR<5f)nlNvAi@ijvf3>2=;XN%Vt4XXI~# z=cTV4fiy*fi;M4WdEeFLoX6gy9%eab3vi+%{`z53vARPGUD z4s1DXlmL6D0X9chyQ;`FuR7Sx;#bJeyr;Qj*tLfVu)dUcP_h$fyne{Obx(pYonsCy zh5ryw@X_V#y^eXC+^BNlPs20w`HtH~dTw;gW3$p=iJnvS5SOY1aC0thY_BnF`pzzJ zn`-GLVC$9cDz#`TjX|h#kLp@@sXXliVU!EVsC5XU!UNt3n<$< zRO8V7GHs8n4n0|)yB{kfT>Nzad+$~MrQjEEe}q$)UZ#$)5G!Lf}-AAT!YF%j0E z+{|p{+~%fWZ}f-Aa0ID*!f4>dRGKn|D*J|TjI!^o`F%F}{e70eq?~q#?b0zgkpN3& zeB<##cDYb&!7)5>L}kT(q%sHbl@LrAAM;tYx+)0rr{;}%Te3e6ry#$KJCce1i(aSU zT$8>$brrbVINJMrhsL6NMpF>FrvSLa4{F`C%-Nnp0ugz4jAaGJY4;__;>6~I@Z`nv z)7z&L?gWWS)nm~*Z;f6kwnufFR3n@$DY{FL-L4zMljcevLk3iwp5rBJUWW z(F3%BP@F_Sdnexe!{HbDmFJ40pto+kU7!-p9$PV#}`wc3o=`ln-fJ!@>DBESA4byS;JjLv78R`q}Avzo^cW#J6BkDhN7_d0Plv z*si$KrlqH$6eh1a->h_HYt|{iL6uw;xT+_l7zjUXv`4#fj#8=n6uw7iuy}xD-8`bn znF>wba{niw2BtVU{$F?N#xG|V?NAFe*Y%?6xA?+)@Q-A9aZ{)#0`yh~VQ zr{4-!PID|aVq$;meoE&1#?H)2C;yJLk4{CQI^#{}S4vJ(2GIkVHOfS6bcxc?R@?9w z{w*5BRyYc>S^RH$jMJ$u!-`!MN31gE&%MTzI>d`=PO9?6ac{$Wds)TVzXMUNfW_9d zt3+8Hpawm3beytp?g@d0Bi|}6fcgwc&eXe60h&#)1XRaV^T)UqW@fri-NdlSN4|s? zI1NisBHt=Tst^1?J$Ej!?C~=Snv=mD>|91eO}STdGm!per^9da_1#X%nC!T71`3aC zy(d1lE1f%&8diFs(?}?xM-1e6AupT5fd{8KJ}NTKg2T=niZalS^}rkM0+#0RM>LIt ztUg|*(_WqiKj;plx2n_^$FdLHUc+>cENGew8kxl{6PD4CF@B_bE|2Mu#kJNYpe-FO zSWQ~@&)}MIjD*n|Vw;Nv?u?U&KD&n@fwF_SL@_2JEYhG#;Yre&`mU9}T84;6jURve zW5jV_$`ZDRs3UP=jZqXHZx0wDdaYh3P^xWd zevz4(Y<*{2`P5eYwb|9cZjP`<5+hEJNq_4pI&;W{3@|lSW%t1f&`9G(d=t0?F!=4` zUMp*FTqr`1I!^p4grWmE{(JU&-kDSEgdHEry|Jm8y(MPyx4eZ~mN$ukEjLb<4blo1 z|GAG|@!_FcEORq8XUE3x@8e|o3wfNKtb&WPv$d@N2Ec{^8pD-wy|szAzsX9+o+>LJ z3@QDk_fVR%h1>B-rieEBx;85QpJ!tYTZGBT<`s>?a4M8cD8YcW=q=28ewM|}#l<WM-C6 z?|zinx7JkEl^GQGmm9fR8NutcU45IL9OGv|v%q8q@whFxPAe3`weuMs(xi;Ce*5=^InWu*{#*1KM>jtNap472V>T0!mBT z8ahg<+Vonl?A&b7L;!%Ty=1v`)u)^HTiAdo5OKYe6Le+1n2SFy8E4>y?hrUSVw}(4 z!Vukb=C<@q^+Q!}O4^Q$-zqQ9h}coPQ4= z!jiRiPvzCg=P&On>)~%e zxO+=UQFRViS3?ieK=cABUX)6QwPGVuU;iS>Qy5q$D;o$Q*p%E>MtH1W#AU=VE-o&X z23ND$8)Zq!vhF<^cy2Lo2bEhk#cZvWcWqN!S)0ob!y)j=KRmOWvpnNMex0_H_qb>4 zkokbFO9IEsf-JMxG2IrarbgOFagmGQx$2)soMU~j({97td$u|*HVO_3Ha6!6sM`S~ z_o@~)I?pf5!$-S$E!6)r0YXlu+1$3ftvAJmpx5Z+v~$s-TBgQ}Ft_+6x9=kxp>`Vw7`#|Esrc z^Uv<%KXuIiPeb~j+zC7|s_=#QAH^v!Ep`V2)RU_R6scm)@Q!=&<=nS|?%TT@F*AZd z*HBl05X=SZ2@ug7+q@D%FuR`pK06ipSJe&VH5fkx1$LL&zCM|R-qw1yB+ah_vgY2P zSFX`o5U*p=;-Y!F@|Ah;3TojEC9LSRh+d(3-(Bi}Hh9Y;?cv~yP(I%h z#>b1gPxsGx9homlZRv#i$^ZRV=HzJDeu)rL#`(#SLne1uoxMcBtCR3Kw?icxDS4;K zZVk@G$6GBSqdKCTk4HBfz76~WxLg>@tr7uv!QNx|W&9Tiid*9Q9@{V#<%lPL-*Oqe zir7V0ZQo_hy4crSpqt*()}6zAliaVYx;zwZb47WnffH(jfIXZSnjilGN>c2$GkQLs zAM7J7S{f2mm#IRPJlh$+9xZZwt_P6yU$!b<9~=Hi{dT)w`T85)^Rm_bce3a6o(k42 zyh0$S`zb2tWABw*nX88L0q9{rN4Ytf_C7l9`FgkmC~OBDa?NaS)_qTGDooY)c>_)w z^?WlC>V|T*YwiX{%zD1fUshcAJnej5dR?s&9`MWe{GE$p>Uo}h z^EXWe)9evprr2^zeY?q6I-pEv+c_{%37M7#uJfF7DkQ<2`K zgpPuUbOj-TNCX4~1EC{?5G=?61e6YuqDUtcDFH$i0j2j&LJy&r5C|dU<$2z7W<1Y3 z?|d`g_xJm?XaCu=*1E6zx~?^AulvUM``H%@0bh?VkCXb0BXfpdI%4~c3~xPK`rLej zdkB0mgxLG26l+5PNgoR}1k&GtRI1#{dUQF@zyTe?ESjWxbN6CJ@6h0>SczN48T=`x9p#W^ugpvmiw(8qHIc`3S5F@vsY3x)zXV~qjpQl67$dlgCS8TB3z zos05{nt6U3OrZ;Q{zvbsBt_@U);gOw*+e>VaLPnPo4xuYCbsur#iqpW&u_ zkWnlVxW4AcPii)8&n6Kh4LnV6-CFy|>eW)0lNJo?m z3wfH2y+kJNl4PjuljMvsbj~RY%XChwv6^?Pqa}4T&&7rG@vl8mbzsdhMjdJD#PfR| zJKwITKUvGfeJ)i}+cIG$6}ML+ZlE>VV#n7~*Nx2J!+03TFjn#!rT3`HV3c{)2=jLHHM)t+xBWHwr@{E@*9D1H(GIuWQxf1=Xv3h`$hL`sq1$5b2o29^ zc@q-3pICX_PwGuTU##+9N+p-QQF7kIZF%@h=Qj*uJqLSt?`PK;Lk%AA7FX|kT*$!| z`1szbg(H@~TF!fap4V$wO4`-Qid+{`37i~MGlQ0MzEIb2h^$r37J&*}0V=ZwYGmZ? z803A(y-`j*tKUrbtCeMRHE!43$MXzo{|X!5)VRogA-Wn2zJ;x+4fMAC(vE@ zpn79$BRC89;3oSl|3)i`#bDeh7gy|d29)~PdXkS)XiVM1GO{L)0MTeLi}Hf?v=C>k zikw2l*2iWT#r0d2!1?FZ(*q+fJJxTNHrtz+751RdXGF8e6LKV;=SjR*zmPmN zEYuj*{Lz!F!+=EPi(jmEs?-1ydE>hKFJ`B{5qbAb1Y z=G9fOM7;ri}pWA&_^8IJR+5lyE`~#8i}6`54NVh*GIZ+y4#3MFRsTl=5HQ< zyg0dSt_xs}25_;`Ns^HaTi?4picPZ54i?Z4>*9+i*`#blI}NlDc$gr9wGtG@7*_C5 z{E7B)=C86d#~MrdlyOxp-8@x!jcekS_d7CYmn1%ZJ{M(K$Qs@_?2J2~!J~yt${cc4 z=;-@2xHrIX{BShEK_!$8{g(UPu8%${YiAxO7U_33BE8%Sn%>Dq1PKc-@tXcw>jQoE zZQj6s+))SD{eIr@Zk*<0e;e`Y{AOhBvTTAi>TEP*?YL}K1E1TIqst)n=H@`0!yo3* zj&^WQ0^g{jpT^Pm6=pFY)w1rex&~xjJTe$<=rC&VC zIy-7$dRb8)_)H)s?i?*-^5ebf{wg^!cVqmwSar4yZ{PiBwFlSGJ#$?(Q_nMIX1a(! zembP2v1{!FymIrC6}y%-z4a3~;p!^c%QW!TJA^Q&q zp;r!91a<1QuSe(b#i&`D2~kC*OjeoW=DuqWU#a|(SupLCrj>y#IyaoxqMcRVYnq%m z0Xx{p&dhAOZ(;ASD-(m$5L#gjSmEK z;=P8VK_xNGys#zf#l#xpu#AxfN49IFc%`ty(j8PqCe8KuqRjrEKl5Z!!dcqKXE)vI zE^%I22x=M^5mngxbku6~iC^3xhGisAF{1BVEvpWAuz#(C&>tP|AmZHRFz!isau?}Y zEuvz1?8wx2*RslJ+-YKv-JD30!6kefVmD;0K(3l*!^jeIf0#tej7c)W}^j%tZQZ>DlP@f67H z@f_rxquDV%ZNAv_{aT37X<2~!1E!gF$8q|X!4-;fLeh%2@f!q0!Qo-e>(d}~i_jk5 zfN{=t&%)0OGBO$Qu@XCCw@1dkRaAj8t=sXJMoX)ISpIl6A$B5 zEV{jQ(DSi#W)6Z=bviOiN(oOPR+<%`ybs+5`y5ppM zf0m^N%46DI7~z`pScZ3p6`91Jvp!TTc#eFXy@f@yV`f$W!+L5U*&=~54-r)TNT z157#S4?L}^0O^E=Z|ww+j8>=Bl8GwXt&@Xe`KcY!{&G5Rj7FWB!k#t)?CkpWCc3sT zOZ7#G;T9^fYCsgvqNZcK}F?U-oKw}fMXgOjxmeT;d)k*JK8SPh=_>KpRW;Y0U@+UceDDpMYub| z0q;Wo4lm+f;CNJ2RJ2Ry+B4g)_-Mge&&Y14wFj!}X1VD|t4HT%PRtmI=M*6LCeu@< zKmP*SK^QR*?&gMSy)Lxr&tH4dX0Vzrbf0kdFPq)Q+(CD52F1%1KQ`XWA-v<3X#I z=H5^TS_{f6tL$!Vlbiwev0?mSoxyW3Ac3nemKk$)i)2gZ(-Qi7k^n%H-ARfZxHcbh zzUbML8eTstva?M6(4r zz_4S`WQ%DOiw$+YRuT6ydoSkFmozX8C-2}{1>JAs1Pkal1Xj9lPL{ZBcUf1QUx%*} zKxp1#H;4xeu|5&QfnzClgoxQT2D@#iWdo7$6ZZ*TE&KIaLQ|Jp8J0D{!%8tPQ4UUt5w0t|W^?f-_CV0PV(!JKC z-WCUIC+zxyVUEV8{%#0g-ybQkfpciX76f%wv0&&+>`}#^Ki^{Dd|}52ZDEw}QOw@y z8O3CCkFsv1Z*GI{GKbU#I{F!bL4PD`ja!kIpdb!(a<&lnybU<`MNF{QQ(R&K)@t;t zkcc1&1?z>nh?MX)3Gs}gH2sb@PAU=IGTb|90>3!z;kTEFR#Lu6JL-ARlh@r2Z(97Yf+EjF(cHtd|IoHj&oFLx;p#MUf6*Nam#irzw9Jw&pN67@OhSs@rtmw;;Tci-Q%Cd( za=^oN$~%-dr%PFnJJwlTe9rz4ch=;hoL6_c?fhvAXA4oepVzjq^_ti8se^2+Wo@SP zf91L?0O0Xx3BZtk`nSov`ezQc++^6&Zpoi_FWx9-Ov@^l>6(CyP5ITPuREu%C54|^d7bOY93q;Z$Ez10}dh{`|Y2Ob6~-g72nMcD=d#I7be7SH~*@U zN+7t`+K}JQ=sn6|G#?7yDL>u1XC!^k6t+&>enVm7Rb5WE9BKO4ZU48v{5xH_n!MTH z@YP3q!||2w6vL9LuWxz9>Q%0Fn^va#?)@3BTD9~eJYpBmX}ySgK#A}(7IDz9NQtq1 z)p2uVVR3HI4(C*3eTnaazomHUzz}-^eg|$J4M&(e3HOXv9;6<5w2_#l(;vu3z9Z&^ zIE3P5(t36*+V+gRJ)JN9Mk8U4Q>P^5IDZ`SZ$YFTm|IJR4M-b%m6AQ(;^1$B$@9gr9IeU@dw1`DC@(3AiHie0$!&H@`xQ>~ zCVdc}YGmGynf+-XWP@Vr|FEm}a@Ea@kY>4@G4cUD2^e3xm|W@P;ra)GKrB3|Bj&+gUR-nqvXE(C_$C`RBjDV0Cu)_?{0e`(@w^M){VwQ|}yf?8?B}N{>fV|!$+zt;-VBY!k ztoS-mpFPedou`4cXzISg?QW}_?zdzO_9io~g6c~B3@!CrqEIFvu|$Ir5O0;#=hog9>z?ERqZis*)wgN}qvOZ1fY#L?XCw7Lb?hEXU2lkGSa%R@YVY@+HC z-bRS)t>5_?Ue}~mx6Yxa(zmt2+?%arGy$2<-*!Pc$UCfqPHvr>e>nmNk}|Lw$yZUA z5B4Z94*ViURCBCOt3!EYXS)FZz1PRUu-K8IVQYfBp5cxCYDWxfwt?Xlb9JyyWmdbS zaYvC(r2r&Q?69cr+gDYQ9;YKrjkXtlX;?cdOuC=(J^T#xp&u<`9xnJ%UsWgNe_^}yUYbfYz? zaYOEkL*w)T2^7(T#U3?jNZ_U>B~|{8iF}u*KB0 zdfb`PhS_=GalmdajMeZ{6?G>`YroU28li!&0XGJI_MMsA7Nm(9`^d0@+O=rN{bHY( zDY2;F;6+UC=1HNv4{HMH%7-(a|FZM{ZSMafU!~6P@pfK*&93FiEQ5nwF3oi=US5HA zgbJ&{Qd?*;>}6kRt3tMbyri{MTRuTIvKx|`db0y&Zai?*^-1BHl-wm_lCRrRzCLy9 z=h_>2A7|k<;YHsf_IU>KMbs{PmLNmR+SFQwPf~W}QZDguHYHo6qRYtiiu0mi26tDE z{+sRDn!3bLLVkF7_%D63!2E#rueqt8Kl6z9y$4q1exe!XlItg{u@-vg8<5RZ&B1@Y<4pkL02gedj zU@XJ8#@O1qSvL7%-7c9{zMCH8vK;z?yVK0fZ1AZ-@m5{Miswk)w2JQY;udtqq>G64r8(+; zYeo%P!P$9ul=0FdLRP}xvK}VWDK`Od7Epp$xyWnzc&fQ{e{+)g) zx7SAghhkKyCew@r;o7mDsY*^s(w*X9LMTY-cy?j2;DewhT6iHeX+S%k^eRBep?h(| zP7j|A8uQz3>3$K6v3IGZ2idEaAoe}+`wEzHb}wT@`GRfW-p1*!G*tT zdPA4t^t*VVbX1>&94od*qU5OmRah<5B5_E1eJ!m90X%77o#zXrEC{0hsXm`zCmW>G z|GPZ>2a^87LH!?gA^(@U$Z;-|SjY+h0GLcBWNjzzypv^mdh!Mcx$ys=|4-`xfK<_# YW02Vx50QDhe|cZsxg%nT_AA_5}9fFKPsl$12gP!iHHgmiZd z-EqhFyubIHbMHClx&PeD^T0FT`EK^!Ywxw!`mE1dJ5ozSi4dO_9{>OlswltE0RXTu zAMXy{zY74|5u^4?!aUva(ovEJl=MH^z&zZuf3E%<04R?oxU&A!6wh7R*b4w4`uXSg zPN!S`YXIODrt;#s9@t|08e~S^b;Eaqwp{aQJe|I5SexFfV{;L=KHN1P_W{j_*nfUN zdhcbgv9`9hK*>jmwN!!3uU_}=VST*A%+@6#6p~yp*U*qso%a0R%g&bZ!*VGDeZ$Vp zLJ&xE9t($umbNxr0jtK{VV;tRaJn@s#8h0^ogf0obz!iXXBrm(=xg&AHRR@M5t zL;8I@yahaukAuyK7ziE=5^7;N(tLn`!C=xubzb)A^Jko|5ALpn8FBM-F66<7wo}cN zBpOKh)-H!Vsp%j0d$SdU0%2cJN1Uggg^#GImGRC2T|L4w+Ttm%N1n=^FOzYw2u=bZ zA)fNwl+@6@u+mb#0nQ=jpjHlh!^IVz;*c0>`gJOSO?Sn0Wg2~ludJ6iqFy&k24mWNaD4M${Zc7t*yBUFo+6Pjq8lx$@YY_9%>66bSfpQ@?ehfYJoU- z-uM$d=x9huNAbG?g_E;0B!%)No(Zc+nfNKL_w>1*MF?AAQ4!R*zrSAtrZW^Bz-g$Z zRTg;Z>qG(EBQ<%P5l5-2{)Dg1!7%~WH}AM2ib_AYS6cc;FCE@~pyK^%h*dkKI-(y7 z!Z-VTVCQ`5wfEoxVT<-(yZDzlCRonGv>f_*aJV8cB$=6+S-IdMGlYlXKW{%0iF330 z?Uvb~0^7##=9107TW2&PB9Kdm*MVm1YH3{0QzGK}y5bHUn~x2|Q2MGrHRCi*oDo5J zG*7v^BU0uzXu~m@dFQFp&{p(~sI;?|458)3oJ;?1^b&z4tNy-xq=AXm@WKSua5}QD z*$D4i&Tf(^UBGk8ms#_-u~R%@0ebTZm5F%zKx1Bm7^L%&YzA27yM-mjyGlb2u31U5dCG zgY(Kn)p;JQzP{9ph;uHfSCgvT(+S`CAVPO-CQ>&(QZ*TXWh&QVca`|Tn)d`*UvFtH z_n{nEXxVRMLZMn;9w~6#|2yT1c4mUxTH;)@pWv3?ZjJ0&X%)r9(WbELTv>XsrnLGL zynv?>;^V<633erT*ARH_e6iwV(66h>%}_mE6vc#g`jJSn`8x-HvhW~EbAmYVxv<=VIxbslCSqGE*-_U&x`WOSa2>m0&TIW+3R<` zoa6ynQ|cd-FB8x)EsjHPX0sR`Ar+`ovmn+V{>`LJInTSn!w0w8agAFd!eU2v<^lzm zUwwto-~7-|Vx$@#eR9oqX6WxPJFqg?`}MPoAt}BMZ<<8Fj*9!9bvbp)>W;|XTqol+ zg+71T_3i0?MDVR#@KuK1kKkTQ5eSHV|2QclqBun}@>NIBT;L;?u~gNI@ij|9gX__4 z0&mpe!klUF)qbZQk$N~&eYn3rA!0p%7MZA5D6^Wn;WloV;qg3)uB#HV*cK}5rKx5@ z-l`Lt{G2WEgLk<8=H%d(wSKg^yN6(Y4}k-ZpCZBLOv~=B__uZ5?GxokEd6br{(PtIY*i+XG26QELDk-9in@^$wDqtx7(r) z6{{-lJVF8EPRc-?fKvvU2({-}O=P)af+3h;Kb!Ql_0XN+8{I9aQp?1xd8p%@>>!V2 z*$7qvdYJq~wn?W4n3!~tS@HgP@doR3XR5}2&9$nqTb7`@9&)Z#$9g_|G!xs;1LEnb zrARaka!p@5XxZIAAGQ@m*dof+kh>4lEcJL{&EGLY?jPVZ;{GK??Jp-L%ojspI0glq zQKiR}t)^^$O}q>WrGUBF8~S-)tH277>F}N78IU1?a9)!C0lt;RpB@(<2Fj_jz~*Nj zWBwya%w6EG*&`4kE!iR?%@kG=xuQZL4F9{E`(q&gTOas;`*Ifx@OIqJ)|Lg9;=0zK zrn9Lp613BFdyUS?$$_aYfx%$q0?L7*p*V}Cvqge*7sPw}{r&x{aYf#f$tq_Z;Ohht zTk?(+^3mCbhwS$PJu+fW%y{5aN3d{nhX|sRyt8_t`xc$D6ZGIbZ=5 zxQguRWt7X+utmK!P@Pct=H^BRgL&RAB>@I?{>BaC(uCU>mkE2}d7>G7L8dvv#m%h- z9JOC;i>z^*gNF^Zek0&Hp-4K8683CsB?B7FT!<6N~sLNilSE)2+^H+c$0ArN7C zMMXuB#2nIADh6`$HnGUbXg9n$`Ya3jlr&&|YH8dLM94;Oj_1mz10LTb{h?Dj!yDg` zdYwY!AsVZZWy-v8VSdE@e^encGlT$J*j@GQzd@mYsexNTNYnZ1H!j$lh)d806&6jA zxi^zGchF|dHhd={I5^in=bH8U$QcCZ+WRKH&!|uX4d)~0YTgnICf+@hyJ<)W6`SV~ zad){<=YS>n8vywenHwi@-XB$^JY~g}V$dIQ_GvAU0zF|L>hel4;vO8yhb-=I} zd~K_MFN-m9J~15JY7J?{b-es79%cKb!e$yaa@dNVhK*OmUmSARa9o53V~2dNGw=PH z#q1fVm#|OwpvAgN2e_~h?xRyEyL8$CELdAsy%lYp+G?pG?&IkScovC=%OLLUH6z{; z0%Kf?KPaqBI;@fj-gT&9Z>t(N>KLI-8{w7BQQ8jv-rX~>G_jLJD!U=9tPJgZ`2o$j zLb2?_P~F-$%-%`keKSFNz__Hl`Osu#L8 zM~DWc-7>jF)7e?SIl|JaCz){&7VmOpmjxO2I*<%>^%@(vyxAXJe4zqWr1#{DAeF2- zQgTN4P1>fJx1;EhzTtKTYgE8KEwH_mzDba5*VDbl_1PJt;|dUku8k`N?0#@FK2NVj@z8ZU+pMLj0m=rReRL}c~cw=_~K9f8? z?2~DD%-;7bitwX--q`uaLs|o~U)0Er>O3Tw%{eSis)up=o3HHnP|){UcS?8mPi!U( zQQIvt0jsJUV44R*f8p={)*eq6iMeA!9a+So1u{g0R-F*@p(aG1lL9FzAr+JA2rBNGirz3KR0LMcY==Y7}GXPhei;H4Bv#CGrh`2AxXc%wh|EM&cfXPVB@3i@g| znG2Ll{#D`7>@^SFFz0CIxS*(YYDPq$y@<^XZcg>t@wmW=c`07g(Ki9_-|ikhd)3GS zrh0xkC18j#(hqB{-e-#eap)d5+A5-nrE36ek%B{be~cAdR$Lo&Ri4P9{q!V98%>K1 zpjx@(AGrXBPW?=NYs+{hX$kK^Z5XMXoSX#ylB(qi0*Gb!cI6pyQ1E{a$o^%8{>y0X zpO;nug7-uZtXc*`?r>8}^1sDaz{M%ET5kqWKA@*=4$Z>CGAbj+#GL@ZJo07Dz3~$B zrBj@tp&=c|!2Hkz!RPTox0iE=_xK#&YSS|^GEM?GP~=je-J{dfB*8wH{!|H!5$P^C zXcSZViCZWTu|LY5bhSEm*DY3?tJ^r8orecT)KT#WHjpNzWY3?qO=TItWGJdWi0CHe z;^Io5XPIWp2#`0ABh}MzD0g&plvclvw}6NMwICS3$w5L+{(_~_y}Mg?W7NT!o}L~O zigUlQ>Xo^5;fCGX>T0*oGD*x{LF;TIm=k#rhVX@mKNWuJLe0`%dK ze^})*l}NhyNC$h;O5!?OW~SETsoX10D6m9r(?!Gy+cxsxZF56UemFSM!qyX6g);znoz(0O* zP@cS&ai)%EHx_AR)QUn5NQKW)(VQlv` zxm5EV!DQ?N=XXLt5$v2HMzqVMFz#}&sQpG68L9KRyda{1)sCyCzpJZ zr?I4$dwg&+TnND_gtfU-sR2T43na2$3|drz>H28`w$99oV1^-Fmrm*lD9FDyo+ z9~ewM%H}CA`xsFAQWo|{N1928RvrP2*uDRwTK(qoou8_4Lvb~Q^RlzwCm>kDvrb`W zXV0&$PRxUd)O|{wUkN_@$q2@aqxzbX0*sufu#ajdP3cbJ;9K|u4OmQSTwUz#J5|q^ z(^(LAU80A8n7zh;1PweBDI}-1EeA_>_#wnmu~GkcF@v$Nqy+B73H>-6@UrQ01|8Pr zv#ib%fVJ#&U>3l5o``z2a&I*6=gp83BS#PPn^GwdkvhoSxN=Zl$<<=q^5xIq!7o`W0EPS6c@B?@}W4{b|Lhue$dIuf^mFz(z8u3>s z4~!kU5MhRoD=8s8E2MraYm{-$V^JASdda6ojg%|g0geZ7()9U;-qVC%mkyQpOa%GX z{PVci@Xo2bmr3gc(N|$f?6E>}vADAmbIt54A1@@emWpYgTT1y&2H%dZ$>8Y1r8gefY>bpE@!h{%IE+ng zIy*Szlg&HOb-V};J{fhp+zmL+sP2iVv7Y4SyxNZ9LqoT2Pn%*RwhGnjFygU!S2JxY-qG(nd9fLW>b#Z-AC8V+eDNfJ zep9WGwIIK+40x*5?m$o-?X^cEGU=*)UwzX}${((zX`&W%_C8`L_7e+%GpLH8*5?t0 zlfFkw7j9?ou{+EgJ?l$8s`ccYK$XVmK1*+tuR{NYQOJ;okgMjjh)23xK=q| zSy&XgQ>o`E$>nrSEv6)wSMKj!ep%{5&8$)E?MctWYJ_cbJ39ql_6)CRvhGBdaY&ODmW7NvjFIF)&q9o zn%-j^wEj{KeO|pA4W-2|8O|LsseY4rguKt^Tw^6?YQR37o7(ltZ<54*fr};&3wPN0 zhgLY`4MMe)$l%ZgrxfP1nrg{HDU>m*k!LS1sNie7{J!EaqPF24e_%{ZnoPzd+kEat z3#Gco?_=Aa4i%{ORsp&aTYEbQcO$KSOSWjtQMHF{ecmGZB*#XPplUzt4bt>wWS2&( z;zyYLyQ9q-@TJQFCCB;t5kk088q2(#r9*ae0XYT|n~5tQtS=o%(I=_L2TQnV` z_r+P$9lZ+n96q}HO>@3F--yhDY!B_KyxU1_BLufTz}~=x59&4cT(hModvJS{YYr&I zlAWDOJ7@&mh)>2$P$tq#d-W>gQk7>id}wx4;H{E9J_&DmRl=lNB6n$Gi&WGg5AwZo zq2>2YOK{Tav^LEhF*Uq;Mr}RE8ko$_i=sYqD$EAuu_@0n39T##s{uvi3AUT5K)v)k z>T#bpz!oi9Ubnx@w%i)eCLQxL^xA%RgvixGPIJNxlSC11zv^By{kVg8XJUoRfDjF} zc#7|w+?Yx_h6O?gWYfQ%>FMyg(?i1h6?XzZcs;CFGL60=a5{wJjo3ZA2C3@BS*l8IMXs;zG)vt}8vKud0CPl}&W@r6njX%+*r?(2K+IT5 z-LByRaoNVFmAltxv)-XwqBT3WrDT`5I7i5*Zx7*9POXO)u-x^a?&L0BH+z0 z*<2Nur|2erW$^IXXs}7Jl4`!XuE5ELlHBplMurlZvAjDVxMn`-rQz)s*`+3ZQsB*~ zrtIz*MVI}|%uKh$KO=eA* ze-emjQEokSqm@MjIflgRU-k9qSS-XH@g4q1=72FDBfj}01dBd@62Q99z8Ngk+u@pm zVHSUBEhIex^|^m9WSmq&2-(kr~cj~ zZBIKotTiR0$vv~}O9=7_@qh+Fat_CUbz#B}S|6i3WV02E^tIKGJ+|5k5w+YM_=S~H zHeC7Aapm+Rc=Ty(lYTd%g_p!!@4>wl=qj(!q?*1=1YN7r<3inmjiN&Zohr63Mdqw7 zslzo%gCPXyj;N;VdhfS=#R@{kUDw?yDG`e)i};1tCyK?jspF%N#r}d4I>p~g84t)= z^U01=KEl?*8`m0kT-)l0=oC-6l|Ndk)vkh0=+;hph`&qb=;VClwDaJ!bC&BXC@Rxc zsK;ZZx~9<^oC1O|v%YO1SiAOqvN7iPj#9sYO3Sus!a03i4eWSA``GBb-V zoxdyG(l8owCsXAQG{tx$cL#@cAAkdq-Fh=^3>*iL@-A7*-N@+o&j@0UAy^ST5)Li! z51z359vGXFSChvxyDfV9rooptOI49KP4w%=h`%NS-{?r~QCcSH8a6-(H2?7f_V+%Z7nhWjBn6~kJ;A_a zAurrUk0nK8V;UAe-(AtUt;4a~a}7gqX|%w%8`Yiq%5Rlt&0kuOCN&!pg*{?BIIf2? z0aJwvri^PRqniCy=UK<`fj4tiyL(-HKTS_l100u(-icl}++Hb_wv+LKW53p6VF>s_ zJ^3U8*?{H#aO7sn=98F(J*ja^!n zzJHX5in6b-&*m6bIq5e7i-tFevFY3>c1|QQbX^lZZQU1t0Dc@-uERjjwDds z4wn#^2eOfG3Zik`kSV?PxZr_>zvqPY%sNH4h$pXZ zskDuaFv5Lh#BeJ5{hCRgCoI9qz-zTPPG=G4>gKd5Nzf{*@oX`wKTYaTSi~O7Uf)JT zH%Bt~<}d@p-C+8#>pJ#Zp~2g!P4EkOPjw?%v`TAqx4lDC_WVWnhskOeE|>*z%!p3+ zJ;{of*<>#v*z6hl3G;d47{ZLkc0)R|4m?fi#8tTeMoVk3&TB1!1;frstCzpzU0&v9 z0jjEU0JTE3`Y_oz;9zcTtvC=9z3fic#V74uc*@sR3A<~BifUSryYL`~hub!FL`>x6c%upFK&p6U6m;GK)_xpI$yZ{9XbeU#*Pljh~&i4kLB0prQ}D_B60T{Z{p^!h|sUR5$q^TYAcLwv)IPO$V~)HH5B;-MA2#*6MTENInbMjJ@J1%_bu_ntgZ$#d?3<(CogHt}G zZ{S&(5YB3Me|ipf*8X|OkgeyIL(8JpW7|!dQvmlGqTzO<;L{@#CJ#9$(~~V&D29@S zEDw?ukUn%*eM>i#+ND@KbWb=|wK8Bc@oI9ol1Ote1q0cF(Wq0zk0@BBHHn4fuDYJd^<|6muk^(D*F(&&-z!^8LAcol#`f-g`R z;OyCg(a}+z&30CeRCZW;XOsM|F6X%YFI31rN(@6x)x-5>uF;%3hzYeqwu1B3skbEA zX{P>Ib&5qq1ZqK-e=^L1aOm0M$y5KL6NB2bzVoznG-QK$$)2Cy`}`49^Fj`j+CAzn z(v~lI%C=k)bBeoi*OAmR3L$KP^7gs%PL=ULQDO{yfoHLBvNP2x+<}je53Z9Y7+qF{ zzi@FW)+%u2g_yrEZUwza{=APLFy(L_5Q0eAI9O4q=m`t+BtM%$2j%sWHX2Q0TeMm_ zjz@Q^*L;juqG{b4o2lgMX%-H_)tvJ%YS2b zqbRkjEU3H_khjdsjDCtdD32bzy8#6*dpze|Qy|T7`pBpc={Yx1Ms_BHG)%;i2l$>_ z4-30$BJ3f!@Txs?|^xo!2K%T zj5dOm1p~}-C*<9y;G|M6R$gOdiPn&s?d@h^mm<#S*7W|wxmOIe&q_grX^`ZU@VeER zwXQ9eUVRs7WlLtb*C->MNzy310w3_2DRO3;47)UdtTt_2LZ{5f#scf6_Z$HI6*>%AnXUPl+SFKBad z@a2(+4VmO^IIB5+aC2olOP5%_bj}z2k(&4(CwyIoS;D;Dao_mx^E=!VQWGJu{a35s z+#0Vp=K?430)0AXLgPKoXM&xU8V?w3n=bdqcTnaW0pZ@-G*BPAJ129xNz1t}ceYG0;IqgLpxid!Zq^LF zS|7b=x(?p_USt`3E&-FfI=t@pEf(j58Qm*=gTP-`2A8`nm2WX8}UoL3NV+nIEIcK%Jlim<9?}49gK8ws0-)ZxS=s4Qo z)_84raMr}?qzY?0l)fu^*v3q?@Ei~CH>0HQyS=ZdU&n7atkLC`z{pihP_I+oFhVmd zG}N)aYf1x` zx;O=6B~8mt6{X=&tksE=SM?vaQ3Rtf`MUKwqG_+~v6pNN7Bj*+-9m|QyOX8U()*AvP&KbNv?O z)BY1(g?vVMT8airM4sh@y$OLleI(EoP&1P?epTeP;WNZzeeUgxrg0gcjX|q2=|TtP zy8IMx!&sU7t2d_m6^zh>kF9$O2KeYUtl1uAw0%v($`1q0<5Gc6_i5XVBw$LVu?yyo z+tcw1zMbhA(*sSQjJ%KgkDvd%I+f9QkS@{kk{VshR>d7)9Gqu)De#l5K>3mScVxAz z-_aZC55?AGNfxzc&BJY2WnNvCOk_!T9BE|}rmmFzNTUE|LC2q9DZ|SasERi`wQioJ zsmfFbLuABHpMpUYj{2Oa-J%K5LAT^bwrcCWxY7!KN~s5MfR;IV{YNSbs)4&())nT` zpveYxH86RXXQ`IT2+;hs%2q|dzX-F_{X4jg|_1~cT^;`Mf2O&Hf8 z{6xU@%3wF%btgskqoh0ET14mF_)nTSl2>g_U(B|*o6x@b5B&?Uwnn{6sPacBu2PMB zMYBvb^ZIvnaQlgpO-$o1GgDX$x3Gw&>8AV2buF{7VkN%Fms06)J_@?1c!w0xZFgLJ zS7oaS!QBFAwkR zCVYLZ)G%;j8C8$)XJGlNK^^@mn#$z$Uh9&Ow0~_qaSwrIr#F<=+(Ko90a+g%%M?hZ zI^)wDCNlYIzw~6;JU6M(qrkW^+8>Iai~ zy`8Ld4<_z8Pjd+(&VIt46*>96uU0YgHN_Nd`fHc19l?cX3lt01d7QHO)smJ;kZc28 z4L0F4xsrI|SR;>_pfk~oIweG~lME{761j9}yopzcxG_N#7e91#n5%hVsP0qQT@MPS z2rpEvC@8O746}>ypI0=NG}(p~)<>04p*m$iX?EIeab0Q}c8Iu@s)k9QnB;t~+G=4O|ZkR9DU5 zyKHJ%xAx(=C@!CQ>)nzR=7nN7ilf8Lxc7ky@=N>bsaMqo<5#bstc%&P#WrQmUX2BK&?hj`Ky5Rx>d;0kmFm>%wKpRwb~b%QXY@; z(>ifY-)u~bIow2a?`GU?FQ1<^*B*Jb;`Z4`Fb{9l%mv;C7NNhERPLNwjtW-uXPcFa5}@S@b<%J~@p-3Thj>STD>xOTj8dxa9PTqsJf<%tztmZiU$To})_zr)bA(0k#AMrxF@V91?aDym>Hb`U@WJb* zt8e0@H{t#$%OO<>Q3YV~-lL~7{@>=g1L`uU1;f~!1jnBfUVk3MP@%99f_%~wS#}bJ zmSRcTYR?2D6MCXl|5?;giSPWT@Wtr`kSa#w3SYZ!&!4;qO&}L5{3Fk1F4;dywTGU~ zm6M03g0VbsY(KXxr=kGs^ikcB1^ewsUtV zu5%_q*BboR&Kg`E@$;_nXpmt%uO`@>;5NXKHE%`XH`dp#TfSNDJn> z`XGC(Y`y-c-cBk$+}^(AU6|!EN3m%Bt9HKdHGH{ad8PB+;t#v#GHg8f9;xo&jxg&$ z`n-V#lT3fVgLU}@lD9cA?lqd*N+qW|F1m+W7f5y)Nq5y#B9Il<)Q+?17v6xV575pP z!$Mu3?UA3o4DSrjU8AUfw|o35uJ=D*P>K4+fFuQGozMjXHYY1r&K{Z;raP&52hMV z6bn_i#zaqM#eDJPTwl9$z}G)(_={INEvikgvZ z!^RzvmB}gO9U$ks8??iDJ#7BkL`7~+R|aWULbLXa{x{5~^J@jyNLPf>%K+mT$?Om2 zs+<_``QVv3+ZzkH=T{tcW(#>144cM#?~Y1lo6gT%Vz5sAc__P-2xjSwJAR$wWDEy>^9Airs-K9ovtRBUkA zh7ly*fPU368K|#oJE%$%SI@3e^ko?E__zq}&`&g7yEVVN<*z4Y>(_uZL}I0~}a&nw;>>K2FiE@4Q_G&U+=Kh^9Y1_DzIDJfM*;rB%0Ju(`$|KC7Bbh;8&{ zuWf+p!ve=Q{gE1{fm>tyPGd!eYfE=rjJ3CkU8XdR1D84(O^!1f*2eo~ehA7J+4wqm zzvnP5@%MEVa-HF5GE1FthHeja9yqZhugJyDA0O9hNVSyx9GamMhn zvEed?<9t@Ztaa~L$erd77>O3EB==Bxn&>W+4APt*TxU-mXoc^mq$;iJt7 zubrW?)-z{|J3WitMPlgbI%(#BZA}-G8b>7(aM{n;8d8GG>p{#df|+t%Q^E|IdE}pY zfR~8Ng(dZkoJ3eeqZxZt0htzm$vlh6^~C+Ht(ZF4s5_a-e`_n&TgX4G#|bBW?Onhu zpx~Vd_Mbe=|5>i|@4Ux9hUNcTBLJWmaEBUG2lL?JTMQxj|MFoT>)-g!fB*Xy)Q%~Z z8pf3Ua$o`Wx>qsRY66uttTBaB!^<^MrAQ2U+Rd%m1bj@J-UX%_1UNU`wQm6Vq%7zPWUP1 z#-TKGI2?z5v=-!Y_c5cyAGk3PpL?gm5G$Ec6*!+>|Fp25U6rTXbDDZ4)+n4~J9F7c zfcpqwkso5+K0aeskjz#V?frb2^`lR$#hYASx zC(Fe_Um!&LXQyx52NFH`slzq7+hom^GZKDIVI;r_ykHryk0Gvw&3*QT$E#gTEjs7s zGH4SFl)@1n1@M5?y>4K)i-VN~%6BcAC=&?Nne`L3d$-lTrJUTs6ER%b;^E;cnr zJk5S%!%%V%@(eP^!Mib$9sMKhhj4;24M}Wg_h_ULGTcY zvFzKc^q&rj5N7Cs&mAMk4CZrksaaGB(_lR7XDQU zcf_;T>o)|(JXv{pl^u~Cn&5VXL$~0iLPNp_+3*C%)3{J%$*&lAw31TvB-qdmaE_Yx z6VSQp>cT11RK;@+#Qd7?%!kvGy@jNV=Ykc6!Yy^Zt~kGqFR)KN1Hj!isBXx`9WAUk zK0@f?VJs-oJ$)~PnQ=rObbU2**7FlOMG$~8$!~K|UK~{esY~$95bBN{fiZbh9f=u< zeQw6S6~Oc_8&yZ!M1RMHE$&n;YvcfqMVRl$(htOaItA-54>^0zL$Zrkj9DzyiBzR~ zP(Z!>X{)DjujE8`y?iqb3+pc)u!vrTszxC}Ch=t5^|ScX0ASK2%%X zLaCdbz2{ta0%tKK0n#$8CieToh8dit&0FG%U#BjCDzbuhKy?}SM!H9nEe9fDD`ISe z4>_5Un+NR4OXq*JXg-*Fnj^*$esdbySop%n;z&!QdqkknQLmGos|f@PaPGbz>-D00 zT!8*t!rAjoNu9=B6+x&fgoLp$I+Tm?EiF;A;!lArcL%)~Lx;292a-B)jXxt$Q1;Kw z=%q7UDbvbCk?pMv%GLE;8X@zdY(3Y~=ZhmzwBSF=vseah-Wbe?5 z9O7spu=J}wTy^aLym|iT?0&HPMi-ZnFcu}ZA^1d{Ogkb8_!6-f8+?_MP?~dPggfq@ zSakZ+Opyv-_%V>|1;#8aHE>`KY#t}N{hYpH$e{;UJZHW;=Z7?4AJCft=AsGI3XhG3 z|1|j7ImX^2(zu72Y;5(AFQ?pBR?S5vHASDZ`>rFx$NfDO(tTZ2I)am6M-zGrUfa!) zh8Ex-J$Q&(*<+1oG-0Pnb8B1gT{xtr@I*8w6rjG!t4hoR0B(4MKZF@*upKd`5?m4O z`r%)xqJKm`Zzoz|$=;^CPyG=|@AH>RDtb>{^=~-@$^5m}nT=xqvMUQH{wUc(C z&Dk&VN70?^5*t|6%~}AeD=HcSFGV$VGa#J<8y#*;gr9T@iTb4cPu_4Gz7n?aB3uzx z6qW^uHG5mCacl{50CdF{j#p~s6I8+1aU}v%nhq~x95ekyY>Gxz>j*sSRXXb|3JMBJ zF|%3ha{=(2$KcF^g3Ipq*j59$PiZ8~x^ki&V+Cp7M*q;WoKR3p(shfJjy@<*6pJHt zV~Rs{%WISjpaP~arIey0Qiy{}X{vV4N&cYeXoKA7C!PRNb5$gP*bIGte148yvIIav8R1rC~!E4Yec5iH|RJ@Z4BSs~Lr8^ejvjbrC@+ zm}9PL%$3o)$T`k4>#@>Wd6%Rxc$pNKwQ5I7M@j3~@utI7;CV86sXg8m>NM&)t^koI zZqHGNiN8!=)yFBGF-xX<3dJQcJW5~PG!Gr3r4wfblx~Exfhzp90g3*~STZp=K|P%! zIVpsvjIT_xw?8WCa;y$LyBg+6K*0&}AS*kLR_JAyd{DV}?I#AAZZ0i#S_5!hG;q26 z?U;k)XAihPC-DS`dQ<2bWjF0BJH&6MAcTJ!YNn1bj91ujd-kc(9(1Llxbk7Q-@&>dlMjCky^t+)u98&p&-gduIWmT&DH{Hp)dH@sv+SH0F1`; zomh9*J;1$rJdpJb$(!AS*w{rbqgIbw13BW^O2_l2Tl;T6Oip%U=^ZMrwq-8@))nEZ zH=3IEvP(bb1B)lGDg)5_ACJ5kujfj>iMm{z-`;FFr6+0@E7$E=mp+e{x!$m}j5e(d zdX`k$w7y&IdN}PScbft~IltH{3G8sOkU6e!d&D7?b!gcyCzASYXF)i~cwYSUj%t6! z$8U32hg%ZPq7qkU0|sLXqTCrH^*Mw#w5Otsd=q68=P16?m5N?2XW85F&LXil+b0uw zMNd3I8s68Mu_2deyQnQ(0C?_?j5Jt#VnPFZl~WnFmajy zHdXjcWhintG}?Z+9+<1C|Kc_er75}|h;15{%cCMPSijOf$AsdFd1^<_#^isTKoN45NQTIgG6@6jk7mM#s zvClw#j8RS0ITl=ZI_fBj)dXha31~*;O4}4J>iDTg#V$;|mqA>9U>knLu>Ug2p2ePW z{65D!NmhZR8=fAOdK!{sQv)t?P6r_B3xU24oa76`iw-#6)Y#iE-(Q#*28CO6b4f?4 z$LSmw1%Ca^%R(^{uA=Tzp36qOWsKx7f4SWEEsjKtv13h{#YfPq2S%R9Lrh3m>a^|a zU=x1`%T=>14jhWu^S0Gj4>0HR+RA<2dh~ES_ zs-5(jibErDIjIs}{^NVthX!I;Z&bT<{XmV_eu(!CRi2Wq{>O%*(tuQsO4a8kYG-}Q zC?PSC=i*b}o|S&|H+cf1W0I9n1$G^+Osov}6s3k;)-Z^Q-)GOqM|GZB9pg(DXtQVGO0&+SSXfEYsFaCHHp8|d}M~OLqf=l%7nOg&q6i#{RCBnQJ#xjn} zVU8NU8U;=#?o)%Ni&9lNxW7MAU?1XErHRd!X2c)Q&P3gXfAZOzdKOOK!ILvy$kqwB z;O#y1lVxpk zRZkU&*+s`SXclSs15-NpAl(Z`Cml@X6cotRJc8tHf+#+%#~h3T9s_0|P02y)E!MX2 zA3{RXyN3?hd<21+R{+Dvnf%e3r21Jds_fCwh3g2-13IBL+ny>l_{ZJd#T_X~O4=5) z1@vA&_2j6FyEliaa2uq%l0!zCbttiyVNuZc%PpL4_*Lxrabz*2ZvEn3CuFT<#gBm6u6lvFaL4 zOAW^pFHQS$)VJL3=V%@joZD~WJX6q5`4-<gTk+U0iVHK(R!9l1ta zNo?`yNSE#o{l(B~>hU3*EWi)f*~71^xuB(fx~C+^zBfg-E&}z!1ZD|hOX2@vc$&Lt zA1GuuRr^f>YW@aBe9lL+#osazyg8zsC-jwbB^w$QI~QtfBh7kP5IULN*w2f~d%!3e z@0&_^U0!j!>=@|hi?n1nXPcgC*hsSUbCb;=EqCk4^gx;WPswrEaIhJQ$I_x3<{y?S zke+HZCTNcqpYj8f-t$e->9^_`&wk5RygbVJ@@|QK{oxzxu_CSSy_M$+8v`Zrto5gP z<1`vG-CYL7_K_X0jqVN#;)_!(o`$B>CracRnO zICpVU)_`V4)lw>hvx(CNu>4J8GXz(3fMl+C_c3TB`IO}7g_L!sH5A0U`@h(G%b>WL zs9khOUP6EX2?PipAh-p02oNB6aF;-EcLp00EO>B-kil(&y9Ad2fdK{`bZ~d)Y~Jtt z>d37+x9+W5b^cs_&D3o6?%k_SVnL0(gB_$S3$d$^xS2A-|9p-{64;K1wt0>3Jb`_#@QAqwwUPGT9B|CAvoy zfXqUWGuKTQE?&CwH598-dAQ9uuVg63quTuy_flOEvSq{R6}rjTh|JSJXvk*n68j!U zKbI+vH?8%Bg@x5W^K17g^|D>>3OqzJGcyeBnxbaB0_BN(yfSt9r0WwWyVwO?5cYGQ zCgp)m+9xJrww9 z(&lWXa2eJO^jrjt>Q`VxQLkD!tVjFyM#L(6bc|}fc&rVJyO7Yyiq$}jl_1*h?w<~S zGcbEngOUZK=jk-Q%@Zg5Xl?ZWnDDAPgTh;F_NEFt@+H7OhL9fw6$v@Mj)=$ZA-3jz zboRbtx$uhu2Rw(7nHfI0wYNh_Krbr%mvWYHs>H0WQ2rLcWK3w1JodyKlC2oCSxp;P zN3-mn68uwEb<_M)K!sGOR}d>(1Cqbix?d}-mR1p7h?=Dhx*e$hb@HK-CxDHNHiK}r zr_z6#mp5}>_Nes3v-TMgPoJio`21mtO($4f=BsVF^aihw=NPvyb{)QcKFg;&g#L2PdiiIe`ns&_Vwszqdr04 z@NBrU%ftqlA;``>PP@HmFg_S`lOENi19kf|7a!7G()l$w9pM_^9AERNO(~RxxONCD znts@@9Yq&WVy1hY2yJMBI9|0g@^e%Ii| zu?N9d(Gum|rW8l!h&h3=$s!dh;$DwkVY?RQ`SX!uJ6UPvvz8f8=Wk`gc@_d6(7aM^ z-xld_sI{z75~$Cxvv9+NSEF- zF&9l(>zvWG&7WVg7X6N>6$P`uFWR#gjr~|YT))+2*V}Xi%t@SFzp$FH11vNp>vmt+q|Yp1+(H8{r29^%P)0fd3RDC4zXf0 zO86X9N^I~6tz1e$6+=DjS3`uN;-dsQT(h{Bw^wGN4+49I}IEuUYon9EJ zdcw-4X!a7e!p@HtcLyIqtFqkP4b8VIdL>Is*uss;UtPRbpNiXN@OUMf;^%ccHAbhP zvY?z>Ewq#-wH{E(Gb7^S{yDxmG$x%D!u{%Fu>wz<~j_=7n z+g5gA<30*BM21SqwbWL&^HwDs3%^*M_60wE7-)vb3%#K`9DGbn*}@bV!+`5Runt4k z`+oY6;`9#7jN{EWeudt^i#Kw8XDBi}Oa%MqbMH@oiLG3R-(wPM)+CYuyula(TkI7g zboLhx5`@d;lm_*_@m`V$2Vuq@5xLVlc*pT9w~rQV+OL>vcM?jI&!V8)YEX~o<$_xL zYHo`i94k|G`uyHo$j8O1Bi<5c@XXPm@>IubxD4K4Q|kzGYU!}S{#uURX{$V*+P#g7 z6!4UojvY|nhv_xA9aB?w3^qkCxO>6lN>qZ#x`SM02ZBd6TKuOwuEB}Pj@_ip>e0PV z{TL2+VofQ8>!g~=O5~BAnc0F@_WD_d*!c@WB>Gk+nwt@ilY2zMeQAs;<^-Cp*Qe8y z1Bb&k-{_u?uoki^w;39IWd{T&4(7hjHbppG$?YahMBo~{$dXQ`n`<^a&lB5{ z73Mp}rR!_-S(9jO<-6W%=vCtvcQ5uhGrXH#BCzo5r2a@wF&ZsSN?>q z1KiFe=BzCVjJ&fbp&G}#Zt_b7OT7ERq0)S-At3IUh17k+C)ZVBZ|i}DSiqX0C`sOFd)=(55$nRud_2u7 z>-?u%V`i*4A@2)zCw{T=J~Um`<9>Aw>S?_?x}($LHn_wh*>be%dY>W=1^d`jKdzgp;cna7r`H<#-iwh=?Ir4xRK%hY&eM1> zR)fZ@Y|r4sCG5w^sBpvGDWu7#>6y46t}&@%`|rJ&4XO7;*$oz6iZuT68j9u~?9Iov zWi)PcTY?tk$qsi_#W84`=3x-TGI(<6)yO%pIz&}P`SwuGG)KyaXGOR9TV2+!q>g^# zIqhogTt=D0|KmV=%FZ(EbH&O$u35o8^m2@BYW2ig`K6fV9PWjB*p& z!LJq5qFJ~w)vN2vs=X@iu`!3!u~OMQE9)5HXq=THtnFJL$7gfUUU<^fMiDQDBPe&6R|pM{mA@mp-p3GYEhNei=xu9>>#I1*GG9DGh?;R3NJ5y z1Qr4I@;mr@coS>g&b|b;Q}Vuu{aowiM%;AQQNV`_%iy%jfc&mnZv_tYk`F$z9OTt`_+Naeuohju!kdqP}-uRJ7@bmeqiC~!Dx z(q|g;K8;7=BCMpCfjWX_VB)+k_%Dy)Rj9SrKquv7P)?G}&jF);st?q=Ybr~z|v)%C2fm)DuD4|6o< z#Jw$B`BMy*6U;0GE(Q7NA>&($P4cwAT|BS>EO@4h2z1+GF-JOk4j2R z5Po)@?T>?tyu4kwyDEGSaSim8o!ylE%742Jxi95Jfcs zE@w3}-QdUI@JVrE_Zl`HskD36?WiB4T(?^-!U{l#Nq#$i&-& z>AD(I5c2xHp^iaru~ssD#x;!Z@w3g)R%_8O(eJdzpv^8!uhl?zRmab=hzRd*5N%=N zHbz&Yy%fyu6X@NEq&41t_apf`5lYW+FJ|r;;cNcmG8co&s`|2bl^-sCf7e82H=fsu z9n}X-B;9Q9@46QAn1iij;NhC6;6y@Ro2bTl1eH0@b+*J4&|7{WwAA7Ae+>_(vVpWe z_pD<=Ksj&gfE$H$e}kmno^ERL?-x{T?M#(gLK--PBrlrMPX{=dpx_SL>|2y8t!Ca( z^`{Y^=isJ8$WHmPwW4|8NHGD_L6yLUrLs`#DsVRHs_I3JCLR5$L#P5|z0Lp0>8{lh zhdYbtw?&AF@$Vmlkfk*nT4>fS=S)66SxH5QBNn6x5k!5`;m*V~pw#Tiy6V+<;AxdA zkw_JPdXr83Bp_c3Fkcn=;)PTMhsE5icw5tTO61m8dmm^7jVDevm*etlggU1?Q-{S`60>90&uk47qH9`Pf7vk;9Oq&Wv| zx(c7`kBq5!);b%#yhxvTy;L?g8cndt>$TUn8KHgR>aGmK9*SXisCFhxGg2EZ@`LGq zu{A6erc0_S&c*f%QNhU&`(rVKX84<}Bsx=SSi$kFHhtDU_ni1&Na6g+Ya>aS6LQuY z=wKa%(>FrtCU6Y)vsc{qmM^2$@3I^sk~yl*@x>@adrJ^Og2&3eA0Sjd;RUA`x?lVQ z%lMJ(pRdR**Y8-8hpwjmUn@zf){ba|z6!%*Yef4Ut=_P%%OWGfH*AFrKMx$8B$999PVXH_YG z?4wv(ZZ+FEMyhnVQ$%B4Xponnz_%g0Fc_ zn|Y4=1otRY)b{A*{viX?w`fmS{aW9OmJyybp5MAtO$697*Bp9FyITor!+d|JHbp=2 zW~!-+8YZ(E+w7wh2u+nsx5T}BSj8ddIiW#x;cGZ<`qehUes#l~=KSN_P=!u{YE<*+L3s{}5h#ZPrk z-88nAOB}A`MsKaUR;Tqj#GTzTdQQ*{?J=~N%H5KlZ5aM!cS(DF6XvdU+2xuRF@E#2hy2c%wR8 zw(A>Ll9+shwkF5EthE__6;0Htsi~h)YjX5af8 zvxxTpxWY=YNaDb0|4fsC1+W`oPK9X6sF^qeilZ7ru8&aFOL zN&+uo-Y#!m|IEnDTqV($-{t7`=15OH@%G=G`kL0oG>h^mI(=3BK{4T!!gcHLDy#sm z!Gj%ROOV0TN-xOXLQOS0a1nTIhJ$%+u?tbtth@GB;rP@aS!94Qh+x0M^s^6rMn+go z>vVV6xR>TLNz8O(dq+rh1pLfzOD|* zIob<;rhGxV+x*-LYxxtngt^m382oD~~Z9>#5%VQbXrvN65>gHOcBd`?o8 znrI*adgA5xuxY9V8Kk*!NYxYKh*xa;w^pMONAJ$Ne>kL@Ig+JK%D_f8(8=9Ie0g&; zm(xN$M%$GjY{}<1Z%8jw`UiuU&v9D!Ltsn!)t^&_QW`p@0+W%+-RWf=-xa(113Wl6 zvIR9hwBCyFxid?A9rNNQZLJBheJDx7|ivEw2vAoYxJTG=8AD3pKTQVwy$Ep38&Dnn;UtaRlU&SCIL?995H

    3Sm{dCbUOS~znEb*@FK#^9k|MppCQQmT#hAxIj zgolF)+bDf#Hv0=aVGs`{5W{SNQ+05SCu#DI)Ygc2Yl1yI_Q;+-ziRGi+@=8iyGWIK z3ISQyfV_w8#{bi->kwH0fW#aFxV555DONX@<1YfX5t0Am++IF%x_#JJE=B>0)l?4| z+h*0L?Wa-?8C!lVw0i%C^zVTTH3)(Ca6OXopG9C-`WVzs2E@%IRkFqMzyKNp`Oia> z{+C>|)g{^mfHkC}qay{BBR%B?@qk-__J1T%1vt*ttE#I*fyA{}a`g?!7d1fG2rqaA zq>vBx-hue?C$V^JY7!hjnk6X?#sM1JAa~?8h@61Hb$ys3QNFv1G|C~;5J8y*y(t*^ zwL4ldGPhDgS|g$EBFe+M8qTll@{&`MHicg6eO>mlhn_D_q%S= z3e=38*7ZD27j?Yb>9?QtO4`;n*RyJ>6%T$-Y&)KYan11T411F1<`Jm<_~9K%NrimQ zb_NFInP6(`GJ91vh!D35kNR}Yd^qCI{>tB0^<-lqo%uiPCCV`u+D+6i0{{xs{%%E> zX8zsWRp>C~pxQ9U{()_1^sdmKDOaeF@KLCiVR%YU)hWVI;^8!as@5fTzE%ceirm5@#R;RisK#vjz`zO5x8@dc0pT{Qf9 z{y)Mafrc9Zvf0_$9OgmB9Ru6b4f-BY1MMlw`YeA+5tD^ACyq+)N>TD3{b0-bz@* ze8IlIo9}4KUBs}O$4Xap6~DB`=RDCN7V`0h-GVGBMjE_*_^EP3tq|QwlM%r)#r-L$ zS!{Vn(S#>n1P(?|qso+regV7FU8B1^-AX#pUu=IK#!^QIIXO8OH#hi97eqO>_3pD) zS#hP0Pl<*U8{B-R_O=4Dh_0vH(_LnKn(DN)b2usP`KhL1;r@E%F$0HP_R0$7^DeIP z+N+|4Y2l)RwbPW=Z6l+Nqh|3oHwSl4==$MK2P&nT5ZL1C9UVu>qA!)$VPbaS{^5$9v*ZKh0 z-Vxc{(Abz(X%l5J@H)MASE$CF;`lY^pvhnMjS28|89qhH*~S$-{%9+p+)##9uusQm z--9BKhqrZiMrFn=dUH(ZeugcAWUand4?>+&%XPMH?2}xvXRlRKD0MGzoe^}j66eRNtfpDdzLL@ zyEB*FjjP3gXZJ}~XMyqnAd#W;|E1TTHN_V z=gI0e!FKapHbq%R-cyQlMLKy}tj~e=2H<@HZ1P{74>()JF*uyy!DMv%(twu-c_IE| z?*FHGstZAi!a)C;y!clNcywE-gW`Yi5dV4A|MV~a|Cj&rpZ_O&#}^nV|F?f^?*KsO zgC;eAF#pR1h=a?@`yEK=>5-b*0Y9kS@m^e9{Qc?T>Y8^W{O-nH;6@knocH1bWLU+wud1yJd3LZjgu&ytUn9*}5h{EUnr2J}no!0l*1sGC`gN;<0^R6=PqZLq|8UORc`wVx)2B?%a1|?1V_q&33w7eq}DC(!YUe?hm#P(u!o!9=ze%?Df!q6 zTZ#XUf`Qzj3P5dJeQ0^WxhE&zUyeYM!bzhrl$nl6yfdXki=e;XpM(&K^^cCK4n$~`8}tu0jE$*TcVJLmTwkj@7T_}%{F5VW-MGG} z4)&vi+PWGsBG%ES1_r_{1xXjZcy(J|2(hy(r?Gl(&h|H_C0s5B0+OB|llI~nwGQRT z7j&VLD5HZz!#uUapt#Y$f3WiuGoM7WEd?ihU+7%9c<~eq3xK2pB{7`yElC@kjE#-6 z)(T&M(K}`nu&j*)hZsnPx|!-E${mGZI_J7gt}mZ>HLwCgIBE3D!3kC-fl8@H;fD>3 zhd)t&Spg|o-$1aS%5hPKZ_U6c<_|juf1y#iLJ`-C!*y$Uo*E@KRKVkRQeGT!Tq97* z5Ag~6goiIA{J-{^y;;&l_DA*A6(=A8i%UyvUEUmW<>Z8`(DA5!1OS$Nr1V{>S#0qm zrY{4*6f>{SetK( z3Z!DSL6(?o-?fw&&lIF-uqxbex)zGxjM@E6W;X!$OHNoNqXO7seu>xysr=L}B(=vE zXH8gBPb_l`SK+ep> zRuF$viz_Z5qH}~lHqKWA%nlIFlHrE|5tY{Ygdu+>Y&f@-k^~>k) z9+&|kxr!8@UW7~Dp%K7i98{_8ixW7h*;g9q(vzMW0UGRgz{v2*0YK=Hz6V@Ua5b6t z(;+czZ9{65HXSixqZrMXu^L9n&2CE~wi>-B|GZA%oeA+i9C-%+z=o1O9kw0c3#uGo z;f}__Y%8RRS}>u5gXVH6_?f9iN}2hy4hAVu?BA*;tM*~=d>Q1>L#wUp?->gw$?l&L z@{#Kq1>yapmcKWd^97`+3s*@v7z8sNFW0E&xJ>by3ME@(S}W$LYFTJFB-sC{;1v=h zpa1qTXY{r0OAFE}r@NGKw_o{^Gypzbt3;c2op*+VbeTzEDag|N#xC~pyA^(&{*Aux z^t<({m_>EpUnP>6o5SYvPw^)|RSx~<^Z-=iY1N~_&Ge`5wo=F0%$qY1)H1s2FV(H7 zd1%{wzRPcmow3GX%b=y;y{onngDH{(Y$6lJs&%q7e;z$~!jUGQ8`)PK#FPJ*k%gNX z#y@-TZ!^VNdE^EVIg(&VuynKC(v20OiM#<<+mV-K9)I+MlBa^q;QCf(vV5TdlEXQF zeQo(7YapJq?YF!y^#FH{oUnsN2Q3|iCKIfkWe`unE2$tc@+{LZg;~p!|H&3j0cagE68?JT@6&F+f>>em8&E1P)QqTzNa5#|o+y!$_o#h;5MSP$ zFm$DJ6dj9j>^UoH`(q9;`11?|jFrto5Z)y(?hY2djdnjzOc}PVHeU8UC4cubWBdX~ zYgs}XOwVK88zp}ssJlP9=!j}{EBKEF;YSGk>t?R-?swu6tld<6RC$fq+w$I9ooG+; zkP=5edOJeu#|3|i*Dm9j<*aeHhhf5W{OIQ5l_>LSCyn$YCgV`7s7G&A+CIcDf4Ann zD=!#rd7b#G#r)%bv&^otbq8Et#*x2OPvl3<-*F)Ma8qRW*t1=2ty{nQ{FZPgfy(Lf zDhwLux%)8rjm9CRrKN=ig7pVpH)Al&@Ih{)*Lc}7$75DMORag>4@$`cE}cxSRA10R zsinfOqGVX;9#{+?%&?*=xu7mkJF{rE`;S6Vfoeuwcy=wFKSgx-EtZ-a$he!;v`E?o z;5I?>iYs3>fu^yu7Pi*Cx!heFXjB>F^$$$+da3Fl74I=u7!>LXl^iadV`T9`@evYP zR=#5fBLI37PcHIKs%5m=fIU}$fp8*p0l~cQhKcS1C$YBrA<3l9&)ygKf+{_MBC9eN zNrp=TGb6Pt{Dl-Yiyomff1gj6%NZ=A8x46D9`csSQLT)#H;IZJ`a5kQhy*7>M_57fUKFIVj6)2E zgO(kSxf72$Or8rezrv9bVKELMC}tX_{*mZ^*iHP>s;Jc^Hy)u}bsW>)SHjmQ_;H!= zKPSp}OVpRRgZS0Hyg^T9gelG(+{jE|5E}#!wcwRD5j|}d|MJ-2h zg*)9;!DVu-Y2a+Rg(C!NI0X6XN)Mw0oD^fs75;l{RjAouVB8v@%sjT@(K-G-Zl$wY z_faOad@1;N_D9b%*wOD*FY5c72K@V{qDzGJ-s`+Jp2Hg;d?pvtS<~l_}>dsjy~b} z6^!FmV>bK2(QOGw1m%xjoyoI2*tU1V4kZ`^NNHay5+M4>S-?S<0B#D{dM~m8fx!O- zwEw@`x&`zswy8c`;7ITvXQ=;gcibrqptfsB@FqZn;XDRZ)oL8(^#+=2>FwDx%gf7? zxL}{I&vv7uqX9UzRWb$+X&1p@65C2}QXW{p>=U5Vt+xf7!T=^g0-y>0oxZtNTNo{E zyV^Rp2ezl=_=?R~9*w82&dp(Ba`JA^vn`%0$w`^t1>4$*2S+k0HQ9p443wlcQsQYG z$+-QI$3_j5gkZ_W1PX8gl4^V^@$|dFMLl-n=L0M@NG)#jYV3dI-mJhwv{F{8K;@O> zv$WYCa{)b8H(RUFlaS`S-xyx8z~gEbL8Z^A4b0Z;kvYw}(UvXOrtftN_cA;(G*2S&n8yHh_y~>TW4cv2nTWjSd2=peSY#CMXgI<{d5o;8iG)m>-!}}obZoq3 zKJPwBag}kmQk4mf#k%w#Rc<*cV&Z+@f|gR7P31cyX|x255sOQP&G}RI38HFWz%M}+>&lDUrxJHMS$A!!sgp#O;km1#hSr3>geZg-B|2frTZu; z81Sl0HH(>w!2fwy7zl=9%aj?fiG1{HPW-Z{lsw|Hz8xNPRp6rW)8PksO;{yH8hdYb zP}1vjen8$`w0Mav!H1VlQC1Q4)2Q0>=%dlT>7@aWFTCT@ncGm+Y?6lK`zyALN*8nG z1}x~m+#I*Zp{lq)aemIr^5CfP1?^gdx!-T%b@bM7sTCCbb};|rsLBEMY2piDtaq~-R!oqDwsltPtV z2^=N`JDN$f29GIdOZ3JkJDoc4af(uJ8-Cp+wZ`NSdSD;1WvX!CwDVY~N?N#;4Zvc- z1t{&I<_z^SDmW@7iLvQtW!tC*>Nb3nXka_hQO()|{vsZ+eqlA+&NtqqLwUcEIL4zl zioc;*O2a9dbz;*<1e7w6fmXS+WQ?{l#xyAEhK>QoUijS?>5!wyWCqI7-I%aKSoL1^ zw-=1<{Z;*WI#x3Ju4t~-JEl02Lq7E_R=aQikw(X?>a-1yriELfHS>anq&gTA*3YB@ zqJgP4VB_lAQ$_}ooUt<2j7DSC*NN#8% zw|lbl@=HECaLWRu$wh$3sqjO4*e!}@B_bNL-PT)SJ%03uiMO)4<=d@4`4>8h(Aqge zLGyb~!)WU;m*6Fjt8et3Aq&6s}|+aAbg@s|*2*TJ*&*>CmnveTeB=K#2>-Oie!5?ltzT|Lqi_FRT=lWROuv9>EmT$X7p)Q#p5xIR>j2O zm!ZgNq=UVVdC#NJqTh#&^2;GX6>%{yQKZ+ZQ-&0NY`__i=yj_I@{kvVabdYsqkJ*l z>`?Y^4Y7^$k1hriqi~@v#)>h51*K-*ufRE@tT=D66pkW+3KHm-ulueg3%`*B(s6eiQIn~W_t@Mf$#(TZ=0l1(U|tlqg-f4 zILgo@MUuBaiXwZ=tz_IRm^sRvk~*$2(dy~ck+65_Opbm(!2K~gPlwgK9H~Kdp9e7f z{%SmJcYI2rgVJXfP*`gDm*Zvf1q7Ku*woT6{vG?$ zd}JmQ6BD?`xKTw>F+mN+CMISij|OV@Df;o_U740bYTdu=GoHiY?)36^o5j-rLfI>0I;nBYt6!!nq zH)}UQt2a(|th5Pwe^eBu?27lzJnARA9C@vn;y_9Y{4A8$b0AMKP@aw(;A^1Sx9f5tfvbg_=#vHQCti)S+mM)2;+_1^xP@?#w7cFbq``(nTj^KzB z6?dbZmJPcK<)O2%-Q6CT67!_m+GNyVa;IYi3jZD^uJ2t!!%fdz*74l`R!#Ct4lC{1 z*6B7+QR8crzs)c-omi?9&ZK{{_}5tUaWGgz7g28HuSfT0g|-umH>538@`J+JAT0>O<_G?!$ytN_}%e7M=0qbVU(~8jJq-m%F~X z+IMVw;d`B}*oHQqZ?_!S9i8tsPK3M03UB+I z8d45ahh^X7WjYc6(V)6Vt@}FTFQIwezmM6pj7urMfVO#Ra(Z~Kw4briaKTC|5A~(p zt7GciDvdM_FAj`b978<47v*_%UvjTg2?~mobqJ=EdqC=d5Z{rF**d!=d*_{2aw#t2r2Sga}45>woxrwxMAt8~fYMNbGK}|dcH7@{j|6zu$6GIf&9h)fiZnlHi5_HBFE+b&AR|x*H@;ps7 zKD(B4<1!i5pS|bzj&~@LoMOi9v9A!nlkhC3ERcW{XTJ{C64~ujK!f6R=d5>*-g#q`u$a}%2II1vd{Hh(~4bM_v~IT z@Wi88NAkgEf7;Yb*zkBu8MoSQ@fgyo9XB9P$mP@-GB2*u9ow#s6wWKs3;*tJ-xF!} z>9|kcUp14N7YN+n#K0hLM>d~;4x%6Ymn-^W9mnaiyic3O#S}M?a{-7j1kK`T0+)&= z$*S0SfNyR_1Kiue-Gis|g8xr$Foh0O5}_6!!J{UlO_+JI!>u(Wsjf#4;ndblFw%g= zbDb8kGsmjASECvlG(*Npy@sk_=cL8eHBa1iUG4_O4@*n_M2x&F*_0+ zd}l^+SyZvipLUA3Co>2B{yIsNf&NO1z<*Lo(`|QVH^f8bBbgt=@?Pf~0IyIuJOXpD z+8f)s7`V!3Si{PG=lICpT3!Mw#+pTb|CWn}Mr4QR9$8mP!vfzJG%AX5SWxJT<>F9} z%PfwI8+ndt(Vdc$TJ-udvKdb!)*6nV@fBF3M^{DcD!!;g$Uf- zBpc1NveC1x<|KxFTkV=%yf+zBT0Mij=<&42w)>GySGSpdli($GUS)BiMENkWI@xSh zlF%t*`551;UlT2jCt`lLlb5t)O--2DS6XADf=;is=1Pg{t1a3^<3FZ5+j!Wx6F|Ik znNK@bWDG694Y+ND?!wC!pA$`CE>u}JH;%iBXg9xWIZH<7@Md{^96sc0jQ@xzDR|lj zIU}D4GUw0D4U3c2r&{A*lKeIyM%qFxDbHQ&p#z(c9iDG=p2_jij$hH|vlzx?(xuXz zL@o6OEd+AAxaC6?&L7k{yb2D1iogZy+Svo&$D(3=X87Oa_kg zP+pL_C+a2NM$T91Fq%5Fw4|0d%QB=#@b70JYl@Hi5=}V^vbTf{<@siAk1;O#4qUE^ zjqgqoLF>YGXPeX6{#$^41|@|dys`@8^cS1;9O87BffS<%}w>-7ZJ2ph7zCovw5v8*UPYnEYdVEEMY}vPn7js zv*_JlHKiDp5GX4*GG?08fa`>D)0V~EzaH0XR#_-*+aflVDI<_v7v)oIAwILC+X*?8 z-1(P+*X(d&xqytsr+dtHBGXFs0hZqrfaQnc3R+e< z%aqFMq>m)o@D(y5f%1r6u{TtiuU?8!zrUOj9%J-(N97hY;1Om0NDomf_`PlYk1Kg? z8X~&MT^C%OWw>!#UtBC}y!7-}8peD^iywnZm1p|JaWH7W> zrR}a(tdM4}RH1DNdL?Y%68qa`?{<8`Z!3Yxz3v5A*(}%*9NYUM+4||${51IB6=Ywm zHdbXq5)`eSX)KhqAfxL}Car&A#(>vm&0W?w{c>w6uSV=#bEiuLc3W53#r)`6qGK)U z7h!9#wEig4kGiD);N&D#%(|;f39(^unm*aW5JPs%!&2_pwiGXOGV8_{i^`&^-4;`~ zY!Gf#q7rwSI&yXU;eXTZzC50KHs8dMJSb&0@m+A17~^7LQJcj;bM1ScWl|&+>{WGU?4zuckF#$(W-g^$32rSL&URdw zDm0EwW*5U&3NB-6NNN5_|E6?z+oPoWVq?Etc}cbZ-Spy6*OI>+Cx%BoVVT;>`~)I@aQJXk`FTaI{jF1484?m zU(;d$Q4rzU)5v$y{UP7-8MVApXEON;ZwWD-6zQI_!SBA65Nr7oO#sl($*zFU+3lDq z=x%Ki-qH`@rT`rF4c@WOT7t-&c~Bd;w6?FaXr#KoGh_s*l80QlTNDTH#QR>Bj_V6z ze9p)s&tR^Owakt^@&4SZy|mIo<_O>QDnB1kC_RdeH~yxRDxFP?OQHS3)6}w5&)Cxd;mNx06+F>dQ@savY|^4d#4l--iVl1S$|^4!?#o@SJJ1;#6t|j(!=q z_-=nx{aR=S$@cjYfvCp?lpVGNdSj0-;();!89lc~c5MJ+C*!gQu)>y1viim@@bg~> zI|XY?No7keuh`r?J<>Tpt$x?-IDJnwOI2{CGF6$j>?-?_HNW{) zWGwr9%+t2{&RP``9ww7~vxOIK!7o<#MeTogg-Ma$MvF8lL<_x|^1Kk>*AK17BJ#1B z2;hvr5}XPxusw;Yc^x3sKB~~{s)Ah^ z4)FXB35P9V%ALWa#XQLs1v)ohjFcZ248076$^iK2N8GI#zL0gD?N76e71nN!{;t)I zF4?|4cDKQtKj|-TN^Ngw(kF;yaP+9>j3Q4r7@s{xkB$F|Z+ad{?EgH_yMvJf%NlpD zYD4)KGe_cZMTPRnUO>E*MV7qUZuaLvVPi+qUp6!tfADf_E>k<4P|K`yx%rkavEpsv zhWs)~NG{y=8H`yK25sv~hsYV<>`Lv&*XGvlx86c|BH)`h>_xWcqs^pDjTK(nb~x&E zGb%{A>82(bOSt{Ow=W4Eq^$;-?qJQJ=VcLNdyyy3?ru9(;)-Axw5sYwM}N5gWXDvg zw<#~%x4W`v%rruyR=ZL{2=kWNshw}?q|`-gWlTKT2yT_@=PQAA>5+L8!Z)(djy>F6 zTts~pylU6%5DKh(Zs%!IqDhYq65a1^Msw2PpGlJ;r}&VwH~tI7vx(Y#&-B|q4`&I7 zE7(t%-S2j&d}g4;6G<)77M*iul^|SQ;AZ7K9ECD)`*@C#jPHsD&sP3qaV4Vic^4M> zM?}l1d%rK<1VVPmSk*~D5y4ZlOA*xBfyJSMQ+`eFsXN}jfV+9p$fiEu;hM+gaCZ

    ZR8_Nn$PT75DrcPF?=46iG+*L8k#(KZN_;R#eTc8YbjFclZNWbjE#GL=;95c|XBR0Si zO()rr`@8X~b(shs%E+j0EBaR>p|Z!(Vz+mH8VV+iwU9fQh$@of$@{AT)&6029+nv=OBdVRPjq!s0ONNfvC1o~` z<^8>9PS0EaiZ28XPhk0+%Y|{q;8RMUoJ?ytnIGO+bt#+wi4m$KF^hdILZ6s0~R3Vx7|$tK0jCGKst z<#NpRZiTBLT6hfV*Nd|bRO{RR`$r1TvRr2_?1Pg5ouEhDPfRoiD)N@Ch~M@F$~G$4 zJ`v-5J6qJzeh9eadSTx|L;1*~4c3#0=5I_G1lj0|pE_V#oc8@83-s=ldr-b#oYBj2 zOmUA6UiwrJb781_ifa^bM+W`gHMrgQ$K3;8tIj7xg=&Avwzky6*a^u4D)|qhG1z=zQz0uj}rv*LqBdDw(V) zU;TcxM4@;qs}g<0EvncDuTkV|>O9jvBQt}dObB;@uyZ`7$38mO#s01=_F63|GLGi2 zFO~kG@fQf*r&4D!=F_Ey$5sdO8%;Vo6b0&p+K73hz4V<|`a^R?;t>Yd(H5Jsj38qp zerb|`CS0r^)$AVo;ori4m37u;w9WVgIYrSh)i*ENg{KUV5jpuD{}3CeiFo3{!TJJM zx<;nNQZut9cb7@Nk^j?oTjMsi($%fiMTT_x57fJpGZIWFUc;+rL|hHY^i*s6v}2P= zR$Uh#ZW?-j$)MFkI4C_&rFMfClxQ25F*Im zIUgG|dicSXc*KZejNQH@&Qtwbjhl+ho6(z}7hNeow*7~6&(D69vc@$$IaK>ziA>vv z4cCHGcrx7Vs!Z5pwkwW0dkO#}pc zMqrxwGN1{YSj|o8ulcyL7Eo8r{Q9YFBQMy(LtF@U^>lrrj$+f7#FXJZDVOKCSCY3C z)T>6#%l10efUo}CvP}PW{UQ)p?br{5YCWos*~|0^*zCrzWHG=MF`nT0a#J4$Jd`2r zWncAEHrE|$3Ke!I6MhWm7W>xi@0KQn=abpqz9ak}yl5@vejWA}oU$Oe?KPd1=F29o zs0~*=Nj;R^m%E*>dqvqYYP@iUd?@&Q7-QLo2qC-QCmO#R^T7Ei#9D+OcjqW-79lmg~6o z5b`YsgFAe~-!%a%k{e_6JBF^h-o}vhHay4Gt`#^;^H;0GaC8#EO^x!?cFH46>v^dg62oABKJHE4_VlyhLc1ROqDWDZ zORt~5w(|&WGWQN5(K=d~4U=d4(CTxy|5-w&4QKxh?`VzBHFVk(OGxvYHm9znOqt0x zMO}RX`~xG%k}LC^v5}X-{H(K16=cMLzWBlvboP^0{e`F9Tr9&fHS8loOt?T~mw`SD zr&)JEavcxCx+mv9HA#qfss@@AA$)ugds&d}*Y_j#Autn(R!`65RpAvM=lglM_aTY0~)pOt%cp6+$Ld`GYRp{Is8gn zcs))Kz%Xe+o=)hNy{RchzGH2z#pgDmdsMQklSb>N65zT>2nUsh%`~ql8sEKknL5J_dE8RVg$$lGu2}Lfvm6NL4AypE8?k86S8s~$ zNQ}WttLr7AwWQtC8#|iR%Xz+U&elPtVo&4>zH}GQ48_lzvP|2E&t@hQ3|8(?R(N? zJo0ZP(Skc|Od@q}FJ)l3v{4Ux3bFH&>G@OIuP8j|qTWAEn2p^I)|L&*wazvoeS2T2^I~r@$XSd%cpYgzWxQEsUs6Rc;LcL^;Al$r05*4|)LN%~jDhb|zY69s-A^=J9lYO)-D0Wd#nA>1q47c{^2lBVMJ8UgO5?qNf8QUdeg=(qhwh6v0 zn?HBQY{vY{>4nW7n%zem6doPFh^=GvVdtKt=UEgsbSns361`S>YppUF_VrA{qFNp4 z-hDJ7=V{y2^5Z`|P7u8k^2h|s(sIX;=SZ&j`ZUhFJ8GHJ(g!IuJPoV@ZM>k$wP_9I z!B;Acc~&i&uiB?y=Ko@#J$=`D&A5Y?y9`o@Lk9ShdI&VYVvQXMQmIi-Ye~ctEA&Rv z+$Y$$fn3Zr*$(`rFJj3iy1!uIH-hNv-kB!>u1_Z8`FJuR#z;ftMYG z!|-ESg82eomjk{-jzR1^{gf|xUr(TjCaaoF7jaTaaQGbYeVi_&B+u?mKw?pf;tT0 zi<7RL`#nu-BF4{W*nVQS)=J`v@MXn8&EkdO5gdN=Lg8MQeE}K~jwvD$Po|ay7mMBk zuec2x6vGU7-Tkj)zEm-=kcdPI9!WBr&HaUe^hXbj_P0;<+>ZI@i{uI3}e^U%)si(EW^*AHBB4jw)s$Fh6 z*+Sb~DRkjy1-_T5nH`1Vdp2gj;xj&Wp0+icAF0S{z;@o}lkIq5<5OPPcPrbl>NW97 z=ZF#GwWA+OixKG1?N1J)ud#AkX_p_{{EnWeO?wNrzZt#A8PpK@O=w{dzwU5pFuU$_ zmn!A7TQK^Xd963rMj#4tMb5Ulhz;4xns+{>q$tEM?@)_8yPY{6Y1jfcIU?p(k~K<~ zX_FcGv2Eww81C#NT!-K1aA50^o-uJNiP$(f>S}V#dkZG2ng-(H3U-`etkf!tZJZub zK??Bfm5)+%>P!>^T~BIldn+$F(2Yx%acd2;wJX))9gQvtcV3qBu1!*WjyvDl(VZ^Q zYc_2?#hNSFJWI;Tnb>GsrVtTdX!SaeDwZx$EnsDaiHFsBTElO)Fr3o}mdkz!RqE>f zu$f8B@fb#*;Z-N8wGC|5^|*wkHZV#@RsF!fUPtbp*7xXs)V}rjW8N>eMRy@NnO_dE z?3kW+cT@+%?yiszs|9!`TIA^N&Nk6r=6>OSmINx?cKq*e#-(wYw|L*P=`q}4S~Cn) z+mR4NV4&ihrsT-yXt(baiF}#MF*oFObr&}2oU3DL_bjwRhZ8(u&F{e3wne2TMQ@MTH##lzwT4VM#yjXCy3dmmXRgC4}Qz+188Y* zj9cg>C>oZ7Mg+=?M)}~(zCHQHRO=r*neOQu*XZ2M3;~ znl|SqtL_Zv=Dh5)YB^@{%x08^C~r2a>gs1SG1>&e>XH8}y_Hyxo-O*=J&`IkI`cf| z)uG3ADZuLRAFWbz>Vh;(G3_st1(s*pyScKykxb$+92IW6kSMYpj4i#3ogM6HZ_#W_ zYtUL)fC<6sT57p@mAy$k()Xux30!glatOG@J1@IV9F1AY>lJ{N^4A+c)4$d~I*tfi z+FKr*bj392&|2K5?bu#AqBIo#G#elPagCz#+<||hP&}!IU*QULa6RPE%evUwzodA> zq`IClwH}8**&l~vAjI!@Csfer*>m+F%d7Gw@kC6?(-uu}am_6`_&CN6u#ZJ! zW&AKi4HxT7I(zNTbj(O*@LcU(!7&DV4p)FbTfGHm87)r$ktODHcVSGeF0ItT-i+Ts+0$mwO5iN#Uu4`$1#h`)(aD?+8JbKREln8)^rGxwDPR)RBljPT2Bh+ zU)93RV)Oi54bVB4S%AaV09ZdW$`xL<%99<((TFI5J@@5vR+5>fK}6m)e)-&Mw)~6h zssSC$FH`Qe9GL7C9dKqiJ`1kFX?+YK^vSwptEYo^rPn|w$I{>O^xpSIel!!kkW@N;-coGKBY#DYRIq5hnOO%6QD&HWL*0O)60tg$`$C^j*iSrK0rK5v|135@ zBlR0(l5}sYd_Aanx`qTVVDkkZRMyQmMo{YhaQ<0#_!S{5#=GI_3~eaC>?XOh@<>8i z?I!Y*L>%75X=ZzZxlkPuLp1Ny`)u^T8}{sQ+`Wli z+Z~dAqw?p(M{UF_lmY}&cz9ZKV&8LyNeO9FG5!k?bB~T2+s#%T zyjOuGQ3KS6Rnl!F*Yq@)3-I3R>Ny} zVR*az(k>zy%^eE=rm=E=RraTT#kxeU`IMjWM46-Mx7BuOw`tYq8B@uvLCEdg?jSfv zvoh+cGWw$X-9;P+Tvg*TAPfn#%>Q7PC7^xShV&e%^GiF|Lc@Tk-cP^g<4}NgQ%Iby zRw2b&U&{w10(^a6L@_ztu103#J)Vd=6n-X>+nK&L!8GBTzYm1{|n@k?xe48>@ zX$VbgHfsOoc1CFO*-smrT*#eHAf7=z#{eGOX(DH$*XX(lUDFK@>K2@>pP)f~!+yfc zKX|zEm~kY_FT}}qxRcDYO?xs?6UEy~#-|c$}c))imxIWFgweYW1@bZJF15y+iurCMq*E1_H z9S1cX^MuS%*HcO zhg-Pwi`ao^CFLW2=Bwq@e#DKY?onjN5HB!_&o^T6hs?w`%OF>Ti!T1H3 zz=Q;*I(ZLRQ0?EE?~(k3o-KK|+*bwb+-6VJuAE;OyrqBcvoQeG z5Im>{?ZbBlJe;gc*{)hwW}(EwLYc~%f*{L*VEIB`iy_QH#Jpprt5GSRd6eAynC>y< z)cfXp?P+h}%&WcInduOUx^)qHn<5yw5V$HkyDV2uUyb-|#@2nz`3&Ugc{9T!F`f@B z!ky}v^Cm3uKIa!b=qy-*pu9+p>t+o%Tnv4mco)#RiRj`={Hs z1I$pm;VKszi0p;XB%;D9yg42`V$yYUnWAbO%Iz8#FQJ0KPF8fBWSDY@2b5SH;j`9+ z^z)uKhPqTwk8b9@PY~TdxiunBSHOF++BRQ~5Q#)mImtGTann@rd)s^c;`tEK0=een z+mfu${zw#J_s|VxF~kTC7de$R6Kh~9 z$kmuRUl!Auz^BgbH26Ul4%qSBP-2cU?LNH9;$qcjrPuq~@D{%iasz9<3MfPIykGly z@ACb>KvfV~LCjlrO`Jb&Uzz&s9ZvT%RD*wSo zJ;3F89{r(sY}}A&L1CB zULW6Zzx+V-&#a`<87e#_1*ekq4=%MUiZ^*;yLF=G-$$nx$CXC}#;=TXoGxZx((mQ4 z*TJcSKfjm>h%28Tm#-x|zoqPK%9YO-D)`0Li$9R9;Kj~HX-G%EXOgVrU~qLBGfqcl z4&z^05*j6=_q|(m+3^PsWxJnVw<%w+0H6)yN`@f%`J` zRh!dE!4{u>V^CCRmO2}|k*C^r3RmU7D;)v|xofO@ zj@{&Ah38$zy$qDPAV*)2czWG!F@`=|XRNr`>2i7}@apzlE7jNx#<9Y?KVxpO7hNO? z*!DAB8j#tTlz(G#Njt$X4@s=&Pn?N)d|U*#3D#hBIerE)qT8Dm%WDUSzugh@mJBS7 z8!f8?{cID9Qg^upVYLZ%@uIWqe6DSo_0j%{1_FXc;#7sp2^JT;j^+q7hd&{E!k_d% zxpnLqh#quM5=tJV@SB;f65Ga+<&&bfnU5DR%(~!d>R9rdB*aq_r0RRH89Wn!92=px z^%L=7T_o{1ecxXDg~tUlFH78Pp_I`0ohHP@+4atTq(P!rB5%F2;{ubIiqlvDk-~ol zEpdHan;QI>=sJ}ACoNm_RJOqv5=30&8 zHJ-Ct*5obL&=HQ(mcO?N07&LpqsFkGimR(TM-2TsYaS`F~ zq_fq&I}GIg^?|QRB`hU41BchFtxdMcPGMKBCUa$!^-d%DL8%O*SUit7+x8yTm(P}w zj?&C&x3H!}^?LurXimM4=~oV)33nv$E(r>)vS)5?wsy-tMmBUB&$wPQ<+-hHj8^Gz zd`-fZQqtQScd%;?sgM&t+gNRa@W z9=V>*x;%flL`p-~pV*!1Dw^ND%NIaG%Dx{-qQb(J6}q&1lBa@CcFY-$ycG}zI?(7} z=H1;L#VI91L)Ngd(;u(!`SglZ_k!eDx(mKPI<6TAxRojqByksobqwzmW(_uze>Y^# zNGM9#t~kB*jWaMMSSu{uEZcn&PSQJ$Tvf4kH$8&l#z`M|In>1FNouBqg7`R1|8xUFd(GAg+|ZV5T|^<@^8 zQ}vz$Kli$Z$)_1gG1kl9^YYrgd9!KQp-o?C$5-+n`&BV3*}SiBO=+&XT@!7ri__O{ z5Z0&*5#;gq@kG^AW3MR|=kL&|yWKRqs3ziYd0&%i8B|&vUjwXNoR>wYXVvyX!6SM5|ISb~brN$H0&Dw5FZBrU1r>=ng zbvTbYMkzW*B0~44)UWkzzkx81Zyuab6O!wZ9+}&5j-9=0XH!Y5&i2%jK?#Xi5Tm)a zu$iHj7n33}rDbqu0Lqv?yN4Zp-{9QM>yT&7>m6a&bqiL3FGV>}R)K`qesjcRA9x~6 zDON~RYkv=G=ogNCN)=}NcE7|#*|ncQ&JK6%WeR|xm=Pb@@K{|z(+|#w(iB;|%Xs1m z8OK5$@ENUdt^4a6_)U36Si$t!9PA|RsJBUsHA0t%Zk2KijlIOh{=*Vn^F)i})nadw z+2z2Z8)e4}u|$MeIiho5^K|ppj3k#sC(`;*^y;_Ft=CxPmxPdN2}vYZ>EU{Uy-c~! zs21JEs~a!wFkks`=+<7Vg4i+i-}3u8A-P(|+ZFCCPX!p9pP*iX^C9FFZTUxS-DDSY zTH!ffB!X>e<>TxUwLuF^nwQG#_bOkdkpY#_Kuh5Ji$9VxhDyuIiY+aco4Zff zaABdzi-o~n{QA>Bw;N!)YA8{>P7PU`AC=cR*Ex z?CR;fLFjuQ7UW0FpM7l@wokeb<}Wk{X}!WEw|RsuoHkh{2ghy2c?xrW7B9GK&)h3e zO`)?}jk&%Xji91p&8qQbZ(HJM;xK(m+)1>$XWD#G7^~@0;gA-ky>r1M&z>! zpY#V5LAcOp2AAh;TzQ%+@;PPwNh^4R(CxYp4$7VG=25@iu0u=7_I_hK)W5zrpgY<9 z4)0E;G>|xzqrGf!Hq)M`6?C$Ay-}E5O90K#Gc~2#oa+7PU(D2<;^_?IW=%^)!5MvGotq zZiMG>-mEp%zB%dq>;hH1tWI{x9#zC{p?56XN&ZGj(B{X263ymNTiX1R{Nu&Bh+UiE zd(@G>u8^xF^N|2qPx1t!+lYBZh>Je7ew9B5cD(ta%kOGY2&mRyp8pGo>F;X1F`JGZ*e)2VA(8x+)LWwfNoX8 z&i>B>Y?gU)ALdeglHNXEPB|zX67UeLU}e$feFeXW8LUlvhuD2NQj|Tf7L#iC=PpO- zL%J11R$!ZLKsPCY~fT#yo6Za*S6WyoeAHn8S&BX)WBy6Ofbop@C#ssw%On$wCC@DYg?DpV-cWL4+8g;U4w;ig22fn|27{+~xn3HsOinG$BBohEZCB}_@J>he zw&s*0u?S>e-kF(dM|3a&Uq-w>8~!=}9EcMm*!KLP zb)fi14^0E9fgajrg#OSdkOIqAQ` zr{5E2ry+<#kw z1by?W|F0TQ(lMs!lEjhY+s!Hk$+3MQ0zxRk*Qv-P3e&S1fE<+=`o9?Fc-h*rr^gX^ zA35jfNxtkR>g)~#+3v+3Z6d0WO zEqTgmhr7F(RF_;j73{3~4IK-EgT~Qw<2mvJIti>L>AbY??%-{Gaxvfbmr5Qw3)88@ zX%VW+%L`Ncjp84qM~8C543x~zgNa54NZn=U6}>KAG}Z*q8Jy9vmkS-87iscpPL%AdQ?28$R3G896`WH@8q7z^Vs(oC%PL>1>Z78J%#VRPKU4k1Zvl{?p5*{? zf?B`4=b}w?%{nxzcUTPOKa&BQt;BuM6^yM-RaF&up_=h?{Bt8Pes#o8CI90TbIS0+ ztqUDio#%!u)W~xSk_U3w!mei>6F72ptR)RadSZspHcRYpKBy>K`7{;uhfxU6kQF3* z>h*1(-dkszOuK(U)^j!tnB?9<2a=EjkZON;h`F{%8ft2TeSJm|1%pNmX*C7~mF0Pj zg`!7enK|R1t@UkKh?WNqHZYz{H=vKjEE)wM=WWOdvc@Kclz|$V)4WutBcB&pts1Cn zrzXW1%+0p%S!(DtOIb_}>@zfgX3(F&7y#S58S}G z|Au_F&B1w6*S2PFS(&++9Va7S%F7LI$9)>6JtRn|tAJkiJIYj04<7oMPd<)AzUUJl z|NBUQ7e6Yp@L-Fg{Aa}iK^#>*0+n8xFFc2>(X(Z;K@3T`3Jow=T)r~|NJq# zF}#mwGhi3E_&rp3^_&+dsQee7+CC>PZ9u(P5BmKNn-s#-7BcX=Ya7_S4ptH{ zXny2u2~lLpY82%=bfXHERi?y_W^s-FIcQRT8g)oCUFE%s0ys^EtOr(;U!3p>;PPIs$=_!`w4irmXJ_ZFv~;wb0%Z_}o$`nM+Tiz9n;O4$%b*IXoy3ZwAA`JGxdkmoqP|AGNm(k)A;kT8-ukV1%*LQT6uRgRuK`oZ{PESf#sh z_gkDn;U~Z6)8H;|d8F;U(`H7%h^F^)Vy%HUUq66ASBjYrTFXV&0%)Z)G%f&wb_Iqr zeI$0s-Qc%#g|F1KlXJh}IvzS*k5WX7{25Pm{(MV~x(4@YTvVLd9PpmiCE3k;RR>uM zXB8GS_-8NOU!3xDCkY&=2Tv2DKXE!eBYJ;{HtS?dbXT;(u)1Yx8V456V`zMFtYNUS zaAx`Qk?dL6!W~}Jy9BQ*qZmV3mf?}#NMObe>lEX<*KOrdhIZrqU0ke5nsMCT3CY!=p-X1l zq5-shH^E0~+_hCv6P)zOvnxts`-%jGia_X{?QJkS&baFI{+?SoynV>9`W?-S=JUFp zabFjVc?0B974%gg81+OBm`l&j!B207=}3{~iE5kqRfSfc=MJ&!j&vW-W-ZAB-YG%; zeICOC;0(=2QV(`^XmEfIe#-?perR*~qE^2}s-`8bpP;Nr^S9_1wi}-Vxmp%Kt^jLZ z{v$792bZ1kDFUmnt-b?cYMMGpzaA+(s){*XZzi&Ra$Tg`(C5?Nr(a|D8P=?OM#LsW zuD_UM4~hAmyX~gPXqEryw^^k#2@|V&?K-*uEB1hQ)1R;fQ~D{tGW4+_(-Vb z2bWC4lQ~R6!-(fDJg4qm3#1nG#of#wa3ih1&CDs>+NN^SdGZZ* zbvtv^Qxn_dp8T`-5BK5H(?+VeI6@ct%BGmHUTBeAaOj8$`ofE6Fe!sp$X-7g6440} zXq7*h{e85R5TVgGS&Q9GYHhcJ0$VIL>jS>{{JA4Sy9g5i<)8;SKI`}}5(JE?>jFgh zovU^`5ANswp=&TReh6)dkpag>@;BB2{VOCW1df6NI_A};9n;vNUj9@*~TlOnJ>#{iX7klQPdmW1b9!Q#Eb{zR6Nqt*4Eb4 zlwLV{2&(x0c2E_djgbi864D27N&Ib+4a;N|i zo{k}#KlC^v$1@Sc%~++?IfU$5Wkx%sTX!g`+$2_n!HMlA<=Vf+P~7_H5GIxRfhI5A z`tZQd6=`t#q9(x!nWk={iUTZI!cQKJy#OkF@gV&~Iq1w)#L{vPAgxm&G2_(Y5)O4- z;&5_=EsE~u;M)aHMHLxu^=y|-bY4Ik^etIDtjg%^Mx;ov4it+OAnLn{8^w9eGlNj# zdS`AyOv1{mb}l#iDJR`dVse9?&gZBdahJ|7fX`SFgD5vX)@kEoK#Af!E>3(3jJBY8@6REU$J>8Q-7oaIl+w@ay^p{fL zyLob^)rtldDyCiSY^kd`@{rBS1jYKug1uyij>}!thyY9*T|wry;=i$c1mMCO00TUS z!2p6-9bMgi35MW}9QNY!F>~A3ZR{?Ern{-42ML2Ym|Bn8No;A6$qGOmKQ)TB(U(&% z)XPNF&ls$}CJP1Dpn34`2^iWaHMeMWr!qcUJmWU36$O$D8Z3#<_#xNrZ`a>oK7_8s zKmG*^_PD)+gQfBDH(&-e;^Kg!spm02v#XLVgaHIz!gXF+^?OvAbYZyj?NjrlfhAK zbRyOB9Z~^sK${8uI~Mtx_AR$eKrbr9P4DKh8Y}kskM|!b1D3R&u~jasQLjeNZRQim zYHl4|Mg}ax{YVsQj`Jr2G80(&Y7rA-Ru(Z=PYC}Nckn4<9J_MrutYcG_}R~8u3VT; zZi}6ZIyEC`0FYfhn9M!OU*Jmqzd{EHCzh6$N)4JV04&Fw{RLbR2wzlG^etfW|3o40 z2?4$NXk+|mW1BYVmu>n$DV`_#%?xwBOl@hNr)c@@4`&_$XGoUG|LY^A|I+a4zYG0; z8k_G{K9hWwY|9QYPb08CE)J@?-i{%@;i4g6PQ|9?LiBs^PB zPftfj-?{I;S9||HJBeOW85zxSMxpXC>Twb*4RM{e`LeLIln7HYcS8Q*cAlPwkn5bu zXMB8o0G0dbXySXQ10>NL=lT9dLSl#HQM@{6_0-`f@hCuZx7Nu8aYeQ9-xTE#>KBJJ1N z-^S@xsHxF{QeS>mz?8nPTl#R_Gy>#m+2|E|9Dbm~)E zcMCB0>a*$qY6%5EhtZgA<>lqDNv>!Sd@*Y9$kU0lw)+~dyI@Tdy#og0>KI0Xgmkr$R1oaa(ELdukh%UBJ^zjFy>ZYE$Xoz$(x_1iibq&&FE*K@_`mnJ zuH4ep0uoS&dDb;GB}2lF754yAVjmx$^1H8G+N!W3uH`Ojw#ms!y3YZu953dpperU> zChX17r!s{ywhhBMPp%l5C(LBS)G=q`Y8!eBFDnP-|^v<$pMzEa)Hu{t^3o zWP}kxtxTTt7<|2nf1(m`Hz7XOPOnQt3m(@QCooYrLDvR1cRdvw{(5^w@oF-l+A|xQ zkw_pxMv12arJ^7^n{KS2uLFihi!bU&jYww<4T3F~Ho3m->o8tn-@!i#i$)n$lQshk z#@*L3{}cX`&vb%`si~=1jvQPhq9Q?;29wcal&6wogn{Lbx!E{}TK&OFr!_pE6|AgS zwF99+v@^JK-+vj&iftJiN64xtAVY^ZZ&2`I znRt@EJU8vHP26r0j2YY*FoiW3Hr}|`94p_-bVZ4vO1(jG*bFq*jw*^+Rt1lLg^AE` z*FEosk41_xDrakQjrI!KQMG1uK}-ixodiDPXoo;Jx$WPfVCCoSuHTm(v|PFq(K3G; zC6Q4@sz(V(jWv0p&34a=hCkJ53|kI%e=|?(*3mjs#!=teVobjfk(#O$i<>i$(RELK z{WIJ-WgU}hI-Lh#-Z!$B4U6!nNDTS@T;=97?HyKBX66e~U21?PAUhA6*L;}#iz&SX zx~lLFNk`Ee)#Qwfj7|T(Sw9gvnG^tPMmrSdrAEly zI8Rty4EHCL!7=2XAuxl-;<4F8iOC=ZndN8HG8Lp3xh!*r?tu`KBmet(0(;LL`tN<8 z0#nDrF)N{NZ$5nZ(0PGJVu?+9ge`n?_X+iI!{s>_4I3422ZJ#8enDTqR2Xt|M1)Cn zE})OqgD^-lew3H|jdk`VbzcqC@B5=ikDw%Y4A}v_pIC{`OKoxHf_`br;zUCjJQO)- zp8W{(gVz1P+-*SHpA{#f5GQ4I5Q9T6=}<@N=0&?s=KgkAnLe9r#RA%CMC#a4 z7DZk7iVFUe{WyyIGBG=UzY*vDyZCf-@2+4?$tn<6EFf+Z-L3Pi@OBhkV;phAIoi>h zO2}4b>hXn)foWFS9sWXj6l&zAsQd0OF}RbElt3rYAu~j7KKt=lNZfa5dV}>`)?4WBrIaaRHixRhM?15K2PYVtM5BP@5eZQYO~$>Du|Ti8J;xBc zhweh*MgJ*Jtk6ro0gs-jsV_}Xbxg?-GINan667aOWFRn0Iv74(2)7~1i`H<5)gR%D zD)_VZ{n*~N9#7rJB1cHvFQfs71D!KoIArRTKTReXOu~2p!~c#_Y}eu8`aH^fMh4jN zcOi2zo9-3IyG9{AAWq&toAzQZ`sje(y2YySUIOvFpuf@vNY-GEPQDM%5U4+sq(D-Ouk*?om(r*E;efT41X7 zU9aJa$_M-^jU4r(To=k5+0Xf!e zztg#xLm7?eLq$P26vUAy=%TiD?V}G*V(9n9T8o(#(}_~^yNsLA7j12QN9IZy|1GT^SK=xqdK!L!*b}r zvEcpu(|-fvdUin~#Ps;3SO9pwn}z!VkcP2mbWgwO<$7~kH#J*alOP}LzWsl}vGX4& zBcjW>Xwz9%cqcy#FHNRPx(*Np=bUB44v4&QXtWEZn879@ib1tkh1^e1CEb^w(glk~ zrlpk%EFMXP_-z)*&`OgC$;7&mk&(IYKBHrnjkR+xc+!84NkJSa&DbS_49Rp(!?b~_ zKW(+?8Xb*D<$5CcV*Qdqii9sz@>GGC87zNz1>Jbtk4^4{$$LYrZ|}-G;NEx5jE(4$ zu_g4ZdVF~z926fB8*X`gv&?`?g;*ybxphYCSHuxDpc|KIfkg&eW_!|K!>Qc{My*~e zxZ;F=1l;lW+5m;TIMT*mQaww2{-vGhI9o_|0!%TQt^GS z9Q` zbHniuaJj};{QB%8~su-uRMSJ~A|_C6h{?+C$OZ73M+R zB`y3AgrHon#)dbGcGV@q#@Ls|dn)w%@r`GbbUvm*ZkXK~HutiL>xug(Ry^>O3~+Gh zuVIl79%W=!SZ%!YNUI;{ti}Qrr<{U#^sHEyfC&T;XK=(CuILqM=Mb>4_;C0np#RTd zq~G}!2G>8QSKc`Cs_Fq6TIg9}XYwzs#2pU;poq zUOxcTei0E7h^uhK)mEILyNAb)ET@v%Q~*0WyGdhWVj^tAaIHI-$V44+ZitwgoRm~f zq?Ej^^SX7uIkBCW7Kj`e7%(w4rJqs8zW<*5hEru8H05p*mvEP#Ct+VNE7he<>EUiPN z1krs9tiWz7@-acHEahIf@MWbD~utQ&DiYVk_3PCfm z(}t0*W-eRfKZP^c`5ALrmsWF;ZZZA1Q9HGu&zmT7+BQx+o-pf42o&Y~xAcjjNLnzQ z@((LR1UQLrdsLGpO+z5xMn}0tK25AA(ohBm_o%;!!XlIRkTR623M}7;GYNB-h|x)s z5s)~(Ln#(F$v*!g`g+GKW|HC42weR z9?GJUkKd0rfkE)ea!5K!t18!{0~BzF@bHVRM^$32+GdrTB1@{vlc%UgIm^eCiB)Do zA%~%m=Y6Df%48}@(yhyZmj(jHA|t5Pij&Pp)|_qvpB%cN=3`ny7Qe(7Zpvbwbsmn5 zI>=i6q3A#Df@ z_lydev^BQsc_-oGJR2=t1_uYlcW1bY^Ylg&l`BXVGEJPX`p6&~0jW61tR+dAzP5@l_iBFw&6W#r^51$Nrr^ zX%&$K2fl18{5Q#TI^T~}?tTB|#&BbiuFNI!`(q@KC-2j?#|7P^-xvXSWle&{f^WS7%%Hw40nsdT(C8^eNc-=Rp1BdJBbCpU-zA2am16DW1ZqN^P~5q zgW968{-Iy)Y0sz9z33#>{8O8$URSA9)MPAB7*~1^nF?3M_1F{s)lcH>2Nqm>m#}OV zp%2-V)N~w3V;1zf^zQ2>O|f`cM}D91CHUE1B+AE9%?B8ZI7o`sVI3_=tE71z)1ZLj z@c`u*EJg)3f^d@|B}B#FPr#+7}v_1q=D{sXS7O zF>{A%8fU|z*wrBu*S~IVeM5f!x*b)%f(5e06|+zH<`nv@)r^i!whEJLzn_+S++A`4 zd?lIq445Zb$G+=hMB}n*4J{<`Rj>k4ZUpjwD(9jc#j%+so&l?FpdQfDBy!)VA0tT? z64+XX48dQ;9T0nbem4^GU=0t_()c%v$TEg3tI(eN{J7dN+43FEiJWInWEUeteRbQ6 zYRU@0CN}`jTED4-D^<|gwlh6gX|ws3$zlqX{3Eal=sQTHPUOeS_R+}cx*v%&%dwxB zMC1raa-M|ch#G5~g*1Zu(kVzbE)SL;nxfp`+}XLVnt46amH z2_mvVr2F#+w5)g>;sQu9RIU)D7O_b#)PZ%C3CW=8EYf(iUWxz z6}HX-)ECb^1NTO;YDrvbr{waYa}>9;PDj{rB6C;lqWm;n^o98wBO~hT-ny`SR~eem z(2~I6h74=69joUg?s`3tRC&^itFS%E7g9Ularnk-enh(O8>iA`=@A)Q`O}RJ%ds=h z_lk!;FLs+TI{027j`yiLi|%S%QC@x3;n85Ixzk`Jc_@+*x*S$YikPJcqmu_SP! zvm-CQgal|!c1m!30LR6>Tb#=`-qFK1Ud^?F>!n|5>T`W>});RiP~|(ehALno=bpI+n@RLnw~zg zYsWGy_De&Q-G4Qiw05}bJGX1&28}lgZPiWlRySgWyC!=?GBD3UtL2kU-Wqc z{i>Si-22At5HBu3aq^>e=_5XNcqbL2h>%!qkVde97Sg(FC}wB{y=;=MBh9Fwp6fRB zx;bdNZoPwDQz5(^)SK6Z`%nrdQmHC*&JR`~h+gpB+NGgq?SLTfPO)9eW2YD~*d08n zl|}1G%OU>Lm+Z5jJul;0$*%V=d2isAVDHmBZ}#^q&Rp>R;w1|V#Eqf%6)f1BNtgn% zAcIX`3xgXZAmC>~)zdcE3>XNwVe4&Yo*~52k!f8K<1-^#8wu{Ps`q`;mo{JYm!LD< ziq1=2_(mldv4hiky96eJHW-c+K06fm_!bAdJMz}rEE8_ixft=jnn2ubp>`{7e>CVy zuDH4`1mCZK;rA;J#n{Wmcn55G^tUItTc!?>%SL7RF&J@ci zSa7y{P;=ILzweTEcM0BRa}tTx>RrpDaMC+9OoQB?W%{jnU+1+#xV%?_^OZOMnuaL# zzf2<#>FSThlBuCLzxgom&LmEG=^szTy^CR?hau|=?XUy~8J9KX)}mvKQasTdHm)wc zn}ybr#fv6?nor&quWY{-`Ma1=)xwq`&1vxSAr}N3;<(soKYl(!X7BeW zMKiI{uD-wDaV_g`lbUhI`#!ut%{2##-zVy3&M)V6lTxv8E%HIk%iIW5($LUt*A8wO zo5iEwkE{7bF<|I@(j3y6;AkPbFAb3zgxshI3;0UT7cffmw%+uPpx4Z(HvTe27A?ir zMR2>c?EhhkIuWiY34U~(MT%EQ8xl8UST}G_FHvW-mjpULLgXKiY4+oBM&D0rz^^*( zd!y?oi!Nqvhlsqc=N@HkjQFvzfvuaaZV6s4D>pnTs*q3JHH6nXw%uD;guRZaSh(uV zv8>VKphuLrxm(=_jUejBSw-@a5@+IwOfDw2TYohe3^RngCIqldIYlMxLHR{G7dK||M8aUOy&9(@iGde;NE;yu^2=zzgg4#%o|$A;SlaSux$y9p7XF>9Sz9}hGnd}+h^_M?N3OwR zfg$B^QV2YuX`$U@P5u#ZMZ*+EOPo-Y!W+}`Xxjh5+j+*b{lEWStEHv*R*SZZE_>Ff zO|_-9tB6{O*4{H>r>&OSwQJWNL23pO)ZR+$h}f}XMG)fn{rw3MOmjLu!3%&Rz==`%a-u#DgrComSptPBaQLPvioWaM8*Dh?jsBs~U06kel zx;7UCkg<(dJ@G+~LC?z7TA)Zx-;M?A%H+MT!p_>t^G}Eq=Tfqy_ebMYNRf~Gm9EKx zatfROjJ_h5opnhopYEYao=w@~djk;VSgCSjTWIpqmLKz{6OXwwi>c2Yu z+Ohw!ri%+Iu3j_Po7+)vqMBtje{%EFvKiBp>jW$#V~ZSa;P@nMtd>kzo{*AEP~1ZU ziNxmQG_!tg^50B#=#`U)*JlDQX51IY5v@9GP9AmDnC`r61ghAc@VO5;>HR_#j z_vhDCXyyrZL9wdB92{HRH-YOgN#V=DxSDGOs(30V zwm2Qdd-p#ffiypRgD6qkvqz`X1(_7mzi)Uf#{ZkE7t=X$|1Za(qx9D&&rrzdBdIXN z>5T)$mz*fgj>z@ZVDF?P!1#u?_Nge!;TJFc(>@STQd(k)+2`rYpR1D{BuG8R*-L>~ z;Ctl%b7pqo8e3NstBvCp1n8rJTNZADPGZOVTW4na|7`s2QyXqqIaz-^+vSz(KJEc)5K)m?|OEsO0+=~kHkv$%|%YPOC~+$akWhp#^c)4s=$%rrWK zZz-uc4m_KbHy2zjXg;WiNj~fzYY}@Ol%EaNn9UeSduC!%CT+eExUKW_4BW3Mn;ekN zaUaWNc#Q;uEs6N1>OJo_{op8DcAb}FAfquloPCH-2GW9VcS3!ukAmqMFen=SO%IZH ztNOfFG08lf^{)Kd^)3mn;@J`-U6u&KFeQIio^Y48HQYAg;>V-U*it5F+7KuBT zcj~l&RGA#_tz#JDsYb-H1>870P9f}(6YT}%B*`wqpVV%RA4O!rPkM-Cn~By z^aVqMh5>&JLznk#ZsvfdIGVRlyLf9sgX{i7(qhuh3f5LN4`t$oIs+SZK|vEye#5%7 znsd+cGjZNL*>NZ0PJrcGOw_W-zgokkpit1w4GF?V7Wlr%#CK9wto!5}fc%^a` z^T1HP)+AT+M7v3`2J}K4d`~t-N*tCfoK$nbkQ+4XcV)Bl3N)998RCwag)G>Wz)=I&C(S50q;*8zdfEa>Y`bF16Me7_{zqjgTZW&rC048?CtG~ zHe6<*g+-Q+91VBDMyj;UybJJ}`X*FIVS=@v)#$N>GB~@;Y(D(#=Dbk z&uzZY+~K-ZwKSd$?iH_;TiK><6ZKganov#+hM(S-xH5P5#w8y!o?S+!ISwNZV2aCAi;3 zqz+0rL3{Xp6Fv^RSx8NNxXnNZO~Ab}6nA;qi+XHR*=L}=8OYSR;>}R%!odyS?%+wN ziC3|QbT00s8B1|+4~cSN5WG9>QTPtUg#f*0eRb~WWr2ggtMrW<(Sg?P z$=>U5lbrfL@(+#-!LDQb&a85rAMQ%YK2@P5UAd3kk%1ZSUCqM$@WpR_I5#Kjm`4ma zvX|XHSP3z8Na2hLlXu9qVLf`UKxd~t2`{kXGS)!k9u8kZ4$Nk=Q49AYX8Uh37}YH^ zk>G|HH`JHXW|4k9%{GyQlfw5?TMUi>SD8b=>&f)(ZkMMD-LvuQk9|jhA-M{7;##;xvS| zL?MwSh+XNAv$w6Dq+=0yD=)gS@}|AQSX;&`S2mS>*X#l3Y^fxGVpv!J-~r{uA+WOc zS1^S_8(iMScEI#uDoS>!9IIYzUmP7HQ!xPr{jKTB&!CpC0ev{)F-*>tCGaEj1pVo_ z?*G+Gka~~Q(ey=;mJw%gR%$S6S7O{#CT)Z(V%pL>#lb}ZD0xcn2BDyL^l9HL2KRiM zIrnHQ83^!JTnDQhM*KMQkH%>;H%DHRQkGlEt~vIAwpth#c9=ipz3rm#n-osYJYoE9ltd`?DQR1o)la@Gb(_XJ(8T8m-P&1DP0Pl#O;iq88OKnJ zUqqhbW4kUxxEfB2N<{GOto~$uc*siB3ft>QgVE^5AE)(o+q{=(1QXLUCF7wI^p>tO zxqyVtv>d?D$MW0ARN2i&qb_dvNd9heE6DIW+(&KxY(r0Xzh}kAocsEO zOJkV>%+EJI{WCcR@3%->t&yD0#(_JnC2ebt!Bv8TM|NfL5Q_ay0K2lpd_zW#ho}4NEUG1)IjR zdLHu0`o@?=X*+L1U*?p}EuXQ+XtLi!=f1d1eH!yk&H5Q*)STi}EL$K$68wERzLGFH zW^3IVxMYBel6wiLJ72A#wI4VWbQ;hMaKozuy!W>BDYS!%0&DkIw3f$b-ADe?Hy+E3 z8l$`AOU`$Gk9@f=DFji5vzZ%5mWo0982sU1H*3XkDQ}wJd!Pqh4a}jDC;7+G3BiuZ z>}2jYNn?Xck5eN6WQBt0?FRvB%L9tzth_~|AlKL?IUq9KaH`S7TM z{?~XW0+C6^PfA4ly&gZux9junqLr0EtQ?2W(#+$M%ze2LOVKQu-|};B|86C7qjEw# zYY-@WHu2iOO1REM|rZaF8K`}i4}dje~T#D`uc$M-bo%?|li1@djwql-~np{&Q58bMg;2J0~E6 zoYy8S6=JFZ!>=5d$dOf3$ahhZ%A%w)a zy}{Dii}g~6zNm)7C&JPjDo0_|g(5s*H1;z|h+#Yv&C!;!`?C9>Td*xKa3Sh%+R%xv z(--W4+{(#TVSY|98jybbX21gr0%fk7&3a+Kn47%4OfFtfp)OS963#IG6LWvEbZ`K5T=bCzaF1r1#xSL2Y-W5(5 zKSX5!$J%V9n;D0V-q-hf;1?TDlx#p#i@_)1>ln-8EQ8+qrJ{9k9L3yB{EcYj>_>z* zo_^#+x7R@J4ZKcvcCwM@$er1@ugpybJHek|K+?N<&H$6DZ!BX4NxSf=-sI=Y)D-4C5; z6y#r+w302&alaBUvJxdngK=G|e(HPK+ZC*_N^{qKUr^Ob(7DIAyE(hTY9gi&OI9y(PFvTcweVJnnHco<1d*= zmxh(kPYtHG`4#Zlwn0LM2CMR(E)92!VH>8t_hle>Yc=hC|8j8`?P^597fUw*-(l+~ zTl%qv$_JIr(c*hC^^WI(#eXQsyV|JD%!2gaWsXL0Y^s(HozASDblFhy9h%ubC!VT% zRc!%LMrls|iaxiyHek`7$>`rV`WEAYr!%1As^%RYxWzado=~jb*EMyy z#v{aJ0*NWo_q|y989U=B^K5j~ZkJ@~ICOP<9AwRyaS;nEz_AGr`rHy{QiSIrNO)}0 zcUjetJ#7qgbh5c3Md$K#%xd&6@#mGfD1W+XOy*VRw@=-W6z@7vD{FPT-x?ejmymJ_axdhUBmNpaS?GCwEf9H zqg}KqJtp@x*?k1|$a^kMh5#{{JEo(pbMDCX5jeT0*O5b~hHtNBLN5>tW1o`)MO;2BZdSmVfkdY(#+ zL45qWzf9nObr@T%ozM?3a>x58yG!KB2uUMFOO_pSSxnpF`u%U=>paohH4r~ZDKcr?!zv4wL zl4ngs%jRzDX$>(;wmV5AOpwBRT|SEYZ_s6(V7kl2y`axoQaXQ@(c~Bl+2}g|iC1K| z2Hf>gxW8hyII6@Xo~RF&C6yEew>?f)Z#8DO=f()uTLGN|eyetj(D%}-?JN5}_76K9!sVIMrUIIN@yw5!$Vwsp<~8UrCQq3h9aPs;?-l&MTxq2} z!;gZNO}Z`Une+Oteb_77llUih?t4_@>>x&a$)KdZSr0I~%{<2Z1$Sf@ksSuI;!J5P zi^16z)hmbbuWC#=B4&^KP1j59!bqb}C(nz*P585nDNiQfX{ryj`Vxx2AC1O^sJI?5 zw)8fvXXpASoIGd#mJ#5QTM#&x#yWrfk3;wr9KHpPXuMOylYz0YseLS778`luo0o&# z5jTP~y*axQ=zJPm(=1dicT`srJlr)`Z5=8L6X5hQ!@NwzOeDCC8gvAZCE{j}4e=QU zH>f#dwQCB@Dgo~>KBxBF{69(uM~sp=46I9a-x2eHThGb*Nja(I@YX2G(?Yh^t&w4)U)%d`{Cn({c^lP z{ZVk5?B{Q+;Gy&8pR05DQI>b$F;!E{zJ`jvsBEa;Jx>uQfQgIylf>$XuI_8Z3&l)) z*GinNG;in+7n}~nAEdqR%tbHN^;c;9`?wOuX0MMfB3Rv!Luj5~3 zk7)CkZn5JIO)(~W#H>J=sUzz+?g@?^D&;6Kw%P~yv;&8PcGTS^)~@K-8onzk44)mZ zyC+glA#9DDs*fMNa?-IBO&$aKVsry*Iw_Gl9;39Yg4Zxbd8=LvdiI*4$-_xd(Z51xFA?8ir$t|-A785& zr^YecbYQt*D1Ak#U^aDGQgH|I4(Ai?XI>Oed}<(uV@biy^sT#S#7q}9Tf|16ePb4f zE!3h4_KSH(VbtHu{fCDBjB9v=P2yUfr^@+*z4<8;+u_9oH zTZSMhbNFh`AJH6C5AT7LvuIuooqUG559B-qJS*D$j%9c|l`bhrx;u9Hx4#2=+po+} zY{olulwG9<%uW=>0}qzm?$coS@OxwL32Zf80*}u0p z$Je0L{X&cg!?)PG+U9c!+tN*}AtHEg!j;-C4pUy|3dLkmK6(g%C`S>YN>)1f%_Tx5 zoqy$h@pQVsrm{_T) z=>&{lK)~_NPnm7Tpj6B`P0(GUgU<>7nM7;clgn;sLkJja-kSU-dqlp;Y8?B*L$1Qp zw3GuD<9zPbP+a2Le z_NNxROOH}?%&8>0Jgf->7=9thf$^}>w=cgZx^){^@28~B&gK+t(X$E}j*pIw4G$0V zoR5vYi%m8fK_)!)d818p0KpRTY9Od0JBNYxB9U}EkC}$rvh(uZC`uP!j5!4 zWu)LGJ|uh4m!~?&0tXz*eZj+kA^h>Lr5;;w?WhqeTcdA)XBMm?J-w$1W88m<1yodc zaTc_EQ23g}Uk|!mm;Dh3&TaHCqCN>NSXB2x>;V;s zHDA`SAD;#iO{qx^1@XXxxx#wcl}0761d(NWAk^-9g<= za)gLV5uBCQ=?HcP_%%rvmutzRRM3wT8t{{eo--fkKiXS!D4Ne3tJv}Nc9(3{;X1a| zk(I{N?Q7QOQe6Z=-WOim6pYw2&$T7K4L~=}SJeCwnE1Z=XDo4OZEJls_D+0FBi(rX7zz69lnJ7L zGUDx8&B0HFP$HQ+u6YR(u>B!l(P|?bOnHqF?N<;|i=R*pM5*1Hm%p<(#Pqym^wF;? zE7Gd7%}>Q39p6wT&Q zi1TZ=#n;IWSsrY=F^>sA(yEI_x0t!6PKTQ zyZXNb`+it~`KutuVdcXRIzMfOFnLRCzmxZD84J^?e}t$U`#nEZ@U=SK8Ja6|mSGEH zkQp}GxsXB^4-7|?g7CPftQgEu1Ee1a#=$1u9{?v<7YshQnS@YjBU*;H0Tna%y z6kWrWf8{TpeUX-ayfUDBxN&#ttMv$Zz!rg0 zz?T>D!E=i3E!MnbgtA{86#r=2`-k}xiTBzS;=Fv>0jeA&|K`a}r5)2;duH^b)c_7B z8w=J04YSd{Az9eHtw710K;|HP8hwFWQYcq)b#0BLRI(bOrn+`tx72>i=B?}Vh+Y2( z_=(Bd1CnE`$ zDcK>SBV;ztXKL;?_AqI@HeiI`4jR$8rtK^AVxy2G{;n8t$d)CwBw?#^20r1>0HM$@?vN2B8M@iPx z#l;+sXP)H}yeh2AWLNAI{j2j$-1NtpNUK`2t@HPpcNW7C_47$@9jeFRhr>^W@517b zb6}IFJLr2SUe*brzNu>sYHu+MHd&HJHL?lMIe0TKTEZ1E@92}9&0HbkWb?OM0W1qI zZ7l_;kXO{N%oUkOpItiIwh=~WK#C9nVdV?t@(5ND!;w`S$ecr1N>;p5HcQ;fqRkiF zuQf35#c$eD@}2l>1b0i-hv zjm;3O&l?95s!l4Oz!_aQSw0CHKFd_k=Ax(my?oYkNQMW14N2#i~ zG_N2-YIQ8t$j7=WE`c&HFN&6sKO0rh)J&CY(saDp*u^BlFm!PH7-Ha8^ zScACR9~G28e5fTHxP!_r+7HtluzYoS`;Np|=;HXsqFKf++nIGo?c?c#(G;(7@07;l zc{2ail)LuD_G@b?Yw$(JRCRTBLf}ggHt*R>v>YhK;f04UjaCdDRZ+qGsLMe?zfjRZ zErGiNNOAak!Mpc0I2##ysAf|9{7^}=O}qr1mZq8S4C^MQx8$yzUWS?)=LSMTW`5;) z*By)>z^Hsmzh$bc%y<0Gni`A|q?Ek=+%@%D@e zBPqFGcql!xCg3q`Ky;lP&)?Y|(LJ3Vo`^E(s;`P@Q@>$7z!;C#UeydoqP2CDmDk@i zk71xg*&@9kuTKU;qBR2n_+(>|(T@Mlw(chLff7REheuSuWrc~WPf3ygOj5Ut@PxT! zVt{LHRoyZvAP+1|h&V4PQyMe@^=_Ta>B^Dvvc!_nllya6Q1e(jja_dFtu=$Ef7~+% zDptw%dIxsj*WtRYP3`gQQUl&^vxa}P5JVWk??$Fiwr@YmE!9jLHGp&-xKAC&mcOH^ zWws4}qDR&A!er+7(cd@2GGYZ^|18tdS~-)bB`4lHv(1_~qbyxFJ?5_01lb&0^BS|H zImTgUjST_g&%yrd`2(=1`^+>U&Oy3*e|ZdpgPC`OTL`+HG#<#s`DPY>zTnUVck(zLux+aH1Z!pgVu!Ia<= zjkiHVf1ZzR0Hlo99+SYS5A(dsze|&d47*$>-t8_=<7?@KAF`>m=^GgfV~~0Asa)F9-rkW0i!Qn&&l`c&qMe`UztGDWcC}f*imuzZv{$dBK zIY*B%Hv$2l!0!E0Y3aE>WmA}wZCO;9>uiHRtS;LA6Qs$qpL?0ToK zSTp!Hr-8hoSu5{q${z0C^=&=V?(5ajZmc$RtQaX^zuHQA*Z?Fv#RM#z-epou6Et1` zEOX*E*Ae(1RrRmC^@kOeUB(t)s`ZBO;%@lia%D%%4beOo|K^)}?>(pV2j<>3T2&oc z$9mJ4zQ`pU-G$5VX&FqJUW5o_S@&4|(M(mUpr)Ydn?(oCEwse%rc{xJ?xX(N)XEYy zcP_UG7gGVaJ2JD&LK^6$_jHDou&H(WfnG|Yc@$E}BQIqa|Ao?Yzx>zZA9{%-3 zffp!iTMomh!w!Z`85d1!JsmZ_6HIkABBee>bkH9z1tfqMt@WHu5lc@$LJ&#Tg|>NN z8oFw|ZRlqL;ifOMtl110D5ebFzC~pXv!B@((Ag`QF}1P#TVGT{OSwC7uiEyWk0Xr+ zX4~7?Z%=Su80?m(K0FTG{~_HLQ}^|PuS~!9MW4$Vo;PO`MAsJLy=9&DsW1N*>^ozV;TPtqHSR!~ka9Mh`RKg)7X~l1Dh~3e>JW=Ar$b-LCxZMK~mhFqTKe$gn8uU7GHd@ru9Ct0qC8Bjf& z;?PDt*Ln7z(!0_Ns%_yqhnjbO{*kXTtr9!#V{@`=#>c17mhsrICH~H63eB2qwJdugSsiv=nj`=4%dXTq<$vip=6>`5_srz6X41m zbfob&4m=1cYs|?mgCWxJ(Pbjr1tKQEm>$Q+g)-ZtJlbGtO;b@WT_gjI-v%NC#o9Dp zYs-l(<n~@pj$!!fmcr0$uYP z1Mf_Y9kwsZ*=*>%gBtb*R=@TftKDgM82l*6`Abak={;)l*>L_AON==fV4T5%JG4?b z&1NRlD?!t?kS5SwW7xcTW0Aam!&GMnmZNvXlJ z-@ma-Yiku#1|TqY&}~@A1yGbzt!>9@_>Sxlr|Udw@J`D6V0NXx|yF(>^!oyB|)Z#*5%xwfIvDdXd_vSdNp zgvGnfcZZZb~$KYF+kv~lCAG^&mP*gC@?%-fbh~z71`ddmc+&S@eNYW*TCa0Ht zZ8JTPB96<|`T9H6jtooTf}Y08nM76aXzZ7Y=IMdsjBi0k|2)@+=B6c2*m!C)D5kYB z2^7O($M9lXJ`S?^~&AFL$g}Nq+q}No(B= zdfZ9iZ|1Ut724ZvY;P_9)_K|1GQV_dUjBW5HU0R0f)>}Cnb5eucThvX&IO^nlDj2Y zT<-5oa~O74?XRBF}guT%`qtrgQI zv}>(Z8nB~-ZD{moFLDUS2i4Kn*U521@B0m(a(QuhEx(%NgEyxu)*({SBCb!94F6Ug z9Aeiu)>hWH?1YeShlKMI%vy|9-ocW$pu;$$K-r*`2$sO|@ps7C_`CI(cSe~0*$zz4 z;H;MQyqRGrdXy~qQnGMX&Z3yF#;&F`_45U@BI!$iuhdC7o{Np{^?8Q-Ec{+EXCe1ZK{Okp z=Gz|D-Tu$bFGQfw6ICc1%Q<_zj$ewy+E4j9e;K*d;yw|hw-~S2M=LCF9mxw?m|Ie6 zzqqOt`47P{%*`aO+*xXL#F#L*yzEj2FSoDS@+jXqC}~6(c{j~BB~Yqj5-VPtXgu5L z_(dQ0M!BrkuNWWkZ2rFYexIOHh)Kgr8VWU2N*tARhL{c90**7+YsgI6GrR6B(59$ySlM(AReFX)rhR{ahey1*_if z+#fkzuVX#7XSjFIPmM=yx?}`q&7cs|0bmfJx>C5aB4S<^$WN_rFy@?m6$j1s6Whg# zrA++r8q?JU=-_6C`v!UpK+af{i*hE6rPq{jom{QBsP?HMDKjMl36DU<78KMB)!+Ug=NjPsMqlsDBH;Xc zPT^7AvPR<8)0gr(FUavIo{iGWMa@_Kaqw$A+o-2UeLMlJoVb?|oMYqtNE3v}QVt&F zKx+>fBcDj0t@`X)z`az*3^VgGhEd6ZGcFd!0KFWkLbH8|zat=5!u+C@?XPTW}>ia>Y+ZwCTSE6}*YSL2R}H*tu(z2;afR95{5j5#cu6%kPqVK-zIbZJaglPX=a z{+)d)U`VFE$#10?)idF}*3djp^Tb!A$%E0(7wOI@dE~FF@+=ac%xE{@`o8aO>S!gMJ&eP_>tE#*AV{*$v5q zK+z|3%?@7@*}?4qQ^$-mR#9nr32m@t%&%ATpzr(QLmTjsLnKHAU(yxv>){+NDah<_6eEK2uU*O$%K)m!YhS*j;o4|hDKoSX|_C8bqs0S~2Mf)bA` z%5u_&Y1mwK2^>HX7xoM`_H&C<9t#9~2`Bj+ga z{j%GGvy_(NHiz#@t3eOSeO3qfem?!#VWj9yqYO_^qSd?oX(-$!;*TpALUygS$()u3 z+C$yX7rFPfj}tT4OzwV`Ti=kMtVlm1`VC{gw;4A<^HQ5ZSXkR!-=ENTojaJq7jzli zc)fPaq@mwuBRKBvVdu^NM?V(VLn=g4V?CEUr9CYEPxkz-aVtUX=7Oi`1(Gz-cv9&D z*Nb_{LL4&9Y@F9ZvOxKU9QZ_t`^mutrkiar>+!jQ=ZV3a$qcP|gka=#I4@yp%O73@ z5BVsyq!4gFd3RfS#eTDP0g!*#sojYT)>hS#yb$X2c3*jxN zFC(;24nYJ`NswC>?y}0pu0s{nX-w^##kZc!^skqq;-UXf@ZwoN$%9VPH0@peDcchi zyP56UhLR8w)~uldYB8{XRpI8!ESPS6Baq3w&PSw0$H=(PX-Iz_yHF|bFU>cNT{{<+ zRgzfzk@Ll1vrxxLv=G1NWY3IBnX*VnMu*;O!R~ZNM_TyxX!O)V7H5Cwb+>YmiDgdP}&o$ zcLDIuGb#w%OyzI_mRaS@?sccJqrKsAO+oo*-WM;Tx84_4zM5DrT17CS2VD{Xi4x*7 z)%$;qM+^kPQ(#lkd4)rY#&QnE1pq13{Oseen^C7AykI+jmlacZX}!@$SfLH=%HN`j$R z<~R_rt23SQ@)M3ubT`i}{1*raA!F_kiARhQ5=XqZe=kANh(AksA3$A;WE-xW_6odfU7Kd`pKuo56SkLxU5?F23WcSyVXDDHP@|K6+5Eeb(T&a;z=D z8U$~5r4`d0lxM%=gL`t8={XCq-l%V+484WmXFYzKB1kO6vy#n&ez!IRNmx{-F9$5#=Q?<{*-PT*_R(i@MB8URi;&%S9EJI9IA*+IEYlrR1}-Oe#5mnNAe1H(*5ym8h|Mqae?y5>m&~deTbkQV})a z-hSk>`$1S$n+o*H0~R61jzlldV?%c`*huii%-?u+W@^|h-EG=ED%|`%fL6D~u|LS? zq&K5f&FaIyvf${S|7L*=RRP#w>4{?CKP(()4<6PRshr;0ynG1`Q&`qkagLEe5Jzp4 zp|=A?dA7kHu%BEOh=#V@O5dY{(#FL&wb=LiXPAtcIaDSo}LQ5B?LHfUi_H+A$L2m5zvTSH=s3*abw4>p#yP zP(kkpa3;4cFUZ6G^}yoZi~q5iUi}~Zj78Fad`kbn#}_tNF(k64siCnlKeVl|@SoDb zknrBhh1T^XmuHIhesi8F91Mmp$3|j=@ft7y*G3BT^?GmYtTQ+Hpg`2!^es zw4{u%G_tR3c7AhhW#^>upjrw%Eb7@mSTMcbyI!j_+rIfPGaFU^o&V+$kZLgI0C2tx zJ>PP#dN=x~KSyxZFDvkHd8Q+JB7Wmre8Eis8q>zJ-*mo>lm(q#U>NXF@XMJV_`i}}*kxi9QZ zCiKeZ_8VucK}PEj$%$FeDvQLiDcgKzGS08fcTKtZ3^+Z4)r0n&A7i;F_#tQ}tWo61 z*gi(gV^1!8`$_|BfQ;tNI^B)A@XvB3uhnfwz_%Cn?{f1dD3hIHb3h-ZjU)Bl9jgx0 zap!Ar6JBO{bstNEuk}Kw&~uSRR^Yo`C-@4anQZVOcfzL4wfU%zaA6A;4KlOy-waac ztqD>uEvU}DXdz)ZEK(PlDNa=-yMMy7e4KTP!=0_^LQe_G(8H9Z{U+&}QTkV|Q;QkB z&~sP_X4$OLc5{S`cM8hfM_jN-+p>brFTA-GuLcP!8o72HUsfU=$wEyh4J*Mf zV>7bf1POG0#^rgjIg`hWp5vgUl}M980a@3I)eYtII{EA>lz3~<_Bn}37EiD0bpVg4 zG?pNN`erhvBPVCQ>^~KGTnBn08iLpCA=v)KAy5oCam-y`^{daZuaC3JTS|y^;Zh_ zgr*kGgH@}K$8AIV0Re~kA<%b1MlN6{Js!S#5NUl_ZX*4#!Gi5dlZ+EByT_Iz3VJ{=3qj87C7%zS(4J^D=J;Z!!Q&2*pgxyFUg=heEmSRwyePw-bneN^CO z;PO@!9X<3XaxI&Wu_}D1%=93ozq8L3^EC#Sefjq|L^_5Wh9_s+Y!Q_THUsrb*Ry?O!={QkL(~ZGLZI!EXF|V1wUh_lc5h{tF*` z-A)Mnuyv@J)M%`o5v=Gg4?Q7YF5A*O;FuegsI8=LGH#I0y#L5%>hX{vlx#A@UmE%K z5;Y)?vK>0^`wa70?2{G*66djUniAZ0P+lB{?JCXA&4^8ocsof(7?(I1H(lY-G<<%k?`rq%GW{&&(^bl{IHiX)=kr)weINOPV2IX#ha3?o73yyjZ zX>NCM!?ao>Ud8y2=wbxVx42Bm`uFbi_y6MdWb3`l+5OLXg&SsnfXA^Z)6zp2o;*Z| zRQ`2F6!09PCS%8gxVJbDPyX0T5c9?5gLO?rL8aA)T0Dt9f*(ojq7=-8juG7}h(5CK zF}9gZevz?-SQ8G{yEN%G$mTfif{HhP_znovoBG?a5bJG?!_-(&n$M4iSjK~5rfR_CYTFY@il8y(S6EtzVxCVyM5We0sE>!z~EtbDCx|>1Xk3_g{k_Pc%c# zs_o{#9JjZ22<91yWVyN@_)&fZTu5V~S0z^|R4J|S#XFCEzz?x4P;;_+VRCmqvgh2@(>!}Ez`wXQ7vhpEPaeGm#s`K-}` z^1@F!soYGMyRh6_$lPZl6RVfz#ozLyos@+aHsQ}L$!9+;Vf^=EX_5M0Pj992<+I=+ ztchIFQ$bEH>C|%~+qnU;K2>=08-*&M>}}n1DAo8(^33xW`e<{|H|RM*VT%E;Pft%r zmz7beN1o5xPhe8CX9oW4Z&(U;gl6tzrO!`i6;}1ip8s|4QuCaW22mWF5|(?Ub4JZX z=vtza_f??^@_tm$j#eaOBU+ve=P=8Z4e9=*Y`E@gD~dMq^ADnsMxJ9AXtkivAOAYW z9k)Y1!C7~&jy+8?WTTL2QYX7< z&|)XLK?^#$SsD}d^F@M2&`ovjyh~T%LoSqg0;tqmENFOYn)z2&J7v#*N{~X~tVj_5FV{9tc2Jgd=6-TkO-6Y$4?ACstW}fE z{39&Au^B+O(>j#v9Fkd%u7Bcy?*oRsFHa$nRC^0OUY|X7_}5JO)8qfF^yU7Zi{0M5 z@Qva!X8)OV%FzL<^n|bu+rqxzmDAGhz*%_+Eh?w^R)q2K!N}(Uk=Hrlm=jmBxBwyR zz>9RS>ka{B}dJKaBLDEZoLIk&<(XvIqZPks4kNONCf zUb*hb73ulRXiN-NgM}hoc16diqwSVUG&3z@CVd5={h)ZTu=5{$UCcS5? z+1KoRrE_>oC-Wx1aI4WXwLm}}0+E~yi-6jFw0`Y8k{F1Y@m5m-0W5 ze48u(In?|IkZ&XV|2XD(N`(hLGtRAgT#|4S{>0nyoz)!WuhA&!6*%7~MF_a=QRdL% zdRbQr0A6ApyJ`|z#C25w`GLD|?PjceKmBv}y86z*sXcvL0%$E$VuuB(buueGfJu8rd5FXhEu+R|XWjQ4}4w3Ip3aT|-NFmuuXK;w>l7Fp!P@md|mlg(h&)lw*hDaM-R(Rz3ntWLEVMjibYdX)#ry@1z zbok%`v94ln9KVxl;*EXj5QSEpS0x8EHo(%n@Ikv}+OI@3_cRG#>$ImJI)3HSAlDBr z75}Tf?+l9SY4!#YQIwzvs0gSe$q15@iYOV0OI(ng^Ri@6L=*&+C}Ba#IWJ3GKyuD$ zVOd}a5|$j7^d9v8)UBuLty}k2-TQue&!;`J=gjoF(e3l+tT`+k&IfRmWUe z5J}Pc8I3Oc*kcQ)^Z7xel~R?fS5{HYYDJypM&{E{f7S0p-{|Q|Efd>lQqXLLY@;FJ z(ulm7<*-nMMz(>bAGB;=?7V$`ti>4~H8rJgQW#$)}-3$CAGd;NvMBv08vRb|S@d%|m*3G-E+*+1+>?0uoWvn}>oaZivhoUD&#A1avjWNCjH zojg2Hf8XfAk^M+*?8%`3;p9{;6zmtNpLo7DAOHQ)HW1D1>nyNlVM2|_dc6B1?N_Ai ziml;3%wwX_K{?{{Rqw|qF)J(0J8fx$917rRu{GTK0^@yUUos)Y!zU-j5s3g;>-eLA zJ_U_KTuUF%eKZa?yNLANh}ZAv8Q$wD@TPlfn$FD0ZD|8NoX*oztFZQ<^EHVGu4x;U ziNh+2{jP12lPuFV*H@DFRyF?>FVon^;ztvzcJ}zU)l0q8eh1^&`f6vVyx=&0xfkGN ztPGDWZsW~T!5e5tS11Xhy2ksE1nsLoWYolwmISAdkj(zUNb0r20Ny-6&#lur@v!D8 zS1N;huKV{vTomJ0bk;pE_3T3c&}CFo6;z<;@x z)jVBkUYD7bS8g)YNsk(gn6z>b*%g^hg(V=*H98!OX~6s6VxNe`Jl!M<36Jw0%}F4Z zuzG~E58oNlM0=IpxLBHG()`P2NFQ(@^_b06!q2j!g`OjpE$Rc2oC-);L!U0N&o&g5 z!?HvN9#SULKkj7o_+A99IdtFjs2AXEmfhE{B3nv{ftCT=mCi{*+l4RgtWipX$(|-@ zrQwE~lX#xOfU!wUFVnb^q}jq@2jEPkxfN194ek1XMuU7@vvRlgKd=(!t$fZ3NNZ5 zmQ@}ZBk#r_lJ{vso3IpC+AT8Brl3%+11Vl>^DU3Mk!yafgLsCB_M6yf%s!vsgy$Ya zJW3*PNF#a1lG%R#=4*WMRwEBYphhvremGYL5Liwj4K&aiTUTCw)Z^_v{z@LR=VRf@8`osjj>HvKsK4@EQgkVRX404Pm*4Q= zSR1vh+0&ws&dn67Meq%K7X0j^Um+ zV%b+pYDgWtIg0os&r9W>9>ef2>mgm*-#0>dZA_dzeaV*FgbD{r>y_&`1f>oz#*37P zKXRjNsLSA+qhN96#34`3xG@9hnCpJM?rZlC-#k0@M)2z7@QRPkr^zlDUrvPh)6e*$ zmGE>K{7MZLb=ffJr;5$J*w<03VxpJ)j1r36F`F_%|P%QL;-*`BjF`U=8>IxL(k zYfC4^hv86(0tYY8X?bP;rug)Cj$3k8K7P&5M&{FxpHa%_5 zi`{+`fYuuexJXMlbm<>C!pKH&y;_lXL$gF8W=fhb{Rzh$h21DfOI`DgrZ8lhHdbe< zgMpuXjXCXY4R;$R#4*en1-94dFAeX^^Ys{3AKJ=1te}Y>!4HDKrfB#req;}l$|@r* z`v(vs0q?~g_C%Au<(fH&ks?Q#{m9SG&dz_kcH4ucM8|{Z%aGH#Apz39XxW8z77a_v z1T7U%kHUJH?qYeaHCR%~D{zSAGMCwf<-U9OPAcf6KDi<{b^l#?j!e}zE+FyO zNQnziRnG6@`dgS6Tn|5^nl~K2S#5af=am|kHKslumL<`zZ9!0IGu0Q%|g2)-j)c6(fL{qlB ztQS=voK2}b`&1fbS>QmQ#4C2P*1PiS%Tmb`C=ZN$6P;ab2QNGgdc+UYr=y*>`0*;? z=MU>z_LmEoTLQKwpY=ozSAc@*0)5Md%1Ux+b(bDpUS@(fPW5O@qT8C`-f=k73 z2LVJ~p~!-+k6rV^OdxWxy0l9hh2dZs6A|Ve9CL?dZ9YR_poYAX{%|pCcI))wx@w#4 zZ50y6k!yz&519!t-07pOIo?%W3g}rA!U?(U=e9C&Kh~g#1le&%a`6KARUhuNA4K)I z33(&aH$%uSh4X$u9z%>rx8Qq66~`dV&X7S z9Ipl-Bt6`3&H7fU-sfuxfirmpN$Zbs4(5=+H>I$}#4|i;A_dJZB45ZNcsHa)F_zni zxd3}JR$5(bK}%{^%P4)xR}}u?F;9p8-AebIFSFB{Z|4_4Ep`K1(3)r!LlvUU3BYNg z2c`t*;ZOfQSvd*f3{W|xvvvtqBm`R_c;K%-|F(K(dO6OZj-B&AJ{vRPwjs6r$_SLo!Jah$Q&yuo@)s@{9nl z995!YRW8T)hv=a$%A|xT;kzthGG|wdSqEkMa1D}g!9Ok)mrk$0bPixgT4%j21@dBs zf}o=cVDz!JssH4-uH|S)_C}TJ!g25JPOlg%H2B1qqrPZ9I;i$zAFTBZLGyk2d8X}C zB9kuQR8+^3UIx?t0{^gvdHhAE)eu@JvX8@cXnVD#tIVZHS1#vB%67R+!tr5I1-IUb zr{iF~7BG4RB`-bi$}`No;?9O4J|fH}uv>GLjAJ-(O<-6@|8VdP-_>e?Fq)g^U3UZ$ zl3c~4<~q0{Kk!-=waatfJ`*i`-iv%PG_#b?`k4g0IQIU66tZc5i)Lq>j zJ>1Fjd~($_bETTFuO&r%Av2|1Z4|ZjzTAMH0HFa5P?e%$h;JkupF0e#h7x-8;C+jh zg?31Pk--g^6!3QhuQA*!)y~3%V3qd_DImJ5#V^!FE33wQ*SLJtb3E6Qb`o!E!q(;Q zBa;)>qPtVclLNSGiMU7`UN)6!IB4su7>TZ|%{z0Kof9qHS^>iJR&|X!mU&fbR}@w7 z%mh(x)4Lu;$w`gh;x>A{o_jA(B6P{jCRVI0?c1=L1P-D5!(Yp8tVmN_1snP)csUb^ z5_(<#HC4V>bp3p|c5g&pKonB1v(iLfzTR0ryo&-q?+RslRc(Xs7wcIW&7!8sXtd%Vn+wo&G5mB1J$QKnCm0=uatGgdoLAK3|@ZC?)y)I&7i* zK>&;B6!etswAWRIUdV$!PSrG=XB zAdKE2Epw5@`Hqe($o}^5zBH3-4guGO(}VhR9qp;A_W3_)TlwoRuSS*ti7~uchRJ9hK%K;F87z5ED^h$7whBpB zGzz`q^Q`Xb+D(;r{CYFiKf2*pA=0_G+AUfp>mL?b0!ynqWz~0;p*LMRRmGp*FDY9) zQVWLTudLe93*`?D@Q;@tYkzby^0H+}aTXfX6r3`4bhJ1B;rQE~IXA>$U~P2X7HNU% z#K$JC*$drUT^2nIR`Z|ju&rE8<284QB)ww(jqWy(BS%=YY7%Atpvy+@(5UyOZ)W9h zRJ9;oMC-M-{`}U%2dXmEqV}O-`=hJnf?-MFl8@;YHv*1big1ImdTFM9hY)kcMdCIs z(&?=^)yK330#T!zNUd&ar_i+1vAhCx9b4So{My{yVttc5B%^k6;VD1s($lQ_PqcI% znL7V|F&97~ymP$0fdjMojM7*Rl-<_?wbvNQN1b>pKYX>EHdJxXW#tOZej>sSvsg1Z zqSf>$63^5gTf0econD!HD2&{lW_9<*7>R)=idRA? zo4NRu)x(-2kv=`OiLcW^w<|}~FjI;X(6}${g(LZ;v>Ryo@@}b$aVUP{fkRv-=jN~r zv*ln#u>Y}bWgzy`Px$<1h(9^9lQK1+g=)~p~q3vqrJVoqXzn5OVFd`=x|~08(KF`7}PDVA=bmk zP%(LMLn4!vNzz_acAkh~mIGZDv30@lL8sobBB$^x!RT%Q$*jZ_ysYx$ZQD05En?;tQxQVO+&Dg>xWFoL<`#(jOW~Ddf-KlD>VVADm1tABbB_{+!93Mx&cC6;DPKoF>z94Z@M6u#ud--=<*!$boHNzXZO>;3Y^ss{zr;ok5o4cSg{~KTKSZi zy+LO;mJNJeEaowOlt}@)#vntM_33#E_xD&7!+4q48@UI!NzwBl?$ca`iwR zo6i5T=@R_|OQXd4U$o)=cWu7^ub+QOSecO#^w(pp>|btI^IS#w`T2kFasnoBb!xm7DLSX`g%wRDPHnVHdp|z znjB#F)BUs;sg7P=_&iV%01c$~_Z4F^;3Ex;M<|$^FGR7a0;sD19Q_6IIdFXe@?HLy zzvffrOMHPXi!R^M_C4j9nc)ssf_p6Ze-lgH4{UiWP$Mpe68FYS`PkoJ4eeRM+1RhH zWn}%+%mwH0R|zWtKzKMDUQ?6Uc!xEB|Bez*8Tav`6oh3WMv<0>Qn%b~p>xDVr41Zi z?mWS@VqFI$DiVrtxZY^`M3(b6%gs2>q?eZjUe{iZP_`&Jy!6~wJ3C^9LRu%uQ%|1N z_3m&2KIQqWv(7N{`wrGnDj)JP;5_HD<$w%BoMMHx+mNAGPHNREnw9@^7jxnT3>Cn) zYZrW*ApG8jmGs{49v}BO-p8@Cvzw7d$+Lk-16xcGlKaA1U-c?bHfNBUS1=1ho22E`EfqBxhAJ-kmZ6Gz!d$p;F7%fV_ZY}3&3XJao z4&iE6P|K4(QeJjAHN6sdhF3%yan;NoUM~!YVx+fva9VUkn%D%k{7{p_ZB*$ImXyD{ zopSaBg;F`KhK8`_8DMJn_Nok^jR9Xn8@WvZ zwJ42YQe~W3>G-bl+%!0IlYu+9!+1*sxA6HGPRpgO>wn^xvq{5?m|G+?^klatI-eJk zN@Haix1M-!q?x2Dk?GJ!iU+4SX&WG4jXf2KlUV7N+$g|fRq0-&jD36E9XUy7mTnF~ zJG?mvB!0gLdPlc_j5-MGa4@-kIF;OaEY3x%$j*^#n^UCcFyqW#7WC4vRM}xmSvV)7 zlTN}E)n4YoHAVPm)&!{i=@U0WksjQpCqa;zXk)5MKtLd>Y4&T?4c5ewL{G1}@aX7L z869%K-smD?C$y)wR1I1pA`e35tSs&v=YnAZ;8MB1M&1(eg9mrxTNcWh*Po1h)p#R* z5IX{jy0=zrT$n1e8O2{1(D$}PAq|?_(Y~AzJikMHf*O0i&f&VGo9w64OnFsdV-1K+ z(&c7>n=H@CHb*X~+nSkWgoR7B+p?+BIEizlkgUiR=^#CVe)a*5c`Mjn=C}ihnE@nL zFVk+>EA2&tx&I;N)}J}wkRJd@Bi|%~{JcC)ZtgnUvBEE3z7!Vne3rgqQLK|xxP2_H zq#4HpE>)24YG`x>Fv@|mYS=Q6EflPLR{k-@?_)#KCi z!rC{b-6bFI*Ki|5V&^w*HDExYtnzjRQTJ2n4 zUd~Ytn=<9hnx#C+O^q@`w+`o3xNw?}Rudc5JC9pT{0c(VJW|&`xg&Q3AN%5b8vquk8>eeYsC{`-9fM9q_fMKJAa zHcMLCxSm8i;IKG%gKBd*vEYV~QNRAtqTWnvn0q4qny~$TeXO8r ziEV;TYnFK$2u10h@(&M9nA<*cyBpYoEwP=R5?y&~YU{W$<0Mv+8pdlZY$kgYH6k)T zsZ*1JJg5k2TPlm!0^&wRP<9hY>7PkGOFO!P>>%xHcQ!&tmh7zkxkq z)!rJe+nvGje%;?bmEHJ9ayI6Y2-nXnUAZ+g_(d=L|0MXTBRiIF}P?R@w z>m)y#ow8W3t10R1bj&fsF1&t)dh`44du)@jOSLWkMv9Au2AT?lR!MbKolQfFo$mxQ zDn~TOx=6eI{XTqw7eXb9K0togcV{syB0^P3Nl8P4O6F7YYarpuIND-co&V!x+Dg?F zvU=^iD-s#(m=!nA_A(h=W13|&GqCeH<`Q9jme}d^U0#gLw+@y9JD$WA3wH$dOB}{^ zb2n&Mk36`EYV%%{0}O*`ay(eCd#xgwW8qq5_sWqs(5(04?)c6zbZr~6TF*Aq|Cz1| zcb_m~NImj?iDlH!*s0u+YN7Q>3b41<$W$~HtTWKwyumGITg3UDm5R^LCZTK6 zev1%m#c8a-WCcV0QRR=ot_3GzbWp_mh%0OR6q^_vLi!N3YEu!=moFD0w){3X^D!r< z%S#>eitt>SVhT`e0wtPUa#=L>NCau*K;78p@x@r zG5WTJ?8bn)0V`s3LrpX*3(j@+J~-$km4z-G?G>vrF*u8w&gy5 z6s+DU#`O2l@cR?QLAV3B#Ac#Y_R3^nl=o#=9}!FtRJf1)`c=c=`}TYS;6RtMz!f3I zwQ5_`^=Zm9_aRf-@4NdPb>+yKvb7fHM59FxkraPzrkU6z_>*YEoLYhEXl}}KS_zbG z?YuXA%4!a`&$}OdHhBXp846y<3^dWPbz$Oj=_1fZyaq*x^r8D7|9=9dYXCogrxDL+ zCISv)dln`7zc3m~7O1q1Y4LyuWUx=$bP1-p$_?xi#WJgoh?H6WDf1 zcUwR3Z`V`%>oN@s+aB~<6y$X0{Hl(}%W=3%4n_{qai@C3#KeYaaIb2>lFCWTsmEBW z-#~p81txav2fD>RBP+w^Ij(^>xE&yKi^GGtYOL8_@QvEQj&C&R4!mzB%V^g<*&oeL zxv3AvAqL}gAF^cSr@!2PF0b}n#iE5*I@=@3SHF$giSpea8D(+ff^XQ%#*&hC8H#cD z=;%mDNI+Uz-gL#*S)$N8ByiC-pf5pRFgpkxEuv#B_)N9BFjDaZF3gsPu>aoGW@J8tG@t{lZ-F+ zGTT*`z#UBf`V&Sp)l|=arD=8BU7-N{dPIY*{y7J&J%O8VG_6eiyx9Xa{+NX~Rsv{tREX(T!9_XL(j;3R!73=A?#n z|7Y0@J!x|ev;&JPl=N(IZF58h14uSNjXXHWJ#zDodT?1U?X9@Qqrcj|C05#gwOEigCyl||TYF11Um`!TjlFI#u_1;P3G z{`#3{$Tq>uq4ZFEZ@K2pug{pTQNGA-4}He>oH#V&2mIGKN~hqH*8NQFRo-xgk}teU zYFY4*N9Jy%-#9dz)f6?qT>F4vid1yzsKYE&(`wj`Ja)TOR-MwP!KL&5N^n(YIy5bL3ls3<Nu1O4D$~k{yw0| z0r}nk6WHR_UIJ=wzwC4ec9feW2H}vy1d>p&-umn#l>#ijjV}WP^!jL>kODHd;qI+J zM65|Q05usY5(Iy{uzTEr{2P&emqcJH6pp^}O33f3$>VVAQ+i;*u8(lQ+4s;Tj~}V^ z8RvYxJI%z*AEYi+aWIi}emFH*7xdo$Vy(|~6KJ83NMyV!EzPtooIaSGUV$~Lsn3rC z)?p#AVP`1dk4k5Umo4?e1kCokb7HWpBU9Dpn6{io1Fs)NYz!OA$~SHR&IXUAZ*C|@ zXDRL<5C{66Hd=Uc_7BB%&zHu#xU!Mpy|HM?1^TE)ZO>x1Z=F}tWT=Sc6MGi;JDU67 z90}qzs(g3^G*^jEeI?Ob)9+^5UplJRN_2D_Bv*Miet&Y^!QW}@vyzbHX3)?DcOL~b z{Wc(RD$%jCw$`on*sAs15wb_Qt&NvF2$Vj3CITa8T}44Ksw+G>-zSQFcGmZM!y}|5 z?ybr%hE{1BnLL1X?I({zmdZQXcj6pq#5(l!suG3&hgv@I*NUk8fl-|*xcMs zcCEd#B|&hV-9%~YgrFc?U}^ezaMpkwbA-oA!$hoIAS3xz*JHU1tL>KObmNqAQV{dA zv4wUHPJFc9xDtpmEvWbEt2pi&d~T2ctE!Pl4{UN$JwqKs7g6ANUmWSO(tQ+quc+3d zWe?%#Gas7~y4af}Rp-|`brf1yzmWkoIeO41ElLH%mG)5rpNip?uqzV&* z|NQwD+ZtwXZ+{MBhIN>ivF+QR;tUbfPJ8A+c?zH3$>B9@>sV1O^tCNN=)TBADbjCc z_hU@NIz9P}u+Vv~Grk!W6H#%6aH`_8B3GVTxqiI1K1;LHawlVM7AI|+WO&>Z)5o|h zj&B_up=wjcZ=w6(geD$@z^@b$ARU?lLtXbvK6v~*cm|^gyWLd@^Ealw_0BD?b<{8ZxP+~%YcD_!DJ>b?UAtk}b6~(=akUp*<-W%fJV7*Z#a+oNx z90?fEVkk}u1a!Gr#ZnA~Z9C@^bX{Yo$ESRDI$7dIwN#VUHR`u178HL>R-Ajaeo4sf ztnQ-8*BP3c@{ut`?q+NHqVq7#u-BIR(D@SH;l}S^0__R8E$@!KyO~g^-0#tHu`VB!=X;9;t zsXxX8+Z=)-1{t`X!V;nNV=yJ~DW{odii%x4z|45X3bZm=&H?;<_%NVJ z?!tckMU3$Nt4qL6-gp?G|5gL=Uz*DQRZTDl0Fv_+3{XbKTGbaqRO{k30_58Z^+xdR z!NuR7E?*G%jQOfDQ1s~eMFW)AE*=Yzqig_*UcSFjKM!vG|5yH3ICk}M%o$k{yz3Ps U*(88aOh6zntMan&h4K6U1Hwihwg3PC literal 0 HcmV?d00001 diff --git a/package/appserver/static/img/escu/Slide8.PNG b/package/appserver/static/img/escu/Slide8.PNG new file mode 100644 index 0000000000000000000000000000000000000000..328fccfbf7e911d2c8a39821c16e5d23591a860d GIT binary patch literal 220471 zcmcG#W0Wmj(pR>X{mIU~ar}7s#lpTD{BtR^ouq~%5D+iYw4Zr#)Ms@mFtaS9X1$jEbP)4ACm0#bGg>%b2LnevF%pESrp7#bQ8Dn7|^ zitC7RzRfeB$X!8!qn@@0{SgXLYfGVAt?l>OeYwiw{QMmS+HM^L^fMFW|79F0K!JhW znEM%|9d~f3m{mnZ0cJzpifZfYk-fW($w4xyw>=kGk}XUD8cmSB)jA!bTe+Y2eXtB+ z{A?=V+gDc%ub=m&CgUm4IirAWq|iRw&tYh*A+s-jU+U?OMbFCZc` zFo>Lovn5!pAWW!$BL?4>NJLeMJE+8B(k{E^t!DheH2i;Eg7B!^Q&m~Lt2!# zicojFE~;x2T&%PEK^wc>d?uw04>i8&HMYj6Nax(PJ1|7kTj*7B8_Xv>_d&DywkSrR zoz?(6uW6g57QI%(#knJ0j9VaqjMw+AZidz8D>7h%PlXyck6vPXN<)<0uD^9Gbx&ze z6Ke{STGXN-JWF41iA`R1C$|T}6CAm|E>v94r^T(drbG26UMLNe+h4ec3_5kHNqw}p zW8TC`8EC*)vF8nJn z398BX<>NcChS)~&deIZrA2-Z4@2+=$rq!=ETGo6&V*giulh7FSrO8FihWBGEwrkq^ z=&kRuXAwu9&$o-&W;mUV!bsiw=m3@N>*foj8eu!zg;VcYTfq>%S=#_#+j|^g_P8yDQoXlX+XDq32Cu89xtJcdwGVag ztGD;&o~7;9oBN7HkWH+Ip~vgwH=|9k@PDQdToaJ@aPZ+-uym=m)XCrh*T|D@AkV2x zUTh3@@1;IKGrYTG49|8R_0noz=AnMy?yXegf6jo8A670OLEZSl^t?iH= z+CZ#NwHt4M4$jNZPwxf>6@lih(lhWCwql45-f4T4GyX{~Q5iU_N*&Q7ow&jOwi##K ziZ5PF8VV)b?tBD4BCfQ*S_40hwk~Kg_OykEHb%@kNDK3`DjONm+FngWN!QfZj0LL6 zHYm;!HAX7p&Vf*k-YDX>e*AQe5hU~-SFSvgn01I2=6QrkAcNQ(+3cq{b-XeO9-=!r z`()oXW`8ZMoV$B_1AsnR5;KBSN;^N!^X*v>aXmWogj341m0PlCE`y$`e+Kac%{8(> zBZL^$0ZVm}Pnrr9CgV7n1{FXtY==xDnL?hAFG*KrRc%9%C)q`zNJhB#lM14WGS8wl z%{;>tD1$*Pj`bd@z7F*sojR2>d)zXuPaUoWr$k&&zO8;R-s*GtiRNWG0ceJ( z(t`%6l3hlOhS=Y03(!gR=akIaPK|at_MFA2LMc>mdTJjK06>H$vU?ZJw?PBzd4gE&W9o9y z?Lm&qEw;s8fGCDS1lf|Jg7VujW=yYT9Ga1#q}pS^poEpsWS^Qr9cCh(95eCq;S@q1 zCKOlzG6UoDhcCOkRl#8GO*P~K&(#3oA`&JJ)-8AJ33tR5r8KV8&fouu{R*)JjLOQ+ z3y;OxM+?LG?%=Gc_GGSy!@|B}NB{QA$Lf00qrneVUE(ZTD+YI?**%YQr{~o=;qczZ zVPgHQ^O8xSOQgMBh@$CNW0MMRqpEZ#J4r!#yRk6;z^I0lM700o6m(_EF@2(=sDnoC zr;-uqTCJkQ{BL7d9uXZY>&ULT{pR@Des1)`W_F3HzK?9&3{O%c=~q=Rq3h_Bfj)V2 z;sN=V508Bf780}hKAzkLrgl zQjeGH(zm>uIXKhE4;#@~ZdxTpHNx~1Ym|$G9DirH+#bdIpUp`&(sMT%^9rr%&5o2% zP&~6m$S1Lo9I(t;*acnJs+WI_(O~tD`*;XC=Bdxwy7#>_@N90b5&W<3%nGC~jN<_cPh(f(gBwakW z;=8YTff$Z(!Nxcp;k;{3Jh&EhMHkY4Q&ycV&9$JCoq}Ye=XCcw`h;J~vBdJ1;vjr{ z)P(X?t(~%C3}jJnSSUF1wb9hKKff{X2RW128X9~NhBi??&R>dT$qq5(BOyd+pfWKIeeRF+w%U#GtQx_;mFjnIz+>I(kNx?TAWx>5%J52G+M&>UPMJE;g);i zp^-iX{-*~iBArIR4jXeutJ=mfvP*bM^vl|bJ2u|EldIKfS>FEbUUPh{6aOXlnjKBS ztp{RAq6nD!3_a5f4|H~$>iQ;cUtFbdb-`-wjn#vQIK*3jXVgQ?PgJrtkz5^IysAm> z33#l=vUc{K4~>}k$$L(mT!eQP6VyKjU3eP^g zVfK}Xg2p}ToZq_+gxbmVNe*CVe*;tdmnSY28Ts5ipy`kab?5THwaRCCc8Hv-<1+2> zW~lNw!)I=>zoO;6JvSF)QJqax(dAKI5%jOd`S!W}!a_oFvo4i|4YujWbn4?gjD(ph z3#=aOwDIz7`)hW&WGvUg-ln=UnwdEdg)1fJdKwFN$!+*_YP13=x~n7Z+41hB`&c(U zix5>QWo4|9WN=YaV{GKLz1;(B-O{4Xbgb*cBi@ijass2k$-Zqh_(PU6H$Ty^KE8t- z<%ne*n3!JVebX?Ni=ptzFC(L0C)TF=vl$q%52y%BCeN=gF38df-6~yOn~X#nkU1?( zbJ)pL%+sN`EcS-tS|I&}Z=?e!`|AU}cOyO`)=ERpAmscwV;xU^cM6fN0bx?X2ZcnqtcY-aTEm&h&#YYlSM`K z*v}}8D&~e4h6Wj0X?k$RtlVs%Q?W`Wv~j&3un`u&zP8ub*L!IFhLk8S1d}uBSM>d1 zlg|i`kP2Bhf_$k0v3gn|GT$rpNs`KAZ|8vGtz7;`A?!F&8c)YtG*^|ImD+<Xr~J$}Nl#Sm5x#kMEUZ3b-7J*5`59r%n!+$Py)HdXQwjO5(%){s*dys3+S zBW8Vh;|}539F}g{6U;KqklJ|cCVItIdt{!lJLEO#gsgM*W`lY@_FGv2jl8|ZI9uk< z6)l9Gx)dB@>T$dJFrjh0H1;UhF~7(gk9iS#OJ<;km(|`j4&p!fHP}P2r&Ix{-tVhO zo*d&yf=kxs&Q$lO1gL+cWUMo2Su%vUp@D__cA72K1mgh15s;FjGKDaVcmMc!8|!>K zZC;-^EOm)ZWp}eHMwyeCNV0HuMhLt`K&bODx`CJRI#?CkS|mE_%JKU8n#4S@@eGBT zUC1pFvo?5gg4033qwMmjDnv1>faFj-w{+d(=DWibIxp8E%-M!q1nUh19Jq|%<)_8w z4{=srU5yUv3-pjKWo2cxGg86qboHZBv(!FeUjW|T#U90G;{id2SK-SGG^V>)8aYk@ zP!XB>L0_%imXMsx#>z_i>Ww=Tx4NT3xH#QG5ql8BjN1tk79DA5E zC0^1V`pb_890LS)Rc_;>0_qUvlo9t)GRt83Q}F8zZ8h7vxHe>Z=N zqc#ZrTu;^sb+{h*rd&Czu@QJa5`n{5QtI#$fti;y&d(PC4ecEiinU+BTS%EzFnX)clAwns9MVl<8& z=T|r*yP}9tY{(VDE#+5DjV;({pP;yUPseT(01&Xp1))Xd{q;e3vz#q^lGhh^9uf^FEP<=bAt{rb_KpZlM z*H=-tw{tySb!L|dDuPo&Yp)w5C6{a0)m2p%=>2#ngcWZ1zE2ByC%jF^@!y^sm5M=O z;eWnnJBQMu)BdbA+w$kg(Q4iM)*t_w{mr{`y#Yr_1fa#NG!^KVs0NPV%7aY%>;8%-gb17g-Cu$_eM} z_;mt;hcaH%vO@5B7+eO#L!_{kPqF-${~Gi1<#Ma$4<<6w-AbrdqwBfbS2Tvg8a~o3 zt>@#Qj#l?Zfvx?_6df};J8zFlnD0ZOwJn3z?p5{2-Wr4NQ|ytU$cqYuuIJ0k#@pkk z_vG;Aqan?f*WIKP&DztZH^;;c<+E9UqGH^LY^yC?byXD_Z!8CFN_ASdQ!r*4TaM>t zoBCyFs-BO=zpD}I_cYvDEY!kx{gB>jQ5=VoMVWwQ=L@ol_qOu47Q$jE_Je#(2BJI!;j_;A$B33 z!(Ln8qq|D`bu&Bdt0ph49vZE8z0K{rK3D!}S(s(AE7}D|Leq~9t!To*^_&=&g+zaMT0BfaPc=ViDi92V`A z?Tqw_1L5ZywgYL~>%<_nUVh#`v)ID!r1Ls>yiVO|6)>g4UF=O>rOFIeZSwT=z0dHr zq%dAa`mDbU#^YHm?zxE423-Mr@qgQVda(w!+HPgLhJ&(s&}%xlmqA2TCOYb(?8@g zK0mk4K=jzTzBF+hEKg%0HU#~SpWYt7bVQq0AMZiWGNv$_cJ21*uL!X>KF2!D$z zv{E0FbH8>Vt*PX>C{h$rUoH{Eg?WWl!idv>pD6SJN4~H;JS-yQ>VBmiP1T$XT0=^K zg>KVf&nzp!ZRvLV=AW*~o|=|~A{Kw1VJD#Ei2i+{KMEP-7>%<=S;F}}(4UZrOj(tq zZG`HS`j6xmSd(Lz87Y!Qs8aP=S^K^}v3j^d$jw7iM(qRoq@;(K6+s8<+a^h1+A5{S z;1h87m)IKuxv_o>-7Y~wknwJ0ktuh|^nG3a>8L2oGCE*Jr?41tIh5uT+eIX$3_0*! z)PV8f6jnfmA#<~7k|qKlzG+|=N2X#|O#zZ}2u2Rff)P6l!>wK_Q^}bDKCX>Qo?(?@ z!KF_Y*1{d%jB@g)7cyJ*JQV zV(h3#!sy39{dRnC#WSp6Y{CDmcy1)EGedrjbTRT!TD}ygBPO||8udP*sH71khAcoKwCe4+?M^gtU(dL+xLwNC$-( zg7*7>hS)-=fDq;w2taSVT^xCH2PvlHbtDLo*6p!#7W%LYnhjkQG@bF54EP~9p-Ayn zxXH?sAJ^{;S|31c=YQLMHaRyJFC=Mb@=h#L9#oMYAf9ikxew~ zl_ual0(}c1C4vylU&{>7+&e0)r~-wY4*hKjdNOzzEGjslIN2hmE)by`vd(aiSC*al zyo#Q3#kg&{JgAxTgCkrb-Q(hrv6SUq%>jvV^lQb2PRmUa^au}s<<>ZWL^YZ#| z3+84cRVjRH2#gzTc5rGskB0jjSkZ+XnWF|j%B{BzF4C2?*H*X%*D$dcioi>rvHQr( z%#5^^XB9JYL5X<{OimF!`2LENl97}YIiectSNcxOF`SHFH8!oIz_nN-G_k@nvfMGR zxe8AUGO^p7rWBQ$EW43l4gr&31z;*i#ReBG#Vi!_44Wn$9NepE;~OUXt6M!<;ZU?; zm#GHHiaTRu8zqm;$fRGAL)t>%tCzcVlpukHPXxU!=tm337p&xn*4`lC8Em>IA&D`A zUMlp6jb66P_o~0+5tbEsa$=P#*G+EFdHt4+L1K0Ds{V1s;d;-^1LNb+s>77;z+d7x zFq3XPq#bBW+Lq~ge3|Hc;PUjtSp`K64NGw_OnNZ^XE56SyfvZ_DzmJwzzqRQqQxZW zv&gJUIa;UN3)~Vk%gH&}n{3;{(n<<}$DQPOAKF^SrU=bYGTE|~pJbt5Sx@F^zZaC+ zT|hMCz}a2ba-=;4#?p1-<9#&m%ztS$8UeptmP-e74~*qEqpl;o53T7?|APL&l{o4s zKoBG+@n6u`t|)!#Rf0cL2mnzKb2;7A(bCV^OU*lVrrquRFT9cng*0fH5g;X_`bmU@ z3a$k{3IQsxtSBiV5!C!mLVP0}kld^z@;^xT3HGbwAThT4)!+g_Vsp(f3CH?C-{ZOV z>;>WJr-X(zr~3NC;oBDe^Cj#uh%U8lMci*mkQ$p47AEEqX-@CC0m8kkwar}ipB5)@ ztY*FJ18ZwE4JN8rMUg?u=31?|tn3X;JT9YWm~=<**>=u=R?BL$|xb)WPQ>9|E03ExwCkH1f>8WPb z#kNM~r3Y>y$uv5xD(O$&{-Yu1>pSNX>VhIwa^T&|6mNFFN0n9jb@Ye9W?JtILVgejU$cb}Q zJD3?x4_u4fqT1ERb@k5j75Gs%4Lo}$Yq|-mTtPgX?ZPzR8;ymoeleq1S~QtJW;C88 zg)!@8@AyB)C%znN4+d{_vq?L^V&GV^=VC8OA~R*L15_FP zTGvTQ(OTl6%;nrOxJpj@vof+oML9Xj0u+IReU>Fau*e?KBza<$d?ELt%mJBc%@gI2 zAcCv?(W#S7H2nwhU!Y)O*TT-s)NBux9;epx+OyK;=4GVj^R3FuuPQC5l;xjl{F}55 zwmH8TXjG^+xlvqff`>P$SX)zCT2kHE)Zm%dV2~OQDyGjVgjflvzK*hhq@S$jz##{A1Am9?Hjc(f9fv9PxFE z7ppMa=E+a*kaKmNG68Aj?B8Ml@DslJz$)|QevxC!x4U@;mLj}y`Fh&_KK3;JXR$uZ z{E!g9|G^JvH+kakT!avKT1qs20*G{*EBxDd{lIuB{tJE0vf(sI_fRKw;Of;z+p(qT zO@Aypwft}zRrLhC3?2at_8mk%J{*EUe#5mbcDcXxDthW9TQ*iSR8+oQj^BFbD zaKyL|40D|!G$k``eMD8HS7W z;4m32`GBHmliLz!F$E3y&67=5&=N^t&b6nW))A5=9CdsekiW(P44npfiiM56D{%?W z2oNCf)CEicC6H>>Po1Q_U|D3ApZ)lo_!~4OAH9^}f<-{fWwxQAV`-ITlk3=2dQkB+ z_zq0y{^^MZHDYsfGbabXE@ewt=Ps&M09b@V^NUdtVMHA84s2;@nMciZ4QXy}j(F-% z68Rv-gxfzdmI91R@hk(?e;WZ~$gD}2OlW7>3MvX8)|)SWEn9s4l#rgDo}5hf_g3p4 z%NT)(gbJjIH$?THMU_J4oXDdco&$UVV~ZMcO3l)S5g6hE8oz}ZsT5yY?Lq|JX~h4S z!_NU8Qir03U1{CLm88yT{?C!o*=Qx-x5HV{{}#O@d%E?bj(0ibt4j!Hm8j$Ga8b~( zh*HNnAC`XNBmKva^yB;bggFDaf}PR)_W*JRoWO7SjvT*tLUhENZe}BRIjsA4b z#d0knJP|VO2R{6p7~`IMFgSq57lvZI`o~WE^9|h$ZRb&jZcr9Z!<}Ddi&_a~m@3Ds z;ID()Eo>V+gnQk;PAVJhL9FEH%a+((crP8N{&MVl85}i>tls3HbC6h@0Lr_48*c2a zyx083v~HTwQ&|1Q+)s-`*E~Jj%2lJ(>`GpMt8%EOw|MdYNdqMVk4V2~*Yg4WQ{|~3 zSeMv`V^?v??+x9~)%8i=>bo0Z7*SlW(}|9(;a1uMy{JU53z@*Pi}uJ;LcLU2h~3pm zic&+<#@$*=!N{yexl9-i`IkwJ;+4)jdaMaHgMq6G463QRlz`$9V1%?*W zw!$hKE?T9EUX0!lMi$=tuXM#ZMZp%q4R5`94gOs?F%0rQIPvR$-M}Xz{Q+&T|4T0g zBs8XfT0bGUIN>3qq(4#^7eHAb%n&{h^?!T%j^aPf3;)m){%#B34HqzQaA=@U`X8?k z1y>5bw@*)BfoqwgyHCFh%(0wTK8Ga?|(gLnIVF9GGo9g)T4> zr%|$X06Z25ESO|wW`^Rla?7e4G~5Rv{rcqs57iiW;WWatE{>+6EEh z`!cQj|Lgv9Ho7>=n}zU@Rv>7=i(4-|ul$_$17JpoV{-pTbF^$+Xq2n@rZ zqViv>jnKP7e+FwaEV$$r!~ECE6Wz)A^mlq0fP{__?xiI?-Y#0WVnAc#NC}?}E(pQE zOVmJQJ%Xy`iA9MKV?kA##DM7Sg={JOO&lE@>M>gbEvW5l2;B}RGdbuWVienI!GJob z2mDOsH6O~;!L?xUAV?7KYlnmZc4lNfMUX%OWp$W}ENp1sy&wNsK0!i!{#qF!LPST@ zq8_LLTnH*g5T;Nem?*&sgE$ZpL`Tg3oHqS|`h1eBQD?dMJDEnk>-~1@lxR_gM!nkY zu?<6SH!#zie%jOWb4*5+K`b(b@9w3;D&@Nf zrVz?_MR=d)e|oPkj!dQ3Xm=Y`4$FGlCngG1%wL^ua7sUZQRtV{Gke(`WQ0!?A$m?_ z&^shR2kZTiXmX0hM=T&8wmO+BKK&B7YZ0UIc=|xV@=cO;KIgdy8__oX&k(m>+*8(rf>fuINQg5$%jlr&({jlJNDq&MV-=iyw36f~;C@?FMwDUX zg7#egLZd1j5{qqClk7~s|MzWR_^8R{)BAvjAT!JT_M|08=V4W+xZ}OemqEAj_)l@9 zdZimgz%>8cc>&pbQ|+(O-C$UZD!0QGvPg`;YW{}ZlVX`?8OQ+P=2(tXI?cx8bh8|d zMsp@#U_og9wMLm80r<4P`u92Brh{__G%5YGEdcn)=Qf)`mQ#OJu^xnl2(y%4$}ij} z*v~FEv90{>r^{EztIMyg9s^x}3-ESQh56C)9xg#^1-_RB z63NjTp5XZ!#oPlk_uD!{&HeOdVXlo;a&1Y>aiq;i1f|R9 z@dY-irGhq>^1?Zz##+%Un%X%GZ6{j133kR_iv5M(PMZQPeQ;Cb;8K)J*VXmX`tL-X z&aWmqJGjUtjUk&ms*$iiuhKueJe`|gjNuZUZ2-FBicLzz)!Cw)KMR6|O2IDV;{}E{{`F%!_%FlQm)x z7w02LN`*LPGD~vrPrloGLXo>Skm^?RPq9U9;M`4Ro>wCiF1IVJWWwX~XORb6v*P!> zjjwW+UGM9sh4JTE2{;V{SD-PvICZeI(z<6Wcl%a;M`kJGFX$vQFHen(=Jx4bVbddH zBjeWhWY{O3J`Ha)X2icKICd0X^&3uOfj_oZ-%;|EMoO?9lq^Q!I&|+IMuEs6K@H$d z@PU8RY^?sk+qr3Jek36~4l%&f%g>^5idDx84B{m`p5mz(LEeHqGS+X5Obez`GPflRLx$NcfdvAb0OPMoCS!dO~Pbw2bbL&10j*SJSu|i$@oAuv(3LhU&!OZ?l zz>j?;)hKuo`CcZVb8%>9`W$*mrQS%na)l-ri6x?%TYz6=ml%M{a2pX7kL!N_)yAbRs)adq}`v@e`XJXLoQIDUW{c$=}+y z1r$%EBK%ezv*vkBZGo4K8Z~m@R+|VrOP8T0Gby{uQW8*P>yffQjVcUJ_Vmlm=3l5O zf}FJOXHbucLAkI{15K6J;z`55gNHJO#34gHIl8d8ICtL^+oC7*4#1lbxayC#FO`Fb zAk#*;uYc(H*;}Sc8q@X$4v{^>))1S8nJCFb%r-MY!fFv!*my2qsus=tGCUqOrJG`V z(PK{`a#U1XR%DRjSl<{K0mJqbQ-wqP@N`LiN?x7)z-v$jhtm+YO(^m7vrXH;UD9f= zdZTHHWY=+(x}m>w0uW4d9d8J)rN2Dz`0((ZuWWpX1e7*3s9bMzcB|z`n}w#4CQFJ= zZ}`b13iMs3W1<<7V;#5Y^z#u4$(aFS0>`$BDFEX=o4VKIXfVB?_YV*K@qWrJZw!0O zqYXt;!uN6qF7g3I+mcLxs10L`H;4hD%(0~V+;sL;5b5HC*xZENCxf46>amDm5aPiL zR3zaF7o|Z)&oOXiXGryioK7h@bKz8*x&9W9mkz2UCf^zti_vRfr>-^R?98k@lU@iu&< zn!x^+Q?3CZW1tS3Y2Hc3zZ`0i##HRoN+!ViN0wRz^O9$vUet1i%1k1ZlOQ+o(FP9O zVx!+J>u9u~B0LZi4<8L{|AM?!;_Ob@#AvMR6o-EX))Nw;g)l15JYx4}d1yn6a5?U; z3AjglSibUDl%&W^_10J;fx)csb|-53wb@AyqLy%FY6%|dv$vO%DOEk5!p<&Avc7o| zO41u)eL>>!gufKlZ_O3YUoS^ir;jRHXYox*w0T#A~wq}B|9P7je z^H)tZ-3S0Sc5GyV!RnH#`f6%qVpK+EwgGo(b)t2HwJWMXb8AY=0brwcnyIodf` zIRQR0EI5N?Dw~0phFEHBdJOE>_UD6MpEjQ7r=^VzI@5xh;@S$en)I9I&k*|G7wsM| zeJ_NO_jgK)cC{6CMT|JSdKc`|lHEPCq|kQ}MO*B|6s5mOItsoy2V==UIbJq~UX{*3 zW+Sr^of8Acc40-ev%N~Z2Ob7u4Cy)QiKuv8?i<`8m}DN?Mc4^OeT1=*ZR}Kdomm>_ z1b8kl_s{|PE!A(8O`gx|!Dm@fO3@8hRd3`6+M+VvCzJ2>b0L?9T}r~_q2W;_C%XlJ zh&hh!}&T8d#wL z?W4Nya&T7w?%!JElIl8IKf4NtfA-_{PjXEsF_wyy2Q~H_sGgVmVknL*0=CBL{CG=en5&doOIrg<9bAd4GiUcu?Kg>;fuoO-D{3w!Xm*z&<$(5Ai|AFBSoK^U-(3LT>cZSQ^#KMU8Xf3+whJKe2Z&B|-aMF;V6ZS5A~aV% zL3nd?Jgbb1EC;w))LTQ_{&SIgF8}BnUK~D-*ey>E0f<%?ytKI6$0o6Bhxsi z-b~+T+|wXQ4l^xG5>7}=11l1qFpJA$U?f2`Ffq?p@TMpD3az6Km~yYwJY|52d|4i< zB(S>cFE3eOj6lZK89q*!eqt!_;g=X8fPe?s)W|SafPlRu$b!h2jCE;zGGZ3$<+`D~ zrhc(7y$Yp;Jb!gktb%M5mGR!55!j^A-19T1m?QNf7^=HfV!9}Cydyvx3T00^Az3L) zyBZf1&Fw=4uUJ@ojuth(?mkVKy+pN^Rf_2y6evx!&z^Re8F8ox8EaUYOgSYH_+1Tl z39(=KJz2p4H<#c&4lKSLjStYzj61Bi0p?rm$ov9*Hs9d{DE8vZx;_T}f&zAfc)Pz4 z&LbRG^opcyB=)z;*faNmCu9sUh{7x2vVe60!tSF&r?)eQM@3OKVeS%9gp*O(E+-%) z65l|v5f-O5_8KNcTQ%b3`dSVZmEKiMN*GOMF|d8#fop$%zdiufcLV^et&@WRwm_9AbkqwGcnuENRx(2&8>z*Oks_o#`WZ3ZqmJ+jSe&B!j?|@)_+B^JHIXpN zk<~eMFjFJZYS%Z1N-wm5V!-X` zt9dily(3H`aCCo&@dl5XGbhmLJ?L1W_vKc20i7sVnoE50yXbP*_N^cV=@6L`!SO#b%p5e}ORkFfMKvKXh8ykFV5b zo;%YwRb5&&aB}L7mvb^(Q9BwrQ=h{BmhU0axLVbD4mG9hC+yAZYV&CXMg@4QmhJjO z!-MexojI^W(uSrk@9*q2s-8bLLaS5Q%?8)Nbw(hQ>+T~4UVjJR#SR`iOW!DI(HzC+ zABL5I9Zwe*9B$sKN_-_Xgz(_?*=nBRJW7dQ$WB6pzD2os+3Xx|DJNBydUn>8PD@Vz z`mPAlxa(jn%~3lNRKyyKGEZ?TRNn#1n(BE?M~Z^d{2O`}rY9SV^B1 zy?|L1O-xS~mjvvHMu;wdkjTa`W;!)5{(82E)VeO-4CzeNtrOw2D6&q_*}^*bZE~^A zHm9s)mn>vmviMuO0(3GrmzaU_-nKr zm-yRLv|?6f@#w)^HQm;QGcVe_p5sHuRct^sv{PgGDVAJV1m$Ji0!C3q&E?x6(+cR< zVWHy_$i2!vAINoyfp{6+cA#i&n=jDg6U?!zU5yax5`!7?_Obe~%o+4Rsxh;?E_ zX01y$-gx73q0^`S?gH?cb3l>gf9?| z5f#^BBCK_ml}Y;yKb~x7pYVCVugj`b7SQ<2px*P^*s+_DJ73o?p}kcOGFoGUm(Uc z6l)k&n4bcCA9@?XV9B5`X^Aa$!`@K)$aVC~xTp$F3yDvrB@PEp!u33I>NqKuoebki z8gs>hhwtN~eF^)y_@(QQrZ|09f4!0l#dM#W014jRe!|}jncfp{w01}*t_;TY(%c^_ zdZ}o<{3R1md={o>U>EpIjCSFZ*3&W4T+UvKCGF_?mxdriD$a91X$q75EMeQzsslI? zWcb1sHkv57D+(WmR>E(>>(Ayo5d?@g7QkV<}Vy+xR<&5n>8%!lSaE#T^DnmtQJ&!|b zd?_#g?V9bJ3(*o=1Xq*m2ZQ6%@-V&Gpj1Lq3M%UEEMOu(xeXpjIu0wFs4OU{Hpoa! zW^+R3{GpzK=6ORNjKJ{&Z755|rs6xn%MtT$Swx*9RZ{(t<4hKwbdTV?z&N02m+*7+Q2TazdMiB2~%~YjpC9PBa>qdLou`!4Y(owE0(sW9bFrykmlI#I={J-C*DY59-|9f4Bv;-@ns-#3D&ZqkO_wS%jpn@h3 z)*k!L%F4=nV26j(#lE$uD02sE&L>n%dRV4Y0~IYT*bgi`JhXm^~W0+ z6buY?RaH_io&bCszakP3c4-eno=qb=?E|ZlKT9(mQZO%4lI^EvE(CqK{m+*o<+35kREeYXx}B6t0>|)GNBjF_ zp7~gDAYVS;gFFC4!19|s5E|BR-R2x^+*b8rq4;k567e_FM25`d2mwZ*v{O-0Da=@3 z@96A2aby0qalbNZ zKV;5W?v&`z{YbdzM7I!@*OE}HKiRxGe`i?1BmlH)_TDc&b8CJ&&FovwS*W9sq)QjK zJXmerwMi|>*!)Fs!O-C}KQzAdJfLquA>jGeE$~SZ-mNfWdA_xz2Kma;$KqT5pL@9i zCMFn3B^hyx#o%XG^L@pCO1R$`e!#15L^(%~oa|j15kw*i{txNHG<%e<_L`Vz88nep zX=9plXt*W|fy-@FjE4(-A z6$y4g^}k6d|0*l#o-o?ZEVpS)UokityLzxN_<%iM{Q44{#D+%o5xHxbV&s(k4dRAg zg;~IUFB8D9r=J<{b@?Mhpq?4M*$iGu7>Q~>m}J%qltRCTJ!l6^XbyfT1TY@(G|WWs%^^MAu(C zjBwdcl|ugPDt7y!gyAop?{j^x_&#cg*{l3sN{<{4Hupk{41JHz9H>V;xO@A8@wd-i z$u43B5?6&|(pNrlk(|rvnG%dJq)*}*Sa}Hwas&!*8}>JBuVfK~hA`JL#6BgZZHS8b zIcAXf3&zTBk?IE70Ll2eihh9M0WOIdnZu_}p2H_B8E1*&2o*@odxgP{Wc?n>yOkmI z^*4PO4o0ty+X+UeE=OrhOP5IFHVL#rNR_hNAT-&ixtRYWV!GzByZm0cmS?|I3b(+5vc@NnwrG5x(F$oU z$DvE-3ouTbO=5}+Iw?XV`A>LgzVgtu* z72i$`?C11FN(A`Ah@`C0ovnGAm(nq&93mM1fptFAz`7AUb?re!wvg>P@0+-kYmV*+ zY&skkn>WX!IJUO!ShteLI_rjGDE9-)8JQt4+aYK*M~E)t&Q&{5I-zYz_)Unnr=S6z?-40&)9v{{nhpFMKxy>AqI?r zVZdO9mky=Pf&ffPP8e<=eE;un397VOE~kAz?~K`ji8#YCJ$dkXEi5eTD$B~!qWnqH z^o0ChDqECFzlcpO9dU=D;}e-cR6c;f@{bJlrA>*Hp}viz>szY}Ao$koWp(F4JUl%9 z(Zj*M7Ao|vW$P{G$rVkR7=taiN+C)Y*~@zp0pH&j4-|IsjAgib#l$d~!oo-xFX$ z)Q!l>#uluvshNQYmPf=XzX2)&5f%jgc)D0Y1m&Y>8blp5wc1^QCf>p}YJFSp)!=Fk}ogW^$UXF0I zwXHX+%ErWQ#K*EdKioMtCtJL>E~U?!uFwOD)}y-b0C!V#x(KAhL$unj5xIaEgPB{? zg*^%cG%e*`DiFyOT8(P6n^|&6qQ1NV$$9Lc?@cTKhjpxruDzoT4@CN_jkm3kD>|Rk zUq={p+L!j{MU>ed79Z_JSw0>s@y27oUp7IntJG@rX5x#o0)A!{G|`~BeN4p2zO)LT zKK*w2cs?nUWzgXC?a3?3@{-W**$6H;z=9ou_=?Hkb9;4%L90~{Xwl~B((UOhlA*b+ za`yO&(b)pbwI59Rve|BaAFfsMeiSP0=DBLWo8Z_|<8E6^J@$TBSlZTodVu7#h_&r{ zSFw_cDki`&c0uQ)ZF=v@(&F^p+#;HF*@*FdUqhV@mkV5AC{;4ta~ROg)~eU*0qEJ{ zGBu?emu-Iiin#jvft&5!BDhA1XMmFDrQ>NME@w0zFY*T^nmM?eb zPy?zy)4SITFU!k9(5U+Nz{#~L#<(LdI?}fD`LX<6b)AgZ(-n|i(xA6f3n8fkcgIK1 zdXqhvFs3`*P%ICD2>n2Wby6o)tZekpjquG%7O=pSg+M=^w9M8 zU5|-W`8afQxsCXKJ_VTS_#Q2oV$yqmo1aq}_xO!E7^?eb_txI^ZajeMyHalYG#`)I zE36fLz6m0JL^AoE?GuwGz}MHNdN<8?C@9P0D5}ak3h_#(Y4^pot7iT4t1}83=gwk9 z9}jy_p;jl>_T5fOz@~X5S5-GJ)=QtKWt{~NM^_i1AM;8;;Q;-Kw5kKRD^~HKbF<6Y zD=_u3_x>WOx2V-=H6&)+@wO2y5`l5UB$>hsBwm=#&mD!EW@#g+7~UwPx&g@&aC2;G zF$0px-|xo52O==&wd$WAfb@)ea>y;Fx9 zLFbf|z!ewX&d{gLo?7FaDLZyMXF49sO7g*vc-Jj&OsDe*hEBh|lyz}^@tAWno zA-Ot9vsZ^3$@57*tmR>2u{wp=+48y6@TTel&evRWnFVM$avtSQ(@x)!H)HO&d}_T@ zWu?6IMY>-Z{4&bNQg#0{Q@^Y+sLP9NUpGNnn)*5<2XQyTtLx6)#k2d=+TS*H>$)Yr z%~ovtj6X{QB2Gg50cdk#SY{id^Zdb+ZR&IF?em`I+6d8J%X=L)0b+S6x6M(dlD&!z z^X`r-1KwIgelBvN_MjbX5&s-R6MVL9L_GCz+_2WGdXqJ*e4`xqX0W-6{jk~?rrH$J zjUfY@p4%C+k$C*d{^5h zk|Xm3HDGZw(c%+7u8jAq_YTRpB}{NeCk)UE#?wa@K)HnT2eH2$o-1lETek9k1@}(I zBXg>RWJ-IdN~aiM9s6e0$Z`9}!!%W0X}6_IXgiX2wo`7w3@ZS8?e%;!SFOq*1|v`N zZT)x3YWmZU_QW}UP6>2dI9>OSJq?QqaR4-%F}yn6FbK zs}w-2enGU~d8oH*zyCT-O<%J2%nAUAO;*ZZ=SOJ+p1T;0Clexee zTN`*ya(y16L%H!%FeY2&n#{L9i+HVWdcN~zTTpacSgrAK2}^Y@HZg8=M~i$B`ItmS zh*jNF7yMIWPj=@XoHzp&u{0;bOqMReT>@h;>Ek0-UCxZB%0JWp9sUj7z=6>lb{^>! z*d#JjbrtR9Y&(C()2q9Q@j*TAsAr+~0j3D!xQuWu)}b!%=~a84zlPp}c=i~!5bJ2# zU&=f4xsK6^Q_igfy#Q42b@04SXv_b#?_sh!;BxrnLO6w2klI zP7E>E%Dde#0n&a1)rIN)_57*#sr{3@x?b~L)gM1(TlS-@Dcjvpv%4%|b!>^z7^cGJ zCTe5G(p9v*mgN*E<3sc{Hr-zxflIJyYqec_7F08Lo2f3J5jw7TeO^R3cD&c9?y$3H zBh?keaC=;Tyv7tyt1rAj8{FyP@Cm^BtPRV`rBx%Ib@=shApG`6PygA#vF^8$C|;Nw z@J7?imR#kS@f<{zbn&phai+KXC+d6t+4B4I(PFxNY=227v8c&Ce`x<=C=_y)b_NT8 zZWV|4*t01GC4C}1xwO5b{jUi}Z~t=a*J-Z2iHJXM<=OYzNv?j*3on7 zYXogWxL67M00VOr1A&4UaJYmK&g2ADMCyIKs!gDtF4Rlmq#r!Hhn`!JL^-rTZ7&S3 zuOyEEg;jl$Dd&-FVi&6rXDAVm7aOLbamV8ta2Bql8GE!q!Vk2Q90%^C6Y1TR$|D7;>@E^6bzg;KMqnWYK(zRfc zQPG<9og(#&N?`_?g$Ry}ydIYYhjo=TjuPdz(SDcFOHxxNZo{<9(57wE$PZ&xFUS|Z z27t!M{Q5yeU<`gSOmV)GCquT zY7>BOZ!$2ARYDh!vEZam{C65j^M6`kC0?k5HwJL>7QF@1{6*D*wU%O zHK{0qhlrEcn0oVwQgN}03!{K|$NnUnHq#No-BcX4M;od}`Bl%s590AN%1M$bpo?5I zfp%r@aCdwJZJM{_M?9+cuF!%Xc;f*O{h&rT;}kl7xmKKbPX)@Nh#_a*zB9R`KT6RtGmW`ceTey~`MBBkw+4T$eD1B+7&~U$vh@4!Sp-8(B`` zjL2lGtE)!jADHXcfYR@;ORJo#zC#+oia4~|dzGySS7GMLHVV4B+rrteq6&Wb-} zeUEN@S^=MFhW-m84v8(hBHVp~u8W{45r~A~c#wq@OvCVgeLhqzGOKtT=fpLB2pppo z^#ayU*Pv}#pqTUR`Is0Ok!jjry=HsYZ~Dc>x>(fXK7<|8Zjd{`1~I5th8v)vK6C1b z0wJZyQ;>=L4$}pAZ59 zN>AarQuU<$>%$5T>hw^Hxp8lW>PpaNGPrv@fTAPMUA#<|Q%_OP$ zYeySvXL91@R^!)J{LD3}nfmOQrH55PF7+i&t3514RO@|4d&CLJAW~DqqnFn{ z-e88!NH08(aF=^_c`@CNs2zGL#BZar8Y@vWC+)8~boi*jk%Mg!nSphQ!st2#mk!a5 z%!~26XeypF8&~JppNfJhrL92c8REIs$%pz0;@B|dZS?e{P;~+a#yJB~Tq}etS1!-J z#B4;Z+AxP3nC}kz*BEpWo&H%HVhuTW(^1=&$_grl)`YH)QUb+o-h178CdE;W zH^2M~dxcwzluB=eDO6-?UV0iu1qB6dL_=sP_e3oMGwAd%*6KXFihe!9JpD*5!lT2_ z`xD5N!G)X7n5P84xW#F1JmqpIyp>q`s~Ok$4_%8sUy-v@%qdQ5>7Y>x&6}Oa^I#e( z%1UbFp9LYedZc>cy75X-M?G_OMmFXE(1bE}vouU z13iD@gvdRCJS0R#o@M3K_?{`I`vyq3zHg~X=n~{=-;0qe-JXYzj5w(f4}YZ2Pi4CV zrRSDUBaJVf4!YOD)i5(|ThKUNcZ-KX_8}CCYDZ_w5j96#wuFUB!FL@hWb20nMJe=c>qk`IQA87AqB{X4|+{@X`1uG7K5e)Yz0sUM^ z)`3OQ$5trW7ZWIv!{f6;H15GEgU3Nw#9_W691|z2e)N~ngWGZ1zR$_YbWM~)=ZwzH z;rbc83kMZA#b6y|A7Zaa^_Yt;I#mdPq^X^Ybo1-Th$oWwx+~B0g)yq*tz#0bS zS*0{e{A=%dX1i@X8?p<-@AGt!+)nx0yIU_PI6{I%38F0Kwb3R7g}=ouA8A4O&-WZ& zyU*!FD3*E2lC@%ficT6u1+4V0(JPUyZD>4uDTS?BntrJ~m1|Fjt~1(+S0c^&ep#=`us(_AX0mO5ZW!F z28ruS93bHx?_Gt+%&sheS}$%wW+!tM73DJLj>PVSVaE0LZz_@t4RN8#l&J~lTk{uO*AU* z0-3&WrNT|RG^Qom#Ysgtvh0_UlyPAJx>shGm^SZl&+P2(eNyXLF65v~wG!CDKoTk& zxk#>hl=!Aeq67p5{;uO(Um8^KzA=^y>Q2>OI&{lI$@IpmprI8k!u2A3Q!d>bq`cLHYL78* z`iagMuYutoNZR2738=eeM0gBs)P&IHzcRH%^zJ}$Iu&v@DSu;ntIpsQYpT|4i9=vE zVdd?=F{uk8C=LL0Fr%-;ongd{bQ275HQL0EAUu`e5jmoIrIVjW3DBsen*89@F2hZ# ztJfBIwX<$*ocy&qR^*Duq*|hfC|iaG#<+&}{m?VlrMe`Ks7sRqw{*p;dq*XKjC6ef zFprM(eq*@E5qMs}tlT`23(q4R0zGnq>M`vhLda7{#C`k6n_;2ebifRorwI{mkn?h` ziK{}P=1saoU+lO0SxC!gfsLrTrj8v&2gUGcdbcQG!dXwQDzj$Q@|4(mvIXe`_4g8! zg6l!Ef1DB@@}B-7o(t-!Z@wH&Xb5n5JSWWN_*oPE_-Mamp`T`XaqRw{k&=0ZJvAp7 zi{p@Mrvy~m?g(Z*Y6k`6eM1xroxN{%#D=fl=*`W^wB9^0i_8(qtD;`%$w2c(?D9K} zY;L^${fA6(Q<{^TQ)yGGSz!}mu)sb{|66<2`FH8aeI?iCw@^QnUW2CF#h0-8_&gUl z=0MPA5wd6Z)=+KwVY2}>3o535vB6y?OviT6J`KsLr$`j^rucnB=3(q@lZbE1f*+MO zGSLq$CElECTB$hOCqUaZ5lGHup4*7c<9pZ=De-%y*H_A9S8*^y+oVD<33Ueq*Rr<5^lb5&#hl0?TJ(vu=E6X4lx63kL=5`$Faw&R^nWu>~6 zi7U?fF`MR+YS1ad<*E9v%(=?nB=^2t(BH0fP_$1h#o<%v$<@8!7&g=;B z^%n;1kqGRFv-f(A_G8-vLC_4Ulq#!^f0|2Zd07t~#N92Rm));&+$eD^kHN;xK#uNK zW|Es(bgH+X5ZZS4^|G_^ls6+`Qu{$sOxQxd7H8|G? z?cXVwyuQ$n=6NZ1SnSxHc2`I8awUl9Wo;EFH1E<~6MBen0RD(H>|YdgdHGF9!9Cll zn5L_E+ry#!cLBZ3Oq@MtosCY!#BP%&h$^m)vI}M5L9%JVt*bHB;*y=Nv7+r2G!qf= z0iN#?c-|c|i+uo9@ddT*Wki_F@Z=~pm33sKY)4Z1c6pOOS;=bpZF*jLekyc&Vs}VO zT}`B6akC^gb_$AlOL<-)~!C$WC*W(PiYhQ$WQRJq8g zhWnDH%)Sn6@+eYm_%vjMi$FIuHSix4+AWD`ztz*zxaXC1m)PJUK*bE-C2!;*u(6%- z`womDf?g3M%*=ks8p3R*Z)jzS&q+NYt#DDj-`7nURvIa=uJK6xgn88vk(IY67T25T zh!3d+oUd!X$H#pf!iIN`d(jVQ)8+5qUh40T9nc40Cam3Qj%s^Qa+ zC23}+Cgr}EBq;h(HN`BiR(1&3x%uD%HO`H1YVcMFGwHL#u3w zcLxf$=uq%*ya7`D;b2~4eNO3Uv|_f`>=kFkI!osi4rxwuoY+yaz?8~JCQLpz&d z@n^n&qwqG}_5EDw_)nT@km@?=Z)U+*bAQCBP_|n7h}x{{xk%3`>giK5W$2QDDk%>> zI+Rj!Qj)qP9P0^asVW8gKQG>;wPdb;{%CZN-|R_zAWX>lT1RFgPzJs)h=Xa<6r)mN zCrRWQA3Bvd6gTYVmF?`z9G2HnMw0DOCzUhsE^Zty%d>28ehVox3Z$IUN@z67Y}HC} zouqr1MNbM?oMq`;2};U(QXVzJme;|)DeA4$IJFT?#cv2=I-wX+8vWSY{ADfdCg0c1 zlwDSEbGZm9W{wRt3R8p;oA}i`?17oj>T+PVU)^%=7|=Ne0z4Gxt?{`HcheJBF*A%d z1S-6&5+pe|NP2rFg%8@Ha6>_8hC@4(LfUE-%XF-z^1sD>C4T1jcRlGGYAnbq%d*naIMHh&N>}PxQJrBKBBTFRXU)|rPBPx|LaeZ>qeik!Iqm1J> zH6Vozeff9fTo-nT+0MgNX+EvY5N>YV-;_?M=wsBpWP3mUI*Wq`%P+6Z_Cq`rTJmq2=G18RJHa{O?{mCQ`z~<1O^n6DEA+{$^}8&cA0T4ybzH(Ujjg1Zd3yjc2wRzz;*if>PXJbQ7A-H_1YnS-$H>Loh>k(VwSTe$(FL>tZ zHs%)o7BHZz0U=bKFeUT7%V-*CfYVa99L(vwRz%K%k4av%PzBDAn+~!d1U;`R@m*05 zW|6s5obB!>-QzDK(Id}pTC2&vZP2>z;@Y~Zf^hR9`e0t4&?uA8gFhy35VPgc;4cKo zy^yIQZ{T-MRgHwzkJ<6eH8QD_RCKxf#Drqzx2)x|c_OiW(QKINo9dMs5K7z1WqR%7 zlb#~=tTzH{nI78Oh~sm(!ml`=^-;+Tsjxyf2Ze|!`lm7vpD|&+*wyw52p$NX>VK7W zh9!%8->??belDsK%(vSglEB0G@bF_9ZO;N_%Dj*!0uP&CwWTr&JlqD)aYV|;=5i9C za$aIU;D7yRKdb0(A0A(4e6Xa-+ZL`^;^OlVL$_FCNc(Ym%Eks3Bq5motfM5KneFrZ z$5P@%PTuT?z3)jy?B*;Q(sb*?7Gh$y=fO)#PU9c`^7r2Hr#A-v=gXmN*u3)x7u#Jn zkiJUouFZH<*YU-uc&AfM(M+dDUL%8;87nV)j`0 z#QruMb4Rx#e@P*l%GPts$}&qQ(*5U}JsoOwU5nVXwwRcr4`RtCGziJ_wU$3o>C=k~ zGkk|-3ZE{)zuU@wIop{FOHKfjJz}FJAJ=8h`vMgOaXX$@0M9=9j(f=+hl3yqHhojQ zRQV+?87ECK9oqyd-aXiyLHb?mm=rh{pgozqyyL8H> z8jhr8uit+Cn4Qy_jJD@q6?1~uGI9uR$zmEGfNHcQIH1Ugx__{K{|^878~2pTNGkpl zM))fAHeJE7uaEVY^_nkq2>J3#9w{X?e@~M9uvZ2gp4Pf|1tLC^W7u6C>nu~zjenuw z;9MX1`jUGN)0~zszZT3MDg0ZMm1u!5zHqz56xaM{uD;0kpZ z7h8&n9g^KIPyHjw%wdIp6QD53M1E<~&;ui8g?Aym=KY>{J%wM_9$1{ya9EU^NCNi5 zEPMz{)wFzFP%??WzF|Lv5;#8*tU7_bCKlk4I3O?d)b>U@lz^EwBienKtvJYl6UaNl zhW8a^#?BvA!x1GKlqd8UTM|b`fq`7fK~bSNQro0(+}79Q64(W#3bIYJ!V81^fzm#D z8!XYa`{M(FxWBD?+1EuEwwv?)KD(O;Y~SxL@0sK6MtS(aVYBb+*FCIoe(w)!9<;=5 zvkx}z?NDUD48WVs^WC;8vmDA%&f2M}OL4@Q8e|AgGMpT4rOy&xM)b7-ewq{?7cH%D z4>ptCI3!U>nWnhC8W^m^K$;dpD4j;R^VYjdF+Ot8Mrz{IkN-`3st;sI9IN7Dz(y zaTke{-{QsW3NX1d{5YAx;^1)nhhxd>`NGBeF2QrrH(fVliL#(;!G#k$ z-O}m0h=U){NPM-B%FKI>sMLSsj7YDbcjX!UqxF)`I^y6^qb20RafU&hn!28O5>pJ*Q zs-`yFk&XHM%95+u8VF;>zCd77i@T_Zq^`Axpha6Eey9&u2~w)!K_jd(Vv&pY*(40w$O?(jWcj=N3g(`*K;MW-=>kip8{(?;{nW}KI=siDSeY%sgs(D5z-48Yn=;3nBtWRuPFGII0IX2My2tqixW)=07dtlcVN#Igj~qlTqO=fnfZZU3Sui zyA5MM*XCclLvrpz;${R1Y4);u1btboBaMDndElgT!=bJx=?#hg8WoZ(s%#+Lsh^8# z-TZ2L4vJDYHrwm9Tf65i1Fl7Nb#l@Xo2bS{)`fEF&`}IxJKnq^r2XBocl61^@_;Tr zDXN=dtB19&bVL2=dU7vIJ89`cc$TIr6z3%MUfd^Z=JIQUgITJ&>h>6Y2w}PQ`y~Iz z%?YNi%dAsI-OjK4T3=s4#ngd^N&N)*=^_8egP=a;W*jOlDWqa~L;GI%mgfm;3lUD9LhiVEZ>ZzAC6RJ-Aw5JhF#OsLN97ooB{I{6 zVDMHh4T7t^L9KS#mzV5lyE-DQmVlm)z`Zx<%BsiodbXvB#dKT?wXUIiB|9Z)Q6X)@ zo#SnfL$BPF-=raPh7yAV9C;D@!<7oCM|A~YaI|voy$r*Hl!>HKOwo{&ou*Kwm8-1- zZ!d0G=~+L=%lsP3vWxCU_L7?o#upfztPBFWtHYZ6)pU;@iFb$XH9c|L;zBaABfW%3 z44F};?j>NvQWP<7akMk>^j3HVCA@m+4Pf0z4g?$%40U{p97wDYulUAm08vGe&|;{l zM_)&n9@$NO82Kv7T!nyE0=KX@HVm#VPE7T;*AI`Jg{JtasaFR(hx?~{F5}H*oFjAV z-2-z?P3HjzAG|rvJ_MD~>0?ML=u^-TO0#x_iO z`{>K#-Lvvf#fEyVT7y7!D&&vBltRcrP!4S#!#@>{f7-`320Fxi6Q3dySgvmfqX7^rr@D z%gZ8SI>hwEb|6@aauoRp*c&IEe4TU3CaBoSv^Jk2{&Ogi3F1%%$k;HP5`dUAZtih} z^H<3b!r{F^iK=Z2!n0TvifrLivEFq0Z>{@E2e-V%?3p{z{*&}8?N$?TGB7oDv^1Ri zsrx3^NB40AO?4~e{?sDyHn`flIJw#B?-Og_VBqCx${}qK87ON-3erX{?EU`UfyX9+?6yR-$UEGHfmO6pI~z~dWQf+c%{htm z=N*hR3H~C;DTi#p5xl6j){&!Piyr@k@Z@TAYQ)0Q+B}rc$+=AThJlQH9LSosq@iLn3>(kg* z-_m&ar=t?(SAYMLgsC7PiG^~FOiDkXEzO_Bh^7ne2WqpWl#i~vM14_7r=gpg=$M`E zP^0%NCVe6r2FOt-zXV@fSNE=%8h`-!vA z_!5I~&&tMZcY~9b$v%9-2G^z?{SZU9Un2eDfzF6}!5$1B^$DC4+py{ST*U#n@#9Wb zn9s)}btLJK@HBou_!i4u7(cV|lGDu%$;Wp+Dus~T?5eP15)7HW zjLcmvnjvh|Lxbwk_-5m$G~&{S=vaN|)aWz%E~nIejiJW%C4*>KG9}fmWE{dL&9KQl zK@tbW&Oeukg$m-+mV=#HN+)OUHYr-q``t1UF2z&i4(zy;B%RR*+)m&f7_%V7GKH0? zCB()IewJ96S+&WHUezFj5>Z6m<)ln2+5&nDWyX57;l|-)RX>I>On#0`{5Z9-4T2gI z*t!s5Q%@l|Y1?=hs9y0fem>a6m?^?$^n}8kDI*rz$YhE~=3@j~9jk)P;yLLfxHr+C z{ELIQZv%l4KoQCRIV1uBb?FuaN#fc-A&-{K>RD^K!pCE;445%LkB)x zf-Z4<$yN+gCe#}QX^1hlD4=$-1INb9EcJE5*Q!|hegf3)aROg43!`(*%*nO>w(8bR zP8Zg!xT>p6>Sy}E-z?R;)f1SJotc}P8Pazyj@e)=5I9PD@*%&_{FeIj(rgiS5jV1L z;Mbd#2+l$E4JA4rF;BeTzx-z+Ock1RIULI1u2kF*#=<$naAJZu0&_W^Zqbi@B7nL`(C&*cqHZiIfmQ&EobBm|gcmbCa?6~aKo3$@(tCKx`sG<%JPoZs| zI2Uw4JI2Eh&&YPv+9@uL?9T53qb`>mK|OHx4VT?X)9ymt3bS-vPW?X$u)Z4_=g5`( z#N+Y0X536HabD-ht#+1L&9nCMjoJMa%u&TLb)mbSnEw%szBW`Dmp3wNS4RaDPK#6$m>16BIzMlO51lbAnVrL?n1RyS0@YsFMra*ew0E z6FSk|?Ke#*;8u4}Dg?~bp8!$9a-i0rSWeo;rg9ku{vR@j2*jYh792k)w06KkB2bkF zePstRfeaMbjY`;;A*R?G7#P^w*C5?X(@IU2M2WX6sK^V&DoOGudpxKB25>8xPGm&i zdcD1=!YeDN^VI37DPY(sXvs^cnLn_mL`+&kV-=Afpl4wL%MFJK)8B{ujZtCS^LCh;QLEP4`srz8r6J-Mr{LX{ zYZoq-OuX-Q7VbS%{$aL8xrI2q5-<$=na}IDm1~SJJGHQ?pj<49}IdiKAtge z@aPSUu~?%lke5|h`}nKrQ1|}NYRS=>kW~F4nangV)8rtll*pc8xfaO7+3~TGs;cdJ zGqMt<3+ns(dtYClx3~9Ce?s&idSZx9%mi3KF$fq0CJGe_9z@}*zb?!s+c#!v6=)fV zcu`T&ZZMUmf`WpQl9HO5nwA#q-2opnQ2TPW(eusz0C_WS@Z!=^lvl92a;%5yw07qH z>psZxsOjv<$;p`+`R4TC?TS+R)CcZX519CS9vlB}Fmj+_p_V$&#LQn@+FALw4-d7L zR(}*be+e&E4&@iag;M=cU3t#7*dy)vBLfjQA*)|02m_GqD>-YYX=!OOMod0GKOY|- zr)4vsWc?4Uj>UBJ#D|TtBAy!BUd{M>3nGf_S4NxD}k@ck9QfXH$OEQL9R^J!NfgG?+S#pjO)kS zdfr0e$7Ep(+yVt^^r7fq{Kn62r2j5x&k)sM;1`)%L~`Jt^)O>wxdrCQ!QI=?GqR&t zA^r<=SPIKqv#fo#z$!$a1uW?YzA0f-W1cyXD4`OJ>0J{vN4}|1dqhe4*bf8&pD;Yo zABVEyyafMQ^DYBk#l9fp{FR0P*Fq+ADZzU+9;ow07bkn?8a77e8fQLC_r~073lYbs z>U#cf^O_|_bhH-(=V5Px|Mea5`pi0hlvE8C&hN!_x?AH6B`GSwYbUrZLoqBH+@dPl z;L7ejlH<|Mgnt*Z|4LT;A68~SKy5A1v_n(#g-{vX=>qV^l%A))S;LIiXNL0RSQ{?e z*=?U8MUgW0^2F*Ely!DyL;RvSlc+=z$9qkvoQe9M=kXCV1lEW3^b{BWg%mk%epc0r zcVy|)JDgLiyP}=J)SF@blt2m~o13E#fKp)8a!Y{q z72yBsrTRaA#{V0;58y=0SebE*d$<({;sZK_m3+|U7Xoj~VZS|SwnP4kCO*Om+Gkf1 z^!e1Tn6X!aB$UKSPZ$z5jn*2QiJXrnL71NP;S3!)qa^H-+o`~Yfh+!0cwWAfH z#wKW`bB?A7GqxkX$Ytc69BTITiYqTHKEfH&_I0;(iwgqf@28~}xhQ5L^wzoG0!)@a zCLx{8sm25-!t+x7(=}UwB0nKGGPs}OD(`*Ba_Ey!{)D-Q;hMc)7G3YhUTO}YDEV*D zM7GiB+B;!NN%V+5x+5%+5dTSf0o$TLp@;m~HJ9<-;fG53p1k$@Z~G6!@ne0OnCXnc zDE{-2@(ZTv2L4QyM)SGKfW4Ga8W2wnk8uo^38s(`u8%pci zRp!3xo)n;DV*EbY^H zW)v4IW$ok?morQG8zbfKgx*wA0`-6PnC(F-zLsk=1z1v4%hM z=Fx>@dh5_ygEw2oNh6%`Cb^(gm2$W0iLeJj3YBuyxm;oUbmc!rN6>p?4u(0?8D#2^ zyeS$~NFWqr{NF=CGg?(0u)!wWSJ!T|^ImoVO-l=u5bypN-F-Ff5GI@$0JJ`SLuhM( z1~RY`humCE=RoEbJekNq(vU#&&~PHicr=ITDM*6g0APWONmTHG_-gLBpWC$0qt7Wb zKh0$zqk2cdU#SeupQ~c;3hsfDF!o|!C-j?+{{nIzXu zlPjsz8pAU!NDFS5|0yeY_fy`awe`J?$O*>ZEi7y)Pc+RL!iKiphwH*aeonyCRaUsC z!SY4Aui}8Igll5<*J&+E5=xspaZ7b;3Huugm0i!n{#na`+^NTapF}}>yoVllIRs0-I5SL?ml?<|Bx~C-*#4882EKd1FXYd{!V*kRjD(1M<1kNESKR%jk8w0qT2T@8 z^9w5IP4(Z_22w9ck;26P-^`gN^8PT9%c$>z{*Jac^a#0hKJC?Sl3$b}2q$fC6%!wt63 zl8mw*7fbrWs;-(Ex+eeh!gP6(oTAQr><0JGC-`%5n;bO*&!00hWpn^fW27*y;D2E; zx1$vf7s!qp^6Q4kt9xBxWgPy=Vf6J5A*UGy579 z5eXE@wo)3+ZY)KxK$UOGlvRs7Iwf~43c|U%Q$pix|GDoqFr6)o>(`6D^lu;8ymlF- zzpIRZbhebKogbZw>+e?nf87=1;eR^{3haMn-2FfC^ZtMG=f73U z2|$Ox{8OCl21x)CC{ZUu3Jd+h-2K-MT;Mx+EXY4f+FfElIL5!9MnVKJ@mOh4s31d z!hPxhYsD4ew3G+{I^qf7=D3NR9y-gvMIxfPf4)BrTnitlhP-m@KnWF$0_)86{nH3) ze)9gmVYK?*F za3P;!xyTOq^V1-eFU9c85im{2@%`P|AK;W;z+~xU90+{>^0{W)MW+PnC#E-RB~?d=6lBG+ zE&;iwd zeUSi4vBb+55@3om=W%-`Ocyx_>=~f2+Y&hp8w(4m&teUc$>7UB0|+^_M_=>QbE#jyBd9LWdx>ivAs*a;oF28^KCoE29y&ZmI)!Jcr%7YjA2JgZaJ`woJ@o|{TPBgX?T&mrD0o3G z+2)a80I#T%)dqgBzPyNkhdBXw@8n6Pl()yv$XD{Y&UUiF(v~GKiE4dxN2#5qCu@Vk zZ+QTT4gJ&e#&mOJMf`%3cRSeZ|(|D8V-(Q0$^0tWnFGKtPCZGTBV()KP z0`)-{$XSO#O+7FcZioc`|Cv4*P2sNRSPVyYDSwMEoK)!2VUqfc+#alf+9*_dmjO>!<$`C3uHsr5-|8bai!ws|x7VxQR39)+$A& zSz|D0I4w0M(=DVr&}n+45NDRQkNI5H*Lk&YYDuO@FIGE+`xds}j?$bhRec^dJ>Qm9 ziENRMP-c5MRKWoDM-uW5-0IW%Al-Hnd=pBPR6H~htv=D1l{Ug9=&TM~Z4O*zmwg^d z`vC{GvhC*X=_L{8xQfW{)=LgJN_+3RT;xy5{XY&|4hr1pHQ#mYwo81=)mx5Lk8;Sr zX5T*8ao@gorSQKcS45@F!E`KK`I_4}oG*V6s&sw6JJKZ6YBBQnKWuM(eC+F{bnLo4 zzju9HDcW}2jMkDz0D4J2ANLd5oM|z5J62Eoe=&TvNDQs3T%{fW&+Q$lSs%BvBJ7Wk zg`pf5%=Ob8jBls93?k(D-nTJFDYO}c*yoLIJ0uZvJ7u2@GyVN)zDp?#0K?3dnh|r; z%nC7S*=6odz`Ep#`7fF*4J%vAw!1Rdu4Rw;-qjN}s#ZIBGruzcL__TR^!pcWpJ~ps7RW4tNLzjWNv%4f8Qh` z`^LH2QFAJyS%xacQFRx?<{@ z68FB|89vGhVU4@>d!5-$Uhr4psn>DMYO{}9)eJa}tuyAgwLJ9t$E~+$TCC~!v*QPv z_qNY|)~9=$Pky~X_)SeX>_grMgP&5$_a2V`! z*x4-@(|w=T8+&_dv>EGKx4xM>`usT4{e10Rok9RSC#5XJDH7XPReJL*zg)YJo&{I= z?B{j8NU2@3SaxyOUYyl`?OD6u;D5buyV~^4T%z?o0&3M6JU%8+p}IcMCo~v+J0osv zG~Xxgk~{WI+=qF{td{I!e5*VjBZp>|k(NxiJ|53}D_0(8_)#YzELJkzZ@WGyKg#FY zU+#p3z_Qbuu1f}{Jk>9CJ+4MS-&=a_WEs*qKBI&+H=CRuUQeo5(lPnpo}&gZ4Fkuu zK~??qvU~^Fk#|}BYS6s~`XPLFejMy9>A1}~t+k?V=34RtZ2HcovZJCvGec>=Vvh5; zt{$JDPtp6@N9`mtsI&v(b|z)@;ymUL=f93&hW-$%SaJcEt!_%&TPg1P=;{h}!@G;% zd)k-0BHVbcl3lD|;X%Lc|9tahD$11B>OGv&{F1yz`Q70pkKD8m?DOSeXG+JLg5R3&GuOfWaZSySuyl%X9Dj18;xpRjaC3 zcdt5i_L04tDnGViCW1W<2m4^EUmsGkbE~6cZvDv4LGj;cxgyl|2Y|8CX4qYJId>mpCk%ZsBwF* z+2DO4MRA@XPDJED0j~u*n+qKL+ zg9}!{I`_8R+=ah*>rE`&KB5kT$~K+q6HIaNHOqf3Y7gfWxjLG6!@c|J)W2q0ohif$ zG`^)Bq}ahV`CK4Ae zHeOJrJCpDG+}K40Vsx}7Xfxus4%dNDqcBaI%Tr{3rz_WX2UE0xkNHqwhy%&m`xXn_ zg+N%ezEEfO7XW!*Z;%d z1B82=>hm`6EdN509T)kz3F0CAfZ;pOvMCJux3ldqA8m&O|7tEvKLV*Je*n}s61AFa zhp-d{8-1SY3P(~zqJb>eq~XdNzn=BJAEzJW`i6cytlqqKE*&f#=xdUBVT891hLxw> z5&Qi8n4GZRyu?c79M9~$eXl;jsWI`heutbI7zK=^3f;}B*86Js9AWy+0ASz0(EqGR z^Iy3gkN=dYv0tnaX)tldssVrXxr6}0y#4anZ^h}{&hayUYQWzuYAMe3yq|KOEI)et zfy%QRKlAJVHt=bjCsOOifg5xOSl}|@bJXg8qv8KIDo13nYkvL-FFq%{=M%Gb5t=VQ zBHFv}+O*}Ldy{SuHA-Bb#(J4}KSsTntmnu*ivhgO)(`o}P1cw3I=nWROp5M24Q`3r z$PL&3`%urQNR zqatymQ{XGuDAUS0Uyz}b%2;yuxYVo|w3bj^r2cdUZZ@|nCSi;A7r!LZXLk(uhvT30 zGFnSt>l~$R*-<|lxSEiU@SLgLz0E1nDDE5mM+Q}4R1|aZp0>dDyzCan?|!+O8iv)J z%9VTGADQJ`U67)Q9J|WDpn8$^TKy@W>gCX35o;!qo{i1KtCMl$z4PKbRc&BxBZ&Px zofD2nHJYr`(M$H!^pq^o7d%XMS031uR+o1kb9DmeO_6DN+*Z#d6T1B%=kN@$cbF|p znJO!qD!b^_C(&@zKQ5b&@ZxButqCBWmA&UrH^TF|>xIpTJ+tG-=#=1%&zV&AquV%< zc&`$`U~(U#slWN^hu2==_v5egd1ZI^NlYRje-_HjHP(*3P4ICp4}7VoY;znAw%cMF zrn1M`ggAXaJ$ zHUURc<<#7ecCBGtadSAaQ(Vgm?!AwL#`S#(M_c~)katnW8xaRCKZW%PTWPFD93WqGVcM8-Rudn}an6Hdp5k zkg2w@YZyLnL1a&lS1nv94jvNvFXvsAs-d+vF!}Zw`)8S#0FS0HfjAWNGuh{&N=BgS zKO`ubId_X(jcFVrvD^_-f~i<7?N!`6u}f!a)}6S4_TvRD@YSjDV7pRMiN!n|;P9)A zylv?U=HVh;WlITK6bLgafh+?8qO*7}Cq?)=g zs@JZX)D`~C!ZUM(#J4R9;{E<~u-{B5(877r-PH~wndHD%MuohdI7sE4;|JIN{lii2 zOB#ObRQQ8E!ism}tU9N}aiQ1X-r@nam1=LlJ`T)a?}F`}LHgVp@cY7p(?CwceNjz& zeP~{0)Th!Z9?q%2+eOCrheyzMeQU98@B31k`}KI`eKxFz!|d^DUQ@X42zcrQ03(ec zKAy+bjAj^;oR7KIlIwJhny$y^+1gWD+ixeVU;9~X-&1x`JO|Wh=GsrH0@H{1-ti`s zQ`$bPnaaw~nmg|_D)Pn*qnSe}IzzwX<^13@) zGf5Xwix|)A=akrZvJl;u&~ne7={n;iKd(y_=UU~{YKQp*v2$gYc8GJiW#aeiPyO`f zVEz?W^iEory`~zxL^zPUcsnvdY?0+&>WM9izo*IWi?6`@!t--%u)vGzW&JhFQNpYk z*^$FVoLA#-{3k)nr;>uxut}WWIxQUdPAa9a=*xD(;BYl$)`IFHcopK@Avu5e`q2OO%0E>2>wH#yuZNH>vw$(=1YAT zt1#pFth3S;;&#ds@U2oGTc%jf3eg+Lw`i&;{-9H^4Fu}fFL_c3L#_!;=LDm5b%#9C zH~&1J`HW!t%#kE?p1E27Mf)^@lHF@&aIal!;F7sdDf_IgN~_&?@2u6Fk_DJ%jkk!n z&D@NDkJ)`Ux|WV9htmkm^M`g?A7LmK;40qRzywE$NwCK{R2p19 zVv=<@9WWO!uq8Ir((X?TA8C_fvgDM3<3&zNWD?_FV(}YdN712FzY(NYu8&vha5=0s z^&gLlW8&@j!|3u(Pfjtx{@<#3JpX-!LO?>y#Uw{jktSbg($`O#Ix#pjKkzwy;tnuT z&#32?^q{Fs&om@bkOe3_!{CU*-`FfM|*uhlbMkr20nFAzE|K-Tzi&78Xc0 zOGX9i-&NNRY1_}!c z3twUJ;^Vd#O=$D!vKIxU@TsTSm5=Iw`D`PkAaxw*(0ED3!vD{j%i&j&ZW-JjdVp%h z`S`;wGRLBJlgUl!!^X$v+?<1xiHQV=kJ=R3Ah@}rC7RglF2=v&?K(b@Dn#nnAG1vN z^Z2PGB#5l<5jNnT7rvBkdzENH>hk}<%qU716IV2;23G`1t(m zxqX!rnoOS7(sSIp)d`V(>G0cg{X^H6RJ~h1L)#f4_QdSNlN_~wLoNOt4`+vmmg93R z7lJRyLB90!cfEd52~$%Izy-FWIacFIPCC^{3<700uH!ID<9ZbWp2rKO<~vkm_eQnP z-n+)E{Jf($!IjAwq1idLEkZvlxp5!+Z6^FpDJ%izE|b$kcTi4{Sg+5x;=&D2CcRz{ zQ|!>vMD*K#LgV2ZDF68%8vp${IHtciqPeS7yAa+@G$0R}yOMMy63q(|hboUQ0w{-Q zUlb8WYX3f1P&%c{-Im=zadXbd(^s8e>UA-fNZxJ`5#tHj<{*Y{vC(?N85ds}oVTz9 z_7rvsgdX4I@ctAMnwwp*sZAVdW#Z4IB~^gWb{9G% z20>x?uL$Ka8y!fpA=p;>%aXa}`%zo$A`@Vwt!HS@oo=upN|HQ*8JP;!9;&eD9!@Pz z&1R$8xtN$a%i)Ae(VuYA%>26|=Q}PCw}(TlepT)}LW|*Ho5AJ-w1ncowDD$YS8Ej5 zz^o27J_r1ySyUvDiPnmfljEF8mNX%b#}h^?2RI&ats1*y4>7er$YAa8gUWzE zH*L+!@T91rrM}58fm(iSAT4iZOPbT3j2UJ3yT^~hxg4jOXtcW{;=BTGv&wo0{QTcC zAvd*93o2N~bvkzPiqH7gVsNM#ptP^=oNp?lG0O>166Qne1Nqn^Kvs${sgUSQL&j<%Ws~M0&8GG}bz77$RLe#O&)p`e2f9Zb|)CnwWt~EgSVABYC3^U?OkQ<8PB9Mt*>by6+zo-Pa0(;dTZgvl zxr^*~Ioc}H5TCNHqKm8|!pqGMk8JH*0LEtSfJJRyiAPU#Y$^;RKZ5M@`IMoAcey~! zMA46cxYL;TyDv^$k13I)1c*7Z&WJut(o_bH?164 zthGV{p4QrsGcUZk!f98M1IrTc7C}CGp$)EDI!YRv;gJ-~tJ_ry+vu1ONErq)CjDAB zjw!rqMA7YO29&WBxZ#;d8H$_CKs`Gr%-$j`%7Goew9MTfZ7$4@_hjmXLb>O}87^*D zjr9#=``SCxH+CKQOxf>_jxc>O?oW@3H}u3@AMiFdsR75cfvdL}TR6@p`S@JDFk8Uo9hRzZW@~a7l^Z7Yt$BQGGJnDUerXrs~f(OZ8hhDY`?U-kR_I&d<{v(~KQ& zw;@OoBI68#ILhn=j^c0%0z<_2a%H+J@qr3_-q6A?sbMxr^+?1$HxuRD70S_%q3JVa z%k}jXt(B@m?>yN~71vVsu|Xf-mo*_j|C_xlG~QnFye1$mslryJ`>H*5WTUx)Q$4b+N2@#n64jYR_d>O3Sy8 zU1l^?aor}wMvxb6XUjjfChS|^s?MrE4WlgWG>gKeAbufG0lmP#)&`n6s&c5GED86| z#^)X`UR4fi;Nytg11(*M#qMdzzGFrr%_di*d*IEkDnA*g)?|m1*35w7fseY?Pp2^@ zi5gXV?b9zoXNilJe_fD^3d5&GYSS7}0Zwy*9b`D6DX3ZMZ19dO6v51x)0J`zZFRl9 zQOldy*l=wTFwWi5t@hmr{8{0yobmR+QF7V#G4>auqT!)o>vXW!R_6IT?M#j6O}WPR zvK@p-ljBT7Gt(A;>GI1!`KyZpC8!ld(G&pf5vIK8iUc`yoO*D#u%IE-XS^>tx;i9wOG#W;+3XC#7wrb=pkP{krR%!B zOd~8x3^vt++5fG=R4FZ&k4@<0_xxh|Nko)5uHO)&rxA>Jh@EOyxm&l-z%O+mC?RJ{ z#$o=8Ge`G)xPWf*Pfe>M!ejzd4V5$=_CYe5fWlHOE9qKUDG3Q?5}tv-wj>=sB$Zbo z=l@3Ql7vVmTxJp~?C>+KCpe2W+!f{Ke^7Ca1(JCD?iwG+qhSO4{XQ|YPr%<6fp5w4 z6u5JA6Q$kgV*_*cSN|yh0wYXzvszX&xkj}#=ACyFf`2J$^1N73OCYmS6)R@Rpg3n! zP(H)rvH*&Z`XY5K%eMNRjn9=#jdTj4#EsmZS>2adXodzxb!j#uE+f*G5lXU+6$1sZ z5+ms_J0hd5pAUFoaqX*ksh?)+N)7%d*OKKobC);l-}0QTCoXPp_oPJ%qUbee(1dvc za=$%|b8=F(TA2yl08)xtj}V}D&-D}Q&Qe-S=q z)&Bl$1GelJ0E3&mzV0|WgHms!ZFhV~jBLb^facAmInr(w6U3=#ZH;P~^ucP+cMEt0 zkP@1H4tCLvhCvsbSUBlv7+XMBJKwRTPo_Gm0QsKT(7SzTT$CC(YZd3H$lkhR*&Y6J zo3c6G9g$yf)~tv!kz#d3$T5{{y=TSTS(Ax58KxS@_sN*Yt2na$d=z=%C&Y=iUV8^u z1JSR;gavdhtNTt(1=e2ck(zIF!`uZG;300kBPu~(n zPdV^@0yW{a%k)#KFy`&MSrTX&wM3q%#Pw!u#e9=In09!&pFPDa9QaHU1uzqJUG{dZ z#(}QpBDKzHSDvmh37<(-@kJq|xw(dv!A#7$C|$7`_-OjR1LFM1ir?chg*LeQJY)(* z{X9eU44N=kqi5}rH>~xU#fsVdnb@a&=oKqZ1^u2{3+lKn=I-U?ONgo7bZ~e+Dtwh3 zzaJs3&5G!m$@qABY;w>umOT3<`j~Fj&9PHNEqv|dZ6Z}Lb@p8ud-@+;6b9>JGjJ7K zyiR)``pKV*q*77|s1mS)Gk*0Gzy94ZuAla;EGw5`&HPR*C(nwtv*?`7vQ&65o~7ul zh9$e;OI$IN?_=}@8qaO65Y&sCgNaaWnZXojx`&I$b(?;a`MVItZ5-ff?xq%;p{#Ob z#;B_Fyk7VCw+u9sN)jZmRxphsKeGv~IFfNq+;;mDeG?rCWy{H5)5%`j&8{Mf1)h04 zpI9D6hE=p27O!HJB8x#TSX3ogo|22slFj=WKcMacrlO24NnR5?qCI_a1}p32mDQLxI&SFB1y zVpTY49?qD%^OBRtXh>AU`$Uq7jCo@1nfx$fE zxv_yGmzd$-igvO*L+#%dp;pl_9e@5+DuUToT@WC?pAa^-G$1ponGXE9a7iUYD_{fw zl=%a{l@?OLx?tTWxSSCKVjcHWG~;7hAqiMeZ3tK$QWV`&x^)w(iMygV2V00q11f(B zJ91Mh2*nkk_3olIANJA;!bpUsz=!xaH$Ns9Y8_JGdC8lE3>;_{1FClasp`wuI zdFU81N%HClR>7STm%}`myE;C4aTp>z7~K0rC7sw&$I6B#t~^qwy@{@Ma|jp19VXr> z_6vjIJCwBrVB8UyMSVisklU+YyD*F8n8MB6!puy;!X~J2>0!ukW@hu`ti{a8jtLtf z#ZY(sFYwxtw6#I%!M$FB#zN~S(zrPw$!A&D#^$##kSvpvIhqpp79#`NB4(F1ryf)3 zA7=E|fSBYaDVi@rS@281eLLB=d?@9jANLE!Dj23)kYu1-|+~81#ORq=e_hDl3xd;fL-s zyn&Xu0-}xwAuFLuU;m*&wZZU`NPu1=U6T3*5FYX&%QM-Z6A~256$GItq~-)@c3C(x z+XGkiQrZ;0l7-mIwe`@SThdfB82lRM2tMr}3cb^?Hsi@B88Ph7Dhn zR|j^{v&GRf-6R&^XGOgsG@x|3mY!1KOpHt=kAjUPXG{&FlUz!qbVv$_gg2HiGd^u- zYO>z_^etM#h2Muj~$)Z>=^!ZPEvI61|(6wrlgC#Of7XUJdq1ief@ojec zgMmR{I}7ta!gL&U$lcT@MATMihz*>`sHn>GH-~h{+mT$zcPLP!)d0X)@cv!elD1Jk z$0vc@iArgxyso0(sHMg}IaMAtD-m?RO|6`e_u~^<3dNEsZBdTS0TJGoJ!l|XJPB88NK7+ly&C_1RoM)TuYPp zjDYL>F`$RKCWYy?o)6p;d_=6|Q=42%uyf_?(zWm}rds}zYuj2GtWP#08t7nom@e4x zP>wg6#a2{g;+H)U>1X5+1{H?pGzlPEMGtaKvnMh2W;hIlIyXTh^q z?0b(0wGsS>i)Yf5!} zeK zkU9;nX7isO&BU&Z3gh$W*$qp~k&26He27(T26VFPPVgitp4I(doIVH#$NaH95B-G~%UB^{@yv7zZJw(5QY6lo-Vr_= zA`;*N~fNF1>1jnt(3dXJAOKK^NCvC=^ow3tUqXe%=t0KMo|U# zzXL-v8io`i^$9V^HRK%L;fT!03mcC>=w`o(Okz2lLXL5G0?u=cpUAt*zvPwFur;CMzMDXskM%Z(SY*#PFAO)kS2Su7>JyiVZjjV`aQL2bsy18;eo;FDP9%h z=P#7meZ#sJClc4E-MbAZBgQdclMjXHJ4eKLor|bjrX$gBbj8ZUpV0QGKhqOjqL`*v zW0OO+O83s(*P#)k9Dk5w)N-$~d1KvF)}+|qqo7w5H~spCgM^VM73{clgY5O}L}~CL$qio8!?-|C(b= z=LM%NulM1a9Wn2O8~1L!F0=##z1zf-W_0^N73eO%Z^*-z5nXD>~dW}59GSxBrKfpvOqb+X4w47880+jGu{ zpH6fmTYf*=d1_$;Imp?JvYeUbUicziprX#0DaEH(8_tAbbbdqv0?mIXT#lDqpc0W> zk)YGPVmhB|M%=pr%6tPG?~mqI$R$)Z zvW~5!u_+5k+6O1!S!q4Xia$;=cw4(n>c99{6s0QBam-FL#5CqO$kJXAwqD=RCY+*7 zT!ljKPYd7S=WG_xYU4y|Q2h*mF*BM!F*KEzg*!vq*%2GQkARM=&aa|MuHvQSG~jSd zX7(NqYhCjUFwuKrBQMQN07*$zM$a`dhMSzpOUj5vpp?e7np?PCdN{P|sl^sHmY<$C z&;Db|o+m_>b(zUAGbSqckstX}rWJ zr%U55mr*}X0hUS9bL_-+1{LTKJkr7^#x2bjwLnr4M~k4NYZ@JEd0zI(YQOFl^3_o7 z(?c`F(V$2@Hc9=yQO@hpbklTk; z2G?x5Ub_L@#oLE8$DHgTs%Ms9b)Z$l%;OK83CLD)l6+?h znJ_rSUIHH$#c#?SjipgdaQQrk)&Cm!LZDbtVXT6nU7MoxjgC+sviO#WARk6WsS9o6RbI&y> z#A$RmpZhC8=z_Hke%SbRP*fNpu&K8>AA%7 z1eu1d<(wQtl2jj^16JlGpyu_0+pO;_EUR@!XT?_kS(+Il$`)Ck5jJ2>gS@O7d{xqv zk=T7?Mw+^`$_7yu#A5M6oobyV0D~!=mF?y#&mwXKgPo9_MDNdNSZ^`>`=wgT2SPl*sY&o zZqlAm3bQ_JtZ!BMYl4aXll+;~a5S1z4VSHDch>T2+;+1Xj(Z&A5v@%?C=1?qZu$}D zk*tUSKo%$Ax{4}`5KnkeLfdmNq@TUpJ$Y0UQb;}0u(hN)UYi#j*@~2g@5JM_i?g+( z?;1N)&=_s#jdoe27o3;0jFLu5=Rc}$87K<2tUWDUiQ5O4E04a#*Tf<-ZkIqsW3466 zTN_np3K%mEZf~QA7{+L~)Oq$K9}#gQRHWjcxYQEn=}LE_hA*s1EQ7nTC~gTpMy`(Q zle3T|mhNy_s(^rMxpBtW2{wzt7wG_IrcTS6Y6ts@+&@3;_q{{~<9OKE#|#yiYPgY1 z3SCL+>?k?;R?~Hq5Q`n!i#G-E7zeerWC?=!8=YC|l|Hj9+rrb$t-t|GI^QTfGo{VWB-CK=n zxC$|7z2Rjv^iX5tL*rWdWDb!#7%8WgEaWpu+vSg+}M3g`PLdhmT;F)6$F zqI;@76W9U5tGNGPH#(bF;zYM`SJhKYpx2*L;52}VuO6rtY~t^Y`F}O~52*iLPKO3* zhK6upLCbgJ1dchh{4?d7FZ+ExN>9AH{pnq@nskf7<--z}MUA+CKr89g{B|qs!lFsx z2k)`Z?bge9ZHT}B`4W>K=kJdJf^Oo+=d8id;O2`<9hLXj^1Mfk&*{%q$i!XXo#1c@K_U`e_vy!J z0eygDdeB}Ru@A)Y^KIdv4j&&X$&+abrPLZn?KkR}ZNPoZ*uSz**%|mgUzGovls1Uo z&l2+%u9vOnm0w#w^yHIYFLIhW*$odTvOl|I`hxyzdj6ZxwMY8zB!9?2$u);IZR7)^ zTZ4jki@XoRkIqv?^$l!NgG)t?e+eHnTNiL)6zDX5VG04KgXj(udN~w{1^zu3?q3cP zZV^5f#I8dYqQyS^wyTdwUF$osz-(R8yBl>t)B+V9e@j!iR-?;R)Yy3chja`+wEsTU z;G1XzSO;6Gcm*k~;PMqMw?qr3(8KbmG}|SHHv5du`(~{9`%mbves9?p+E2w7Z(@TS zO?1Nrxgzl5+hU5H2rvMKx^dszb65w7L9UBIG@+NlOo!_qHecU?*A5Q;-?a<`9>&5f zT=a^LcNDVuOe&t&Y#g$2;7c&MI1xGW9~TqmtzwaOl^nRzV0Sa zA1XrM1~-n^6#dX;gE#!2&vBBvRC7PhMsm-5PkRi^EW9^nU>Df6Lv}L(<9T1Ly-jNT(*=sL57W4tG%O)S&MJUQKAX;^_i9RT)BNPtB!olfA&HU91Je5 z$J1}o7t)wJ_pPerfr2bkli+XH&aO?a_ZG-pk8rTqTqwTx-FQgEiH7q2_iIC@LYW*# zq2Su$qR^b;jweC9X&HC=fbV2z%REM^(qEx$X_Su@4cAam2BI^yNsE;lQ{ws>}i-#uW7#imj4D2qu zB0-v`L%eK+JQgn@ZqxUoa^uh#=Rc*bnLkFIfo=~G|M1J;Bf^K6JG|kb%P8s(gweB>7j$u+pDH-BFj^|S~JJ?JmRv0p-$YmDbyIo9ca z`w>BwgX$Lh8gj3UTWY&&YHf=!1A@;Sx77MvT8l1?_G{K~Daq^M4O5Z#buX3*$!nrv zH(8fOxr8Pm;m?%s&!x1E`n4hABB)as0X!%adFNg#EDLMBe0dEcyMfj<#dfwTb*kBjntQ)#y`CZP+mqk< zxZAkj-B8uG`mj(vBiHi6()iDII-uiCgF6yh4fAK;2-gF$;M3EAEPZ|9+KA)3{W+lO zgs7*S({Fx1#YZq=tAJrT#4yJHJ)br8TdD*vSedmnvQAMxHfG2{kGSOK-ti*6(7#di z2czV`_t+X}0r4$qE86!V94Hh|5fLy4l>g9;3D!y zLkvB&)iHl*chO^=(s0(D^8t4bEG$%;1)3On)D~2*f-0(M*HRhL6Y+a{2RDW&ycz&3 zv^-0EMV1Iop^^r*2tmo+!@8ZR)&BOq!qH(y#u5;@6AK-$stc4SEg2C(g#`Ytb1VHz z;~Z(*Tm1JGsfvGWqzG*)P$Xov$Ak;e1hj+8$t9^Z;<`LohFtD$T~TBrZrKhL++ks1 zsnl<2NIrlb5NOxGY$mZ_VWZb)ERY|eCF&0J1m28R;~H^aJVE2eqKar}MD&v59*qu` z?9O$c`V-*DI0LmSw;IDMjox-$+p{&83P;6_KjG2C8?NcE)Uf|UF6O+~e(fcm$C>Ww z{HJddirlR)!I{LLBE!Xkf?9`mhI_m7`~yDkvY*U_r>e_tO#GfLoXail5r3e2;@;mu z*)jcAJ4*Sv?^~8O1*ci>_s-QeId65Y886dBU$dW2&$Li)I+zr|H*pVxkV49IT%8pU!>VEy4;* zW7&?2E;?@dHKj{pov#maeTtl3drQ;vDnNqhn?KN8^E4s#@GGTt6T&NBRZfOwZh|WD z_ALNJKQvE{8Bi7$=er7KKlSR57R-27mOxXIdO(Lq(-| z=1mTBwSwv@$OnGbkj>39<6Dmdh&PYZ#kX}U*q1#c#yGDPn&)RS&PyY$viSXn>c00| z5LhgR?Y?MQMqVBLdo{Pgnt3NiE7DXUG->Xl5)L?JR9j&a@#ZdCAA&79w`&ccpN({| zju~pr{jnPGd-!}h1J@lZJNYSRHZ&(?iYf;vFFpjs$&_-?nw_mbwJW78$_UkZWs~qr z7vW@3fo{|DkHRWYdmdj%Ej&4WydEkq8@^$b&d+k?yOYI)Pz+YYLt##?+$kc$l58P5 zF0+VyllyLNA-B2>NvwW#RhHP45V;RVDsC+N`xL&NCnrRb$P%x$rlT@r6KRat_XrKCQWman0&(uNEFsZL-;?~aiDMZq{ zn44y0nNfIqDmKIKnpTjui*$Qesg0D6%VI92&xCJ4xl6z!IjfNxt3G&#=Dz2`aAZx0 z(!hb4b(EIq2Io9-{9|FMwKez7H|v&NeAZTkOGj~|h=nV#ACDjeCsspT&S^mkETu64 zqGfUtY4Ka9LGEo4O%U$=&N?xn#E@J@n~4j(96cd-8#}HHnUK@k>EbIe)!)Fi;V#ZF z*IJNsYTm#sRCJMUUuF)jl>xsrJ`X&X)#crI=wXv>xAo(~@o2*b&t3!N73|!dm0!8X z7apX>QC!oqGA`w+7I+IOH@C9I$s+D3CMm{UWc^OkmP@}%(D!Qgpx8Cit2-(r)jJm> z`wIVRi=^-#C>qnHcwmw;L5}w{#pPTPxk+QJ+x{ctPNdxC9!@$~r z6leo1Q(Ubk>`ba^0Tfe<{m*>AA&zX6?WD@;@&QHjj7dEA%ABkb<#49l7ZSk=n*Qz6`;l@7MyedX0}Z4<-0G$_dt5H4Tmwn}7 zdj5o%U!D>rX1v&5-Z@Jvwm%zM-wkbqW&^4~LdB3bgtSk>zn;a&i7euDbNC;V1}rYB z>=-BCJkj$G0UWG*rG}K-P6>?@OOBhqs-rYYsznjPLGo;fr0lTbFx8Z?~Vi_q@48p zf{QYgn_>%p2qyVzaNg+q$suk<8E{8rL;t3RooK$QCt}k0q2N(x-?1+Q^DqDP!Cd}A z)$4g6-<*O{+b4=oZLHE>R(3Jk%X|oZi_MwwWtJRQRw^=4gHDmKYzV8e()BKS3mR=W zOooi~T5pCJAFa;oXycGd>Y0oD$O|U$8x$4(#I?mees_?GsrkXksDjV{G}>YsC#r!x zabDUv`I;m%-gpv$!B4`hmb_48nRdjYkl{QgXj=B!Nj#O7_5`KsRWBt$mymZVTN-r2 z2qT{oQOZ!tr{=Av?KyX$C;icbt4C30CS;96{@sFLayFA(j#_kHfF2f=y6Z&DoiQ|^ zo=kur{{FYSlc`r006kPCcyXxj}$N(KLAEyve1Y+?A4I1LAa6|aQI#!$z+Z-G1E?V#xWavB5 zv+LwvtH#Vw!gESUSq@%{|6q9p3brUQO>I4*fq8{~fx+5lcDTKt-4a^Nh}aMd7Dg)ACOp!jSE~G^e1DX{F=< zs`FHBFwFQe8@B5(_u|uan@}#l)i&0{*5KC#k0V9ZSvNY_8}N7a6h&%J@9144qcTUd|0EDzn%F{i+T+52>jT+jEuh@{q5N0vQR zz_Cy)dm&ylqM-M|9{Wo9XAz&M_=HPU@%3YEF23$Pnnqwrvgck@vGEAVkd6U9vH}%WTAS$@F-@$a$;Cun<7?q^^=Q zg~XOYKecC0U@nV;YXK`uMN?CIE{!1GK-ug#x65MU(56fdl`FIe4=?q1cVUzw2dBL9 z64<<4#j2!O&(Q0vFv<(&$usFjE_&1ExTMNa^15xGEr_x9>e*3OEt4eQYPatIBd~wH zN3bb(Yw7xW8+_#``=AElUEu><=PEaWuV>I88M2UV$Efqv*4I6#VD2+NE$Qx zItQS`!P!MqWZ@m2nQf3i&`Bz8DIbjhpm3<8q7~5%OXy@yC2|K9wvIS zouS-73Jjv#f(m20H8?M;6oP5MvE$0^%$93%(uB)&5o5Nv-NG|Vjk?naujdLfkfjvPB{Fz;*05hKh8m3G1D zrB$+puoC*vp~-{ZI2u2fJr1tZJ`re{GjZe~o*rkNF-l6`{%_n=F5a{fTd4)L+c!J; z#=>b7xQ|!aVcw^wrx|2>aj%x9bRF4HB#j!uCH2CxBI#>dC0$>}n|XE%(e{Khlevt& zh|0)3#!Als-K)@qyo8wJ!t1}U=T}s4k_V&H+Gq|!X~jlX+r|aECnq+CsVexU5PI_q z&WJUv6=na%FN_v7VcielsHZ+5UTrj8)x>R@rMv;TQJyRlmk|lnN&BjjPSY-5m4m~jp z{iZ3}5b(QT5-L3YXXGEpa>utik?jk#IFi0^;*^G786D!MbaU?xs~mLw?Fjb%Zt#jsyR4C{a2 z*icIET+GTQ9V+VM?=EX963F@?(2TDtFE*v(eFo1p)n6kx*V@ot*Iu~La~T;Bb1(J-Oc^RV{P*iMlNVp-&Xu5K4Y0A@Pq{#H@-| zBlol#h-}g|Vw8!&ICdcpSU_6J5&IoiVZcS%`n!>}MRF9xaae@WxE=fSBGB!eGA|CwYSg#QRQubeeE{&obAogwmKFGbUYG$w3n$YJu zR0P@M4=-;F0Fkq%&Nh<#@Yu9}h9nhkZ|M*Evp%ST03A)BV;(aR+K94?pOr$m?=B`R zkXfs?Ze^uzXZIog$m0vE*hQWni#tQTFDzZ~^tU~292Z3#@u{agl3Qw8AsI(LuX<*2 zy-7`Oou0WnqyuE()4Z{|LAc1!q3NSUGTh_jOg&ttwo+7-cpS#K;QT+PPg@O=ZhtD= zw2HZjwY;(KhQneih?i^Xa)#-XEp{-Gf|BHxq4pfK6VI8lA%+VS*t<{OkAE38;{g<>43=_HTQ7aCMbE23f4!mzOR(#z`hSNZ&@e*JnVVkDk= zXW7FYQwuCPh$pk4Nc(vHP{5Vf$&hV`hv^nB(W$QmHDxkrng|TYNn6`tlbK7#8ju$T{N3{X)UfIpu-<_ky%2tcE3Ft z$47whl4eNRlq^2V@b?cy&rH(ZD{;p!3QnGUq?8ocl@$^c*fm2#F&P#DmBMXlcKkz? zV4Q+oock{Zq+UNe@%uDut1p9BnoFz%Gi>@Ndf`oW-_JV5@-~TAW;se>*HVuQFHnL> z)2{Bb-ic?>Yi=4gy|tb`Mfw}8ylbcQi<4hD5<(-@0DZXi5FA@EYvr3b@B)Dgg6yU)odr zlD+SGwfV^6Y${a>0289a6GfwQR#7S6 zASgvs&}Dytj%oItyLvccL-#7t>w?~sgk2L<{yJAFJKyTi+?9B-WIv%Kt86KCvy1Rk zkkR1yyF!{F^AeDcgQ-Y|JT~WV;(D3F{Q$k-LhoRcikxzwsiz}((Qn0@HMuLM5Y?b{)o`#mGfFY(1an z9jo&fYHCuNLkyl__4|5_VZN&o*J<^!Yp$%N{6m9m)F1fC4F&Iigt5AKE9kN3_YM}Y zQ|H@!T^YAEF3hnDw2cvy~W=DrFSNd3(^_~S|MEFf+shRdihtkLRAc~9`yqEg#!L!+-G zyBTv;HpEGE8JR*=l3kk{x}+tA_qAVm4Jq`r$jt_VYwDDoREIjHj)i}IkI`|49yKDF z6Vef0Bm_iw6=xrFh<=NCpTm;kTCrnP=;Dbi=G^m{nZ6_6XrQr7UB~_lqqBTbPN630 z)@W+6oh}X=>#$_rdo>tTT~hu2K+s({uWU@HhH6E%j-w0pRfL6W^cpK zldtj}58HiCOb#vFEiI+ob}?40W-nsJX=iz_FL>EmuyYD9Y~`mI%~j8SFG*V$k;qD+ z#}ITyJ3Bgl>DCV|PFHC%qNV$26>Prl!kydbj7;tS!Gt*4)baf8rFFfx7jyG(u}NjA zdge}Ztp}ncF(zxGV6Do>A&u<#qghitBKvu!+T4eA<^3@+-Jh~MoQu1!Kf9?`7c23{ zefgR^!)x!Us>*CAL_cfHZ|OMmDID9hhK;Vlf)nM!D;f9NS@wN+pBX3PL{Vd5V9N!u zMX9RBJu<;-l%x3r4*5$QpZb!B3c~$NuDNtkmY*rVi+-Z)by+xaOjFIvQCDbysU~NX z6$dlInJBP$Tc~vioca#ln4ftlmNx86d&W#FU0dar655J~;Pg%+yk;+Rn^hW1ScwCR zveg&4EPR1d=dyBuv~j6$oc_+6KoDj%;|LzAdYaBYHSd^jj8ZXB7Gu<#i#?I0L)eYOb)Pi`c<1?Bc^@oi~RX zTjRHGpNx9Mxak?{>dUxw8S(QIr%S>#4ZmI0eaP$xe77y}%8{k&xyq)phB<@Q6P?CZ zVtv4!;6Fma0P= z7T$VxZaU9jz@n)@tVzA~QMQZ*tiH4Q35R|(c-bjE2c zxs24~WA0&+P6@r88(hp*d%NSd+sHmy>}-bP6l8 zn9ly_7qQeHY2V5m%`Dy4#cj!%@XZQ#K%r|2q7&{gM+mF4Jdq z@V%0Ymma{>)vi_J)B8CCo9RTeb`OPjjOLN)cKPu{BG*nY#jp{2Nko&GM61P&fMPOp~^8SPCE|PJx`L`{XA61t_ z#cM8srIbKBHGdp^D>8Gl9wfdwbw`emW32;~Gt(?>+t$W)|hnY^F4? z&J7*kn;bNIJt+|X<61ZF9i1gcI=hGioIF8wqNBZ=wqZU> z{x+zYF5{;chc|y7pxWIgl1Hq!yTA4zd)A*xEH2JAP>$u2=39Iz{^-&1e#yye*0Hgz zi%+8VbRq>GKD|0VmaiHjWzTGti~ZVIW=@i4XOWcp3q4;i{eZ3TH2;Mi*Z}CL%MgiY zJJVwvfxXOzYETHc0=dxgTcXohzl;BdCr29I$>kJ*g2JFBC@5oOYT@+C_%q?x+Gtu$ z-J}(`~ZtRE!xQ)DPpgpo#l@w)XKZ>9aC2M??pjvZ7gCefzrz8 zafq781c${Y;#!io{iKOJuxR~+RGnL3TJ9WKYGGgQDkHz|rKF8|-ejx?G@l!~cflIK z6Q`>~vxc`~`|kL-R43rb(mDZZu||RYZzTFV%$<%echhws4ly22xG*a0q0^x+B?!1W zFD)niOH6Z$m+ftYiv=v!nazC=R8v0DFdWOZSD^UGtC_(bHYL`pFzTL&Q91QAT-r4_ zGd9_V^>cyU>`g3}@+&d6=#(NI%$iBRC)|m^TOkW1y4l&vfZnAg{`=R~0e#C1#TBK% z65a}6I)M(yfl($(ObUwKffcXyorcA44cK`>gH`? zGGUEdQ#1P z&GQ_lYLw*%Px97nq%O>>yy4*b%A?RBahP@p>^*Nq9eTly3z9((9M+KB=6b&uFs&9r zE~iC~MlWbKiRosu9hxOa-Ce$mA~UdtVN($)zLReXS+DlGYfCzF{4__?T~nt78V^ z?58ci2|qnLal&MBnDj%lTA?bx>Xb5OvM(X~sP3dYp;nLG5rZC^F>$Tj(4>8hDe(tZo>Arf= z-4aY&81!_|^mLA_+>ZWIfga7KvMP<~(Gnzv_$)7V*VbBv6m^09aua->*lF)q#jQ5| z2|Bz@LGafk=K?qR{pXQNvdV`D@hx8vzs#|L$IL2Sc6mW%haGI#EJneuh5y{f_BXg{ zL>tCmSy{np^Ple=ACK-7*EtEtkV1Hm64A5hh3DbmpcLa54Nruxqqb!78Y#cH*xJA# zv!K9ysT#eORxQB`wU2RCmx(V*TCEndb2NGD(z~(ILD?bEeM>;+I~ypV>*RPpJxRNl z@`Sa+v%Bpm5toRFNa6=l-A6{rSM}*jwD5I`jj9K>v3}raq;pSC&v9v~5I+B;;NalL z8$QOEzbSzT&L8aULDZNPXv48D5eJZ7v*P}#<1mpna(!EyevIEd(pR@)xWFEI1_mB( z?w|4TzCJ#JLP9dJUvnKB%YT0g7NF_PdY0{V}=UG zJ}&Lc<`wgsH`LI&;m0*H#CN8RBvYt;nJPKXz^+!;21g$dH+m;cL?yT$Z(g$E-#{QK-E)SmSm*)m+4)t6PgX7Ueiw_W4R9PFA(L8uv&( z3&~c60WoigYYNehX+{ex1~=?ANim7mD<-Yxskd+6wr2;8?W*7-Q`lf65C+`$&}kxJ zzO|x6o-|{SUewZ-Dz?7x$nxMR_$`y!Fa3VVlpHy>X69_#>eDwHd>LjV7{T)vk6s`f z4rjtb_3i_0#fPtx{ME#SCE?%DRg5W%!$aToMz~r>;?k1^lh~>{@q@*V7ugS>BV98VA8pP!srk`)jO}1k)adkdw znPHI%a#nHktztJV^Wxs22KHnkgv2rZpT1`z{Ab?rH0QPVh7yQulO7{#84Di2_K8JYpkjpRel( zRe3Lv1CEY_RdrWXsgh&j!Bb$CEj-KpeGDv6L1A;Ddu(49`cSF~8~&+qIUdiM z-e#C<;OO~GBjHJ;*MY%su~&L4uh*pOD>|K-R*%84KAOgQwnZ6qlvNp9d+Wz}SG2Z* z9Nt=|!S4C*q-=_%2h(Eiv)EWMvOFcmOtE}lNihKhca7KakORjDy*fDkvXL;Ioj7=@ zXWx53{Rdg)rwgnn}U(e~w(c+F9;26|f8Hk2`|L)@GI509| zTA_jS0pV#Z5a|vZ8Fy_7wvAk7Y!6+6L%_%=Cqok7XV^_NL|XP9Fl1&BbmP-{xB(xx9 z=I7tcsO#&tc-3TO!5bN1!NaHj`t>W8gM)+Wwp|%xB>=K3f$$W9;KuyVA77IDNxUDf ziW0t6gijO^Ws8Ha7mPwKV{|8WpN`f0NOY`SM~RDe`e1k=4+n2nwO~LTot=sxQzzRZ zkL&Q5tDUz>k9LPC0~0*Kz(d!0D-NbFpOuES=Vj*0a?<-EOe$1Xf^WLK{zH;6!O@PJ zKJXt^a;Z!hk1El++hyJD;&yg+O1o?bQe`akxNFAUE2_4fh);d)5b3CY{aRKYZ1lza z!N80=a2;Q1_c1iY_cy2uqxQ|#$;J`M!Y_*0pEzXN^Nqr@>+9=ZmIc+)NUiL5Kb+sw zO{61KgeKYAB~y2I2ZU+={`RBKNx#+JfV-9-L;98tC#&_uZ5FHR7+IFS3?I9Iu#sdZ zNZAO+$44i$IJdg$Dc@OD?KU&V{_e*WP8sM>d+}`)cS9q;Jm@U2dHIMet+*<11Toe? zEak{zk31Qy9=~(4(KrldXP*LDQaskgA_Tsy4FmGpkuu*B{HFsteKA~BKGEPdSCOA@ zRtyI+oSOI{S44!VUNKOeAVsI@yd$nD1^%q!oY<5<>mh?dXS(bD&N}6hJFk&V+2_!& zWHfm3f#2Imwa8PZn0eMUtYIrbsj$$NlWTdD)cTFVAY^02#1=NW5~SFt8kvAXqUc^A zkF$|RIpm3AY>}RKild5e*n=Os5?5>>Aq7L9UcHNW-Etq8l#sq+;l4EJ;tY8Fxj5h) zm}iLhcGTVcE8g<=r0@4kz2UCnAN4X}^L>f~tfN+O-%<>e**=w7l$f(TNUsdmCK-vJ-Ox%FQU z3k!SzVtZ}K@2K(z9}}xuFmjdO=KBomNXb_=7TMZZm)XNIPF+IZl9qnfApA5^cJM-D z^F&YYCd-rFYf-twM;@H!EZfCwFWO>C&0gx7$#3%I4D=w%ics;d!-o;xyCc=MkuEIt zSBG@bbx5CmiiN0C`n|@=*jPsja}+?xg4_L4j<};j+e75%AxRz%xy176hov^>8nvD3 zT6Aap*Rb=ATjZ|tZ{NOUWl<4YKZ52ub~LE-8&W|hXN)gz2BYs2+9V>@D?4fVM{|Zg zQUX~17yF6aq->eugy|J%X=`uW8w_ann7xl^G&kQ(dPd%#X<<6ilAO9s-cR_Qp3U)vG}qM0XNuYnMOj|?G)r|rn~Rck8W`wXGX9z- z!ub+?MGElKfR3{G%Mgd?@(7@)Alp3Vm{czbmq_yYA!AkY3GIJ=0BLc*p`oGOogH!C zZD6Qm45jgpBy}!lw6oh^drZgr8wIGEVRLG}q;IQ~Y2M_&zy z!M}2ms5k7uSzDnfMb?I_wrXEU7EVOs!v(sSkjERgFfybDe(s)H_l*KB(jbdFP9p`YTb#lj2!&{#JF?!x2xA#(;0I zs8*KWOK)8aQxUdT&tSZMYxMK%@ej6DM5T zul|1N8BjB1mAHKTSthKTp`rp7wvDZzWs5vXmK=-Re}4sD>(A`on9c51(!Wh6h|LTl zVl6^$)T#=yE-K0ooI+Qy1EgmSK-7Yj_ZxjbWL0S^`+l@|Z&Yn=CZ{QD;nzeHv9>A9 zJij#6wTfGC$1ia&ko?VC3jgEe)!8xQV0m<1_!-y#nc&c?vRo~h{ zbKFi}?R*Dx5|xv$>Ypq=jqFuUYU-+!nkRgx*Zq6RLSk4{At^Rh|rN9xku<`hUTT`oyK8{mNXBopz9pyG#Dm!?q7YpYrQ$ zEfEM~*HuAC9MQ)(ST36onS}7;Ahl@J*lP^!YQgj#=n}PlV`J6IIDpPos2B19RmwK<$#md+{@rhRB zMxL>Puf}2wlRPD@_H2}Wf`k0G9Eqlef^{nNF3HJS;_5Y(OH_#~$K;7!afa!oxZha1 z@LUpwKrg+nG0E|dE3YN1`R^5H&GdnnVr;d$yqKR4QtpwK_OV=eey}>ckac;QPChvp zP7u)P6HGCR3^Je5OwlYU1^J$hsw?lOe6!WbEIs+8pJOar)e@touYFC*SgurJe58iI z%|5)Lf{+y%Y3W*N&StJV)?L_0nW1wsV39sP!)e750ZL!f{QuaE8}J+kg10DP&H>q3ow%*yB-FP{Sd&G>;Bfq z`^HLDYmK|6$dEwe%|HH$L^nDoYyLwhdamoJ__M_kdHJ~_m%#P&o`JQ- zx?g&Qf;zxKP7ydYzoBU>b|e1fvAO^2ql>o08<`lN(Q2S_!>@1qI@W`<(r^Uw)4ki= zSBLu=wI;|eS6954Z}n7FHR*_!Ro-m045NB26(k9B-F{w}#kH1o7&uUA&#T^#B^l?dw<01If#h{peI(Ys@H#3UR**vnaF|0ua zGGOYKzw>lIdzI1}2L@oR5WT(T8OC!v(PS<i0d*4DC)WK*T{7jit&+9E1r++uh;umwa(6U&mrv;Ka|OZHz=M6+si zf)5Fp1fEEVJqA-EFzuE$_`h=ob-_=^ZM=h7jLPdRLU;IiXDe+EcUz#tX|jgxjI)+^ z+EAx;`{3KLE99kScNm)|g!JExE`-QU3>4#66$3wjEEKSuv;XjND@fCI1qISE!Sf~t z2I7X4ur#o{s=t}|u6Q_WtE+mRlSkrma@KOrW50zxR6fw6isGRkY>Q0=&?%Mqfr13HPS^Ek3`-D_weO66rgQ2{e#%XpC&m7098fsSA zfzjO+rhKqsW-Ys9Gxz&XdFV8yE@p+*`BBMnnlMD-^^fm$pUCXX52yu{u8OKZ;#{iRJKU+xd{u{?Y6Dn{$VRcE-!h%$$;%8WJ3gj{;NH z3Kjczs8;7^_&RRDgpyZNQ}as_%Ae2I{hxyr*r>Ahzh78Ekb2n|qOJ9K2=ScbRbtEh z5bpGc2>6^b@ZWmA(!WT)-b}=UxCyMgCL@mVLRT0jI@r=~Kri|5^ZwDS@<;x+O(@$l zw8@mieRY|3coutF0n`^fCjjr!F-7CTa(=K3sFfNVD~| zIMN@O#tqv`GNg=2ljUK9T{0HH%6@bK1V1Ka0@{J!Pu40mbTGOak`(Rw1T!==*U!)} zE~@!3)#O>{zQ23Nk+i(f1Hh67dB7w|Z(fE_v-fu)V3P(vC91vq3D0*Welen-~Khc9AJ(UZ~AV=|%B8)M0gO>qavsH;*0__Z@o&A?6 zg!!DPw=5qV8X|nIxte_Ia1A(sJsMX>O+oxR{M2!=&8J# z4`}ughus{$#eb1ar#|zA*d2loiwYR?R#p0s)hmuDjPxt@UtLvGmw)41^+1db2n-}x z2mgYRP+PQ9$oOT^@$p=*IOw|~{pn1nkEXw4d|P(WrUxPwzgR{$XnTR_aoTc=zYd<> z20Qe(VOgLp!v9G;MjX=}?PpL(i*5@=TE3#9?(X_i8-#9{-Zvvcsvo19ySpUri?F)7 zI_jHQakTQ?oWlfJ*lZa=MQTz~Qh%HuN!_A5{#x79HrqvN z&JIN^*s#1IvA}K<41ES~w;*O#Bcft4;+lx#6vdtP!&u|gHdm^V{Bl!Mv?8ApgxH0J zpRT49S&aB%7?}QTq~($CKJriExUVsSmqDMF-Wrn3#fC>jYy$)+6)rHezvQl9;3!Dt z%h$@32;&l>UTBXvi4Wipz`hQpD~>Y>d~3eOk`nEZ(ubAy+Ew`S^!fys5xdO3@GanD z-589$+o(Nuj*uH}kCk?%f-d~*nsL%(k~Io`f2C+6+=Tezlhi*7g16B^qy6QNK^T-I z;b%J^uw~z32h?^zUK<(MzXS+ev>iMOJMf#d$^$$PXrhF(U)Y~8!Asq-BHex5 zVpFhRu^Pf&XpC>0tt|zY$1YhFFC$#oX!AW>yf!#|zn*Vnjdr!6mXBg0r8mdcP*b;v z8c^=8j`YWP9kFBN7wc4LK7I4lc{Ojc^uxd_=+bC-FlgQ{LwLR7VZHd=uUddS!4=W}|dfx>T8pKuo#&&@e%r2{NLD9kV%@y_V#)4)a3KYAp0HUY+Syvp&eTdXhR=R|_8lA2={kj!#Ge&; zw*H-C?Qs96;N4OslLsCIjQ-PzL4WyN>Kl|TklM=CJ6eGYTzvm`I^M%?u?OvC!C(9& z_P5XH<{wlkJio(Czx4b9rK>==p1_m0d~!B(8AwxSKX8nEm#^ck;rFMve|&LI3Pb+2 z|2S|}0mQ>0DrJ^vrIa325_rz=wO;yQ-mizZU)#tx=D-cP-}^;Ij@D?`<2=Y{WFd^QLz(q9E!iluT!m~ZqxOd8UfqF{fJ?ilE3Y^D6*#;gUdw- zZzrs+(JYJ5E{-O1M->Q4Ds5@CBsZ`Y4yC?JO-qJ1rvyl~W~^SE$EcHA{jET8K%LH+(VdvtIA z^fGLInj}g{cEMFuRl;LocntVo_$1SJ|NM^x>rIp393 z32+xSd?{Mwz*L6Txz;Y4+#meU&fKd z2*sma@i^iU52qxk^#4pqL}c&Fcfe~?`q0~#p-ph!JHj2xJzZZz-Dp2ohZBiVh^n^ee7reU^{`(X-;6r-+KLGb z$AJZHa~HQXsMC-N_3Kjo<@mN!Zxb<{&`|FIe?(M0ul>A43KJ{}(UQI45hcbx-!Te# zzYH%3?iO$h6vfy%cR8oqM0LHV^0?K(knRypAApE@!{YOzJJRv2z0F4A;lvp=v>2%S z)z>1Gq~+<%E*a$%4ANjZUGg51x*T;ffVPTw-!LM~RoO!$b@d-_Y}pRh5+dBeqCHQS zB=amnZinQX6@BE7HC3;FpVol^k0ZbCE{53fTOVU70C($Q4CzWP`zR)j=Wu6m=w}_z z-Wj47%g)m2o*RV)8T{3|4LQ;og4NK09HKns^Yp$OvFok%K5TNIoBmfy3p9#i*WFWN zB+y@e9&oez! zUCncI;;XDJciA@vk?13zzwL3PBeT60X}TSZRM|?r#}YZOe>*hW9~ecE@a{#r=krvK zBE`J(T|eI`x&Qo#FlwuaZ543L&T}+S2~IcQZ6+f;YV;4_0_%8r^9DpHD^Dr*Df>q+1}<>4=Zy5u>a?o7)p< ziiH~Q)7C)Lo8!eA^aNy=yBKLI3Zz@VT(bE#>p7aJ;|271(Przp%@8b+n|_$reR%!V z#Xva2I*-sBD{nAR46kj*p5ox&L}xkK5IM+-pCP#v&KI z+AGu52i&f#n~V9O9Ie9CR$4{Ir{t}{9qHcW-fual4WST`$kmu8@|DZ}GTo+IVO(+o z$XrM}PSeeRn)2M+a_H=F5CPopM4jH&r~8t+kkqDvzWaK$R8a1yuQAWGb87n9Xk}mkFQDk-BgIUooAXdfZQ~|( z1*F<}+8&rLZj`XCrR~O!&Hb^diaz?bx|pcl?pianVkNS6)~*bT4d_D8 zI&FH|`po822I-x6#umE{KZ%lVc@p`xEPNyKAXYni0x=wDx)rsvw>8Xnyr|TT-p{jd zRh@Koa$COM6ZO_+@y1iFM-Xc>xZ9~J=ky$&CV+r~@BU$!?!bD;pE97Z5CORo}N~x#dwDH;(VOBKNu$u-=*zIQhV0ic$$zlRFMG+OR|9I&8583Z{7d4w+x zr)DWypRMZSE_SWl*vP!D?Dh5TE`HFU-kg4^!t}8MzdJ@lAjMm+c0V;9ZRG%p+*PiA zJCzjv-tzpcK-@s_xZw=6-iGzn`wibjA^lxZ$BP66WR2cqBRn3(a6o{}+}=e9h40k_ zFATX-+lR`KP$o@UT6KDsXaIIym6;&2KiMh%Zy(1cHU=86Djg5f9EIep_t5At5NA@rxa{WfwzmltXgO}8Q^TNIBs z5#gNnNNOX1^Dq$5@n$IT_O9bOmOmoD-!8#d=wV4kbr zP?Y2P#IvLV_VM_5+^>&CQV2xNYdLEO*70)%@Z%D1T#c_v2CJ8)L9Yftii^TGXOfK{ zAI>W{9z`227T2Mlqt4X%Dxe#s1)YdKdR|W8EXk;@%Efk`?^z)^Qy> zUa7m?ClZ71%oJSz3cTs;JwETlrno<;s*BR&zMii45fEg)OXd?(pW_gCJfDJ;X-SJJ z1D*>*R;Z217ceiM$X!W*sHbObBF;_PebsQqqSYSzz;p8*A~r}HI*~pBtqwzbBcVT7 z*HwwrML264^1%0y_;XZOS+EH@khl>S3ps!4*i`>c{Y;A8eAODbKC|}%G=A0&eHgM+ zbdJxx3PP8a&1gO!HWg_SSD*5IT;l{xi!yd_z1<)1ZL;G!qS|kR?yg6*3Ke*t9OjCn z)8)x2l0P&Z6k@XqNnEkIvpYR-J?R4RK2Ev zt`p*33^pA|r+W<3a8J|F-c__b8d3||@0lGEKCMR7Eus6t^?hs*dA>5d^-Hp6)zlGm z-RVrGXnyupd?O@!4uo!ykzp2?-O^xxqtBD3%RgPMk#n5Kv>{j<`&qpaK$=E+Jf`Oc z-G8)4sQD=`jCftPsPlBRnK=vtR6(uC4d7RycmB{_=&e}vf!4I}T*4Ct^bvY&Qr4#t z6ad#G<#Jol02PBCwo$3lw>x7WKUiFpSO>YtUH0gh{qwCpgoS>-SBTg26q4gsq|ZRtCw94`P9*BFUw%Z@ z{iwc@F7~vC7lNhbfh6i^5T&SbQ6_yW+z6EsW7(#G-ko1Dut|CB`#SdQ6e5nj$$%Wy z2S2MwuQoodulpt4t)Qj@9>%HaBKky|a-Fx@$m?dGi5DIB?xV`cp?jzLzn~ZQh?Y$2 zV{N`0#dCVjJfg*h#Ex4t8LL8G>~vhlVCh6K-~=S&2nmUT9PhE{1MW5;_0`q7P5a1f zC6gI~pT~GY#a^M_9HP*QJoMA_rk{uCJ@0gjMFJismTp%4p;fn1*NR|l$7%2Dl_=nN z4e%mHx)K+W+XoN2+XlrYIeOaIH5UUMRvFuin(vU++!{XAgmsNQ-}N-HHQ$sT6o5n_ z=cx9y1s_D8Z#eSCB0t;_x18P2w23{2+P|MHTe*5x9{*mD0n6}@JNAR7YAe0ZFElu3 zzTDM&MgMDsxjne{74$sOw*qTWmM{x?x#tfjjpuD0c-gyJFsgHZzA{H6DPr4%S_Q^AY&c+0$_a;i>=0G+l7?we;r(}d#HapknBq8sY zhkXK{ZjSQjh}~UHMWE*ubs0;Sdy+9R{$fQ*`t{kD&)|%(D73pRk}64W_l1w!M}Rv+ zP-tiu$fv;PXp_dCf=~3?-{(M}9th@AT)7C#C&gLoetrA=cmeKOpKsn@b@Xl9!?*Wbb{nR&c)JDeF3Oj$c;Ao-)&(;~R$bEdk@PcXy%wi{$zG7$Xt$l7Hgd`^@L>T_$?^l%exN5C<-s5+Y=FX zD4Ewr7;GHxcQ93lMFHGU10_&GX#Iry#r9u$pWz&#OC)27Ilc&9K52P0XdlnP?;X~g zXFm~fdC|K??&Z+ACh(hIE%+#zjqDcbC*0=EIpS576n`iy!On^PW$pAf-z~>9xt7uc z7@Y{>yWR=a`ucd-84pEA_^$taC^`OFi`h+5&g9)9V)}{$&-)*!w_*=_IhCjtO;i~7 z7ssoWOA091*6r2OJaaqP=lNQ_8q(RO-?^KJ z^Mos`54^wT%K$>=8SY|tU<7-$5l+o z?GYlINKd~p)=@#o?`3Rt;qIw#Pj4cHZ_{kN1n-th6`!yW-uav~m=nMwZAffRJcnFF ziXpsd&V7hTRrlQM+C42-ZDGocZE`z)m?1j0e-D8qQlEj~e*)&pq)*B-T7_;zKZ0oS z{hQX>{ShztO35t@FyV`Fq!R7Kvq*16uq)w)1RU0~&1IW+72R7PlCTw1ymDF;;?)Ck zNqvM?Y&c8+1b&zI0G;vYX6vs1t2KsnVHXzny|WI<5DGA1*fJZ|cV~)5+aLdEV=qw^ zC`CS|qki;Lodk=Y)HPhjfL257v}s}_VM^F;gG~S4ghd7@2|HSq1zP?;j=~7FDZsWW zt&iQd*0fH46gL$FzBw)5Qo=(vn`{T&GwT22QA~dx1w-)yed^@zPw?tWWB#0ddZ-6> znG2YUE$dl+eLq$&lyK9VJWpgF`t(lWpBFBN(^v4he*YwwXdl{^)0A|^d@K_*HaFJW z*37e?;Yeh!H%(GtoWAr1ab)!kk~;?^4;{_j4#nk$cY&3@*@@~T)M=7rX`{ndMbx1n zFhlH>%hiYROW2NI=)TveZ3R*H6rw~o2eq^g1p(gDNrvDvS;mNt_vthmFUQ)vz?hVnZwLW=&G=&uJ%CVl9hTWfdZ3mWfBE-&HvK!X0#%%a`SM(I^Trt-9WfxDcse!3g~L^hm>_-XlgIYw zVXo+8QTFp^nUC^p)*l3ROzS334K(4TB{s7}%#AXdD6J8Z*a`r`oFshhM@_M3&C0?n zU}p|{Bmy9i>D;u@9gQty)@nC$G(DhodAt^8OuTpZS9#|_^cmIk1)Kh3PiyXXHuJ?| z_Y@G0wf=?i#8wArhN^_Nkm6I;Qcl5pJpmbWj}4o>;=bpMr;bymIWHhf=sEDspunpO z$eGSMZPla6nzPsgnJD4aQ-xnaX0=MknCGkz1m|ue3ZVFe?{VePKIO31U~5~S43`n* z?dp`*1Sne)e6%-T$L|(ptLyCvnltUlA=*e6BDgG()%BA*fp9riU!Ux;c9Uy%YO!^b zm-h53_O&ur%@pr$?l~ev5H!vw!LH8u;k)zQ<|BVx!L-0D_GZpZd~7!Wd65tiG#fY& zk_h7)_$pj4QR-EwD8u`E^mzFIQ(z0ANVH5)C^zN-@}C->2pjdfRNgr3Gt%EDnMJBW zTqmVU0EGJ-7(F?w$_=A)jOi*sMT>P3&s2CNp-@QNGis%^mOMIq|q%*wqiuK zOrA1l3S?a;_|2HdN1t_qizp{R^7#Ia0{))*q;d4#o{2IIDBh0Cf_WDr4np0aN^4wnj>URaR zHN-GMHLP@l0k`$wsLsS$8BwUS+DJb`=W{Av`Bk?B_EHs|89?BMEA zrS0~N7W36gzhq&eG=)zL^ycwsyLzl>DH2M0Jvsg16OA*iWA1FWhN~CnY7WnG(_l%q zDp^-ZEDCDvaqYHU>V-etZk2i4x#z`)HLmN+zzMQ%ixMEk5fjCYIIkWFw3*rWCBM_; zk<=Ged6~B{2_EZmmwG64x7?<=h?a|OF#^QioVW`ST=+oF=5JR+MnCxYP(7sX06?Z{ zs)wA!N`_x1Y`B>XbYI+;d($Qi9J8iUV6vzQ5?ox=n%P*>)~giikBxj|=^+&*e!So= z_6SbmeOG%8ntYR7O-w)A{4#1})7Z2sN04XsSh7q9vbD0@Qjha^^m4(O>ZXC-X*IK( zu28S3Xs+3-k=C+VitU~$ZO_)M;=6HrhSAn2p31I~K7Sl2MfveIZi4N)hS;q#gzKaA z(Isn?q9>|5gXi4hw%SuY^>3y$%hsR8U*_}YL)s zgnCT{cQ`_RaPL zTg0rVbf^8WbdInb-!5MqE$~fBgkEz_U`=iFz|R(9^2mC()yRWOdRa?$JZyTsZ{z`V zD`nr4r_HQRJhrATyU$2xQ6AT9Rl$3#46VuoNs3mN2CR8^k<~iiJ$*FUH|NrSEu72> zxmo%z?Mx=53h8)KJ+wb%=h%BktH%_0!}@sY8y1GPLVW1*eK()=E~*Qz7|Zdb9{%+c z{y7pVi?P8bgHgIB?E?`%rh{rf@}0>vI?W~rX*Nww*A(aV?y4Qj*yvpvR>%Yu*wfAX zLKoeE-22AoPTM>{uYiB0LjGj-haKID!uj-PC|L5+tQe>M|! z*1_fScQ(Zbvhq>~O)brbf!p({EH-=$#pkul?)_->=YxnUE7FZO$0><~ZI0eXro5&8 ze8y@UN&5CgQ+sN>bH0PO1IK^*!tKwJLf$?PT5(K z>qLoo`p13wic;hn?U$oNc1-pJ1{sm!&Nv26kk3zY=GhrqDKf`v@6tm(&)*+$y%pYe zdGfCR@Hq@^R(2+=J~8AYh5|!NP2>Nd?46<{>Dq9?F57mOZM)01ZQJg$ZQHhO+qSE+ zZ1mLkpEGxJGkKRQBQjR(^~R1D41XA^- zBI{b~;78lS&{}h;wK8OIY8xlNQ{`^Da}IJ4-Vg`umSom$Y}~A~=*t>{oG$XwQoUx- z>Qj+-0|Q4jRt#oV(OwWoFYXk&R|{>CR$rk&rQe7>rj|InD@A%-3$B!}sbys@E>QPw zs@}+Kr>CW!oEpuJ;L&QP-4j@MVLHW8Yl!3ANS?)DX1f~SdB%=@>QLcx;6LCBuz|aR zS`2qFHEY+2%VfuT_2-G#+7Y!lSjZCtqT7eN@^-F{X6A+}>?poJ(}UD_Hy%(X&bVn) z7y0lq?=RIaR%Jaq{8`i2GAmL)v8~E~8#FN%GuvD61dU%y;pA}mxV7d*GOoOQi_HY# zmZxWiS;Z{FdnJ!sTIN8z|>Ncu> z)82|KHCThyda4&wLC(3*pDuYWwj%59X-bl3;g4Iu z7%q&jnbA^#2s!Q;LYK&ncDqs?o({0NY+^fYu9Y@VP8CS)@*#aK1qZ1uE!b#B^ne24 z_nH3j!xHACpk9K+o{bBW73KvpNnzHQPzX&0%`%FY!;Ss2cVB3>blBHkIvgd+9k?_8 zcRp{F@B2k~HEvP`1?ujueCa+#ot32YMdbAg=DE#r3N`%Z3rZ0ug8pObSvpPG0Cyg_pO z98X8y4L=BwzM7{Fuho(E#B=6$N6{)?1x#C-S(J2pZ^AW*B%VM(XEm$P@#Wm8m*^Alj{^2UbLH_( z-2>-Lc7EMB65&>e@X_pG@+Vd1$N7is{9wpaw6iRwP7a)t!k@&8_qi4OEtd`DbL`%y z#Q)CkME6Jv`HgyuYy4~WXaAH1<#VFBT}SDs|H8d}lmnX0f&cr>^3|vA@GAE$hX>;g z(54vbQxN+-%P9`W;mCBho=8YPNtFA=xtHFkwX@lA(!#2EV%|8`>B|Q{GwGy;tQRcD zL40~}_L4(4L;wb(E#dv9cz{z^4yLpvKOmEJ)r22UNounh2~{h!e|nJ1Pw>ysF;fM` zY2W+vq3)tU!(47gj0ccdWfl#n8wUd!KeO6%0b%sw^Dna;ZME7VVvNlpKx zRQhFt%$UsoQ*=2X=VI^CC44%}ojgGO+Y1YOJ3i=X_k)ojP%!kiWc0Ew2PkjNBV{GZ zza+}Wvyl#zq(U2D(`Va+j$kww;@#d1%YeP=UCWB{d!;IUX5)UvAejGyyK{3TH*(E` z+f2IQbJ)c8px^qhR_!^rvKk|N8Fl^H$dx4BMF2Hm^g6!Wr-}tcDkr+BCV4K82?t)d zbw>GtT2gV-jb2F!8Y%Dsj0uF+f?Iu zT%>ebouQB0ZhnZ0qi+BAvf;RnV_)T4Z<#(Q7NuGL)s1n#{@rb}9e2uYwTKdh{``EM z^xu>5!}#Iv*(~vX3Ex~1KZ+BAZ_jr8|N1k+R;B+_oJalgO12_=+02s48Sy!5VMXTr zIm`C{Tmv5y=!EEhC?$;ldJz!+2SE8P|NrC5DG<7T0BY600q~Jy3S7c!9gs)I(2!%l;I2lVL@}rq$g_vxc9@+%i^JpovbOh7UQp!Irmrr)M;3S# zP2dMB^XCfpzjg5N18ZaKH;-BCV~ZDy7^=Lqs*L!RI*Ad+#>${0SffLkBiGL z^}jxG6wk?bbx?257G4GCM>-0O6X*lB{!>yW?3T(G$(&SKrncM~IR4%;TvZfs#VIWB*v< z!9Lb^2OOuu#m}3w>mOYt>Pm5^&wKx-B*u&pN$za=+vjEO?^6#Ugt2tAvRv#d=lubZ z2svu5|DY~^Y5(8#=3N9#iI|XLjr33=*Y9OUu3Q@ONkApyE>V;}uAS;h6kG8mXj_Kc z%V9FHMKJ^k$>r0$s_ssq_(@L@-UVj5`+(~foaRuSA?e1 zF|qti*=N6?`Ct|vH(MyY`?q?Gb2DkJd5k)WA(QYgCGLN~(q8m-`>lUGeZX6Yc41P* z_iA;jBEWonFZY+ezIr1#^aR7C3&ix@L|p9mbnchwR-C&u7g{q2%!d<> z|BIm3{Qv3}{ux?xr12&Rb3|x!VWN6@8Xnhi0~KL0$Y7!XF$=2fwYa&>IaVY}jJ@1h zogt%PPhwsJwo z9hNS^Z&)m15pw=7^!qH8W<8X7TK@_M*iKo$C!-oD20bFqO3Tik^u#`f|Dmk!Ps2t>B{Sa+F8x4t4fS9q>u|5*P|!?5+?^!YPsHo z$l+T}e5ebte#1Au9-1`DJRm0rUB4F}97JSj(3y8udGfJa2Gw1Eb}ubs6R1vujhQ>_&{gY;YBr<1x)Rv7 zuny&DSl5_e?4&{jxH|7=m~;MK`=jQg)G167^jPl?&jIat&kMt7HV)!lR?36M1)@a7q@M$GF!IWvy=y&4Zd-QC_qEha^O(@+^yKJ3A9M<@A3r zIXj{MyN~|IdH{AH{y#5)|Df<;{HXuC6??F>?@gSvgPxiLQI^m_Bzd0pf2}|wcWhFH z{gAku_alw4QNL?N1VP-Hj`}Ao$^8Kn?Hb7?r)c-(<9Ath|B4v&4zKaR@+Dw`>FUSMOf7&HmTlIco^~)e_6-e}w z8`huA#A0%2k5>qPi)q$C$VQ)Oj<)*m_rgwU`6Uj?NW+Z`-RT`bCHNXGdv7?e5;1Zd z#hhAyv?UO7yY#+8qd~fz4BZ7co&VTtA8juy3{3qn=z;kt6U6tR z`|JgYO8#k*oSBQ*&>|c{4kO2Dgb`9MEDo;^PTN2cgL(VM$<>Qdd7%fRO3Q+DsIYmq$$kgi`7EcRquAdzTCq z>JKE|BP?Y?D*nN5-Q+*Wv3aLsw{%_c_n#?`rKhb*o;x9gw3{?1r6SK|X ztI+isY@m@@Kr-O?I5Ok(Y>n3)eruw>p1(70*v?r|0Ie{}V-Hc6c)`2LP<1;?8ntwW z`~8JJ_ejCVoTJAFO9vxy%kmd`vqG-XlSF%Tb;1`g;-$$~e75G7qbP|)n^;lA+>ux49KoBq)(vUcL(CT!%#|0{z;<|ebbWya z74mO3C|V`uI5>b4C!qui<6=oVx&wBejabna780xL$)KU=T+NAy9=xmZu4~E&{S|Fn$hQ6czw` zv_Pu{!?di41T*9#&iBTgp|)`%+~Jq1g~*?FHUhQh5RLWTVBztCBZblFAXzMmmZQdVW{Z$Ly~r2mIwm|^C;hY;|i>4*UOGsJ}vLC43EJpr#zHVQ%S zkmbJFJX zck1E&8=xNxAzaGsDK=n2qc6uXnp9P7CthAmjqXpz<+-GNNFvZy+=`$&%%Gw4Y=Ctl zTC%3UPt$ICl=JIB#L4m(Y4U)}l~uW}iY}_sg2VA+>}1f~`1J0~LI?9Ib!XSO@KfgJ z((MS;4nk=Xc*%%Rqo?*&RU)xBRDK^Z!_2}=;(@_c{Kjho;3rK?!{-h7y?QwLfgPGP|ZPKZ4w0pY+YPVom`VZ zl8kzkfW1GC9H!GHSY3_#K0)LZDcQ`6T%{75d_+rdE6u zB&SeYT;m$FULJAZ)z+|c5ajoHbW2HBZh6AT&yAX$bBPrXqUEU-4fDghueW1Mo19&C zO=geZ;nTx5nnj5e_wQTTSzg@0lx6sUlb*_TVcKDF)NMOHS69 zFMb&(Gi3W;MS( z!#1*;-(9^$NCYvmFYZ(!WNzx?s;+D5{116{n0IVtA%#~PD^tZ=ahhRSrLc*Go}`tP zmy3g*vnrR+xv3uEr70b!ERAp#cKg6UA_+@heTVVd+5!n>uVJ82O|P_|@f=ZW4oWUd6nMo2;v7a*m8{ zQ$B)6UyG#)zTKeAJ33OXQeRid!pBcv{5R=Z{}l1UfPEp2F<2@qTBW1msv!agWU3ka zfajiD>}fkObb^S?0FAupiioP{QgHP3qJSee>u3)vs=*1y#qHsM`Tel*;S+^gaR9i{ z=<@{X&ctYReLUy3$Qs4#AEH!o#lq*=0X!muuTyl5L`Z65WN#yDKepT~J)=VmG+U>( zQckVKKK`D$z-=&30_+n4v_q?o&ZtXO;Po`@$|?m+>hI%5@)Z$pq}+H#Zmf%Q#OqTA z)(!Kc>|a8aoZB8EB&=#G7L%|vbQ3ja+2BB~>`OW2a@ab$46ZRPOpMxzd+>ZnZ18;L zw%`k_De1n!t>Gc+L$lAU$&%%ju2@Jd8#e0zk>uoOe~U-)F{yIgw101<%(z*I;cu?~ zCjIa!>rna3)I9NF_7Y{SybsCFc(Juujde~=&8-+TO>JVQsKe@!_2Ww^5>5|@X4^N^ z5zLL5WCdHaQuhgl6QRb51P3!?!G}NkLTLI?d!1{WZ)Pm(+-t?EayndhM)vah+kHu1 z&Ve=l>?8dv8rM&Un2oLa=0&}(0XW9e)G0FVC+CaU{y#!QN|PLv%Ja+A2yAH9;zT-6 zq=tMnfx#r?6Wh+|jmYX-+`Bp4EL%MOD17ZYgD&BdRpA9W!`5;jhCSa63nt?u*er#t z#P<50uGWTpb2&SyWoxf(nN~FoUbNdF-Ml_Hjv!FuA;l39&PFnWtg6F(?ml=3vsdQS zvP+Cj>9&)%u<$R>&}0UT($Ma>A(iFt=3e-C=QtLYc~m6l+eJA>U1{@L-2L}q)r6*- zUTZ`ui}Hpg#U1qpUjC!Qluo>8j3Rvr+#9lLL@69;6~bwicH+gN==*eB9hDDot~-P| zeBaGbbf2u{{v{eNMJRHxo5cR-XqtW~KGJ5HC?{Z*->zzbcyN1vWI$R&qHb?*`^pLk zRZJefdH(g)LC)q;0IXX(I!=gEL4jISdb#*nXGX?vX38NxK3Z5(xn4uw--FWimVc~{ zEWL&_a4h;g1vj~frlv=BrwzTkT0Kzz&)OqXr1>3s}%Bz*q@-wmUkkHf?(ooLzO$ZSoX<(TbCp8;r!&3doA2!!uu8h7W zOw!^#7!E${28V!Ru(Q4ww;1yD1aZgDGeOy$G=@TZa*WDlLqkDR)QmOX!9L$VA@~nR zD0_|} zrk7nvhR+Ao1oPMp&P2rJ-P-H*nq#_o&r>l5>BY&tFzolU&u3I&3|XmJrwo`FlRmQL*%(o6^#EC1#2=;+M`4uPKB_j8F49`RfRKjyZ-D@4&NwvPND`&>KcYfsx%bR#0^McySoWpM3$pN(}PQn(rU@^U04ls{R7}#6FJ z{kImiB<>47(qsKYldBrcEGPKEZe((bbeK1;AGT-1Sj?!kCl(h5DN76{kle1YLWp1WBN~B%MVsFH_+1`&(w=L(J7+JCj0ihChH4pZt(kzd0V?>}{RuneN%=89_ z08I?VD^G4$De1Ye73 zqJ?HXg;r}TK(!Sc<44}miQe?*Q#CxSQi++s45PL~URj|<(+r!@yz%zsyc!V|1?x`4 z^cN{TKK+_>un+}moHL@hBP9R4uFd;S(rtBYYO__TLWx-IB*clUWuTh?@l3?j#7gPo zkB#QhmGQs15>!x*&u1TqK%rUP3|!8oP1~aLv!j5Fkdb9TL4CSL?$SmWckN8f%X9Ul zpkM(6P6GmLN>Eck))3~tb@W?8H-RoB_-angk{cZP$cWO$;6zDJ%6{|Q3%|aGmEyXv zWgWXDW+L+9w2Q+Ac3@9`<|up_62J za9|#7WL`erbOm1RZ2bBx6%CNr z_Yt6a1QmGLSh{>m#w27c$)*|hN`fBjN9jzsuCG0+-sB!narMTAS}8j^2(o0u_o3uE5jx2B<7jZ!3LgDKwm19ql|yp$c2H zf#Q0N&uwl>>)HE8t>;cuo0eSQjHuZ*l-RgFbjvMKQ$eE`)hwmzc*2SXg|pSG zqz@`o)HvV$5X}m$8k)LXb^F1jbde7{MlX%`{L=DlqZUPL)7gJG%9TD2@{qfS;nU*q$0U=sPrO1XH+65{Mu zT;ZRiZH6I2r+!o!vM&;;$)@hJJ7)6J9wTs9pYUs64H5Uc=PzjU+1O}08uL|s8s^xT zoDOMoBPjGB5iuXcTXw*Jr4^mU)fL4gx-u9sTmOkJs8HvIzSSU)AM^mH;dD)qcFuAz&sk1rp7 zx`RqjOrJ81)f!>q5mGqM2vQ;9uuoL#Ka8qf><^crK5={X{{D}d&g8r z$^=T4B?S+Sa#6-FZ{ucVHi?IZ`M99}x97|-FTtrH5ng2Ip%4I@1kp&7D9??Arjg?r zYgJDu@gu@#;AEup#JrW3aBA_ZQwOG|{#RfCkts^V;MN!@UgNfHs7wT?O5atiU5CMJ3Q3;}P$94ao1(cg%AMUtX` zKMY}sACuc6hkW*+9)4?AuGA6^tqAQHh6kuuWQ0TjS+rKHM*v((chILg=4v%D@G#_r zQ{kkc3B_z`>TjHyO-(X@d_?E!86A@B0t=XtIrFh6H7f^Z<#dt45vyDq0%#Q*w{xd0 z1jd4jddLYlR-73Hne_hF3lmnzi7l&uGA^Vs9x!fn@|gy@;hwGEdOJ=Nr05@f3Sg&9 zNW~+7g1-UhqC=Z)sv~?XZ~KRtHkCdy1D^;os)*2$z8M3UKp$pcBa|`(a5H#`yLT4QphkkJnDg8mJsOyNg$E!hrQeIcI%e5Seuj?nfdCMW=1DHLZ&{o8=hls>mH!m z@i;(cCP%y2$%(yH!#u;e6`hU>P{L})LWf}5C_qbjsRItNmeqL*ai?V?k7(~l4n%qc z03vqH1e<~!-e>AlAy~-9gRDkHeq4(lf|}(OUrem7qbw9WakYUT3wwQo|1n?9vJb+s3Y;+pgFr-TGTBvCY-7Pf( zJRK-=uO{T8TplA%D5CEL{9dMpZO@iG4ipu)zilEw@=ks82?!bR+0c2@#y`WK3Z(Yk zUWl2tBLGYHk!GW6+R-?)=Q)DMMyNoCUjyAH-iM&c-8#{~9pW&?WZkb9WOWUAh6TjR zOp_wS|B0w!9)q2evO`ZbjQN%eDd7nf1A9Nc+M??adG| z_?w_nPmx{l23_#B{A-5c=0ft<0FeE_HLv}jd)Jors2+}W4h>tqWUkA!vr2pDF_p8d z=zG2RbK{D0M*mFwW&oK!&;Km^0Da3K-zKk96Gy!o_6ay=pHOWfkgJ=1+BmP3sQy~* z)2-F~D7NXDR!``&N(Txt)U(W_eO%ES)=ZeapU!HOCR>YAxkF{ESiG|AV~bVa?B-9o zQp3DOPuAW-N%!Pfhg>w6Fa!YWe7*KFqycI=zHiur++VGpi-(^ufxow=1t(YyJh|G^ zd8MVCElF{&?m+bM??e*JnJ#jd?lDThoFr|lnV=h4U$p-j{V~avq~XUPH)N}53L(!S zLpjhjw_!4eE15N2$XoWV_^lWIEcm@{`W9?I{LImdou=ARQ-T>~DqKD9<;_2xxB_O% zexb~8=4{6YWO{eW4FNE~Hlq_P)1Fgem;N^;B#c+7cj?Nx)$3 zk(KK$nQqNa@}fbCwwsorubQd#;I9hWzC6Xw{xZF5>w)LEBShYV*+gS8z}&X%?K*+g zY`v3F?HtU;YFB<=vI#wnyrURRKHY$>3-_vt`Q26;mA76<#w(zBtufwasgk$f0g})s zK$4G@2x`jUV1Srd&o-HA&}J4V58AIIN0BZpMNNbU%b*bD_Z?g?mNUVTbTkl$TE2q) zo8%FLV_e582tMd{`=$Q-VK^=4OIbLS0GuW(n1aK08R`t%lJ$^;W}zwy=F4M%sF~kG z+Hd=xU zr{xj1gQbIhr%BWXBMUq$*IWqbA3b%t7LWqdS|Lo=|#hQVg70Aqym#0C3^|*oG z*!NMG$(Fn#`V-spKD7NBF^#lg>EH#~b~GecTY;h^A@(jn$HAzaLWxwYsS<99egQ&O zSQIe<{=ip3rr^!L*8O3Hdf~;|`xTg>Q##f%xfeU}FFdxi+pV_cLE(fU*V*zxo3IiJ z0Pi9&vO#IiD*F0NRN#5;@|2e5i5x|PCg9d+XyepZZ`!tDWc7f z&)*8x1Hp_7Skt#3RLA6CZ@+xd#|9t?Fm$5J%4;@%$XXX}OF|gC1URq&@PCO#L&84+ zqr0y6D;>^ho^C|4!^3|86Je$53#D&87h#dnv_Ov9cdJh01s}>=atJ-mIm?i7B)3s7 zP?Q83q^x&wE4Flbwbj>$qo88;56EwoLw^OwTUB~C4+vghYhRXXH`fL`;BaX328Q>= ze~n|a&g2Ch7rp>+p+NiR-|F4ErA0xEk)vuISiLw3bsRDvqpYB`cRYHKV;!|UYASze ziOW1yy&}+mO}I08kZ}|6vkbq!!KE7SS2PR3fuZF7D4h#7*cXiQOWLYmPKhz99A+_4 zpMgWxf%Tee#(e|SdYSMaBT2k;aPFJtKFThpW*YqSJ$y{^lZL^uad9yvD`HI%&n zP!7yE&NLF^3Hfwc{IO+AAzqrt{SoNdyin0sHu-b@%s^BP-T1KT~5Ic8A!?rgeEbL_F`J90!*B&}J`{8qU%M!(2M!-Ht*Rl9842L+V2Fo|G zH-Ss}v=%@#lSj@ruR*62><~dr3Y!(yEsXg2*>ezYWXd;>7#HG-?*8Z_9zWR}r#f4w z4<%Fey?xOmaI0WwgI5hURZJd|!eAEz`G8#k6}n<9EddBpMbuL~E&D~))xwBH-!=qI z@#6TiR|{*RibLDCF#tE(^UQ>hark*I1ve5F5-^U?XYd-3hxdlWR(cpX_L--pOLGZH zYaR<5U5Hk>>8LS%^fq#TU}}am(@-D&WYNC^U&-0)^f2wV>y$S0{@l#BPdc$^13HM= z*ybknb*cBI**$MM7ny>(HkfuXJ;Q=^e)|k{3Ru`z7PJz zjr9C8ky^~BY`< zZ$#(H-AWe*$kG>XX(_D-!#S~;ia3pr1J`XOSvwZcc#a+Z!*OtGTF24Z&$+mq9LQXGJHx+Tb5}OkeRa5qq z`IIwG3v1>3dlmo4WQ)pc_UHSL*I)<43&=>uEgM8rUOn_;^l_cnRm|u0{Yj%aXj&#G z(Q27%D>V$je}zjXt-ms{UPp9(cY@;_BE38$utKG)p{|b-YqS7j3?yZY+Qv^=$3#Tr zR7ax_K3lp-&r2(-IO0|fW&T}Bdz9a*;;YQ+0bJc$%aCAl9&)!h7v>zOe|y&@!kNawR08qNjTOgbSlX&QSV#Dm-HfVWZ)=xF#pA<^xKt_f zR9vv`pQTU8%!T(I`;F4VF)dn(G8@Meg-F*cwWSRzLuf`+PN>A;VmBS=xI zqBLF#4npF`ZK={HxZKCWS1m%;q4u^TcKz%F8u%9*-h=8BN z1oYs)?ZEB2ArjHXW*RoN5-@@&JCNpVcO;zdgAiHUJ_<*wO}Nv zIkU?;h^dXuSnv=jnW=KzxcMG7gQEX*zwgg)>|)vLBH5=iXkwkJa+NF4|n_}ZkaE<6y^TpS%OnKITIl)+q2~F3+L`>%5MyPxy8*QLY-W17IT5z95N_Pv^+eL_H|hCNdpCD)RKsM8O<%Q zpi7T2?B;>V^1&l!=qAEaP~@11$#yllk&QSb7m6VEZxiA3NI3Cv8tlz$Nuzbv-m<-V z!d(7`o`42wGcozyPCkkAZy>hefoCueJ}qi>0@QqT`QYsR1fy`l{NVJmb|!XPfN&%; z+fAG?gcZUh;8~I~I2})VvOsA=5ybn?&H{nV8+i(sxyfV)6;r)H%R+W?$_!Vu(dFse z_GQN)Wxl{Ji?1t#vLOThGHk8M(8sm2nj^D*qXaSUeXp;VS>CNWS*V0o!7fO%Wsqah2HN$IBU3qbQ4KJ8JRLE|Gpy=|>%Ija`$ znpGA6O&W0=)1`AKVsDNl9c~G&q#8TZplK>6vgO9N1C1!!J1q`b+cN^Lx8~PwC z@2#v4>SYmKo(=h_?&mb*c(pe&EEm<*)~~$OLe48_ ztI-4=Z(cX9runjFR<>)NVn|No;P2!daHEHvNF`1H1uO`Ld@)U+0ulkcJA;M-5=xpM!9+gcBLGtcH+}^JryP}mvzel zi7zJ2I|(~AyH}B?kLtF#kY}88GeqOw?>>ej8H9Vq@}lO!P(B5$rhRKiyIw01SDwwi z3?OFzzx7wefkiY(ZuoWZ4MkSWJf*|u!jTXy$j~2juJ1t!g)JKX@+E%49zEFqOOtMR z^^NnWcK7W`PS_MtRkD&*l~=hJ6+8M?0&w5RbG`ljy3um}9wxY81nM3`KRbom{> z)!ewKnKdr&ne!(ZB37v@36fc2)hS4bX`4Nq!2}Tdog*dOdPv1Kr5dhWr3_ZHUOrkE z4-TO+nO_tjMB>3TEM!0;IRr|JOO!a+R`qfdG9)%>5q&+qQ*_&kMIn>&8tx-32G8#) zUz$lVsk`1bgd&E_I;<9)B4|~ubS(vK97@8Q6j?O3>+{yI6yl{7y#-~EgiWO6WQw7@ z8#=j2X>o`pvPhT{4Y@5ND()!~X=rI(Or^TGHd0bj zEJ~`@DeqW=5tE7enX8*>2#)-T>Zh8L`hy4OQ;2M#>esE~2#QXV`NU~dq0t{EFQvH2 z5iml36q?{jvNPjV*V!zSu9~Ky@Kq2hWLFgxm0W^&S;GbiquAE+hf;6Sfw zq#Zf3(n)oaWZNi(98rj0N;MHXyBRo9O#3FcVw#$Z9)4x)HDReuv*dJq>HT z4%f&>*1DONi&yG)Ewi@jY4Q^7WXniMt!6l!otJoJGBYi##vJ1i!+k&>DHy0)4ElN6 zDTgdDSCg`JvT_qQcfd99re$ROH8>*6K<40K#cSnQByh3E@R#Ul@~k3bU$iZy+B{hi z)0&u=B$s<6RS9Hxq_oY-6Td!6X=r3>t)P)JY)CRDSxHLWQ>7v#EN0>UvM+&Xm8X#X zLD3jvtoHSh((^tkoF1(hYbo9Q`S_Gj^*~_>Pq=Ezm?qMxZq3V;4;ncxLR(^bf4~D<(T>ke*9y?aHA7c3J7R@g9Z_6dFcvk;E2m*4 zCUC3fpDnxAJ*OjgEP0-Xnx zK{u-$8!v!6Xi8p85Uvi}!Lt!HnfP?k((>+})U7<(E}f(>fjdY#Uc?Usm4i*5j#P=TMcfOfr&IZr zEO5cXO&Rt>bE{DTPmfDiUT4+CjkE*=4V;W0neBy;T2( zOSI%Bq)^RYC}pJd(Uj?C#OJVeIfqruCN@egG+@v6<&;}U5^JQy|6x$~w4C_tsmiBW zwrx#mlBRYIp{MY&F)&q?cseo119+lkn;TJ(5_6N%Hn#T6*|wVSVJpCtpp~J`OoSv@ zAAhq*8Vyzoo+-MTc3yOTWRkrwOI?T;8t*HsWv41?CKbE!(#2T>|%z0l3R%H~$)+`0W-Qzr-S_RrId(!$p+OaQ>G|SC4=;V2{5X+TS_90XBfurFbwA^p3Hm;>O>3Q&0LVH#3)-XI%9)}FGk)V;>eeny8%<< zq@^4ZDW^ppDIb3sAwv+JW3|QQ_#X_=6NofDPy3=cV&rVRFI?OhN;%OYcyQ?KBm9Lo zLsfgnh{n9-Hr4ojgy+Rqul&sp%l)%n5a9K5XIjRC+UOb5baIO-Dr?DfX2E=r$NmLZ zW_yDN43((CZ`&qfkuoZKd%jC#4@y|tS?L%JOxL8kyL8t zcM0HMz)p;5f1Q=iT#3P}Po#1T?$VAOTCi3-DRX{_l-UtLWD;V&ouc}Oo^I^_*LHP5 z)6b~?Jazj{tZOs?YF!@P#1x>Ln!T~1dunDiXN_3-w%~S%U!CLaXbasxQg^#dpXmAl zPB3t(r63ySwmPp9{9RjOuAMv|Up`dmkQCgq9$_=bh&QS@INoejVjBizEoAx{BZ|212m%?K7xlFTq4pf@9tBg&}V$Qv$mIQN-_W*$t>$1Q

    wsyX3FYO1oI;9O+Vs(N_~7aX|<7M04L?r$9ybuwHgIlFtj3Dll5Xe)7G=X% z6q$IMoZ>E0qC;>8z;wp8wwh-E%*&K6+5+58z=Sr_tZQ?u!)ggOSSMn&JV&uI(sa^( zri=_mLu9KYVdeD}2}LERY$~N%I)#xe78_hD6~Yjrfu^2@OMd$i-N7I8!|2pXdaHhk zL84u&yx`ZN7nkNxFkQ5IH@MgYJgS(|TqZg;-B46=^p$o1L)wso_^;z~MnJK=XYqoc zHGLGUEUi=QPPz-Tl9A`a#)`aENw&hBg8p*H23JB$*K?#ECEV-CZ^r^S9qC zRaxP8LR^Z1zpm@r20Ii|$JONE1I^(=v{fG~x_)m~hhNxL+g#`56KB&Q6A4Az(9_>f zi27)Z%4$tqi!=;;*kpq07g=lk?T)*@Dp~wq7TlPWYA87`lo=|gF9hx~H{u=4pZk5G z-**l#J7_rsBN(hLbdryX{<2NZvUU5MIt|ILv@*voHU11sq!0%M8vW}tS&*A&6TKWc z{B!fe5(si5RE!WXDA9xAj*Fxpx7{znp_ioHPAZ3^A797d)BB(8J^b{-9ovlUPM)XL zZq$igEM!qG8-kKtNR8tT;TVqu%H;2b2b@R~N6l3eshTABUl;k!L0;@MuHgM)i-jQk zy&qreKyg~VaaE9Zb}8La)C3}kMa?8xCh;>SSX2J`9F8Q2uRF12632p`p+_RV&IE!Z zt21Q6WY5Y$xw9*2*;gm`$WbDoUX#->r}^d4u3z5)nABJsT`r5K?k;6cI`HTN7GA=# z7LQ^td$&{X8fh*w?8ZV_jBmUrg-G?P*}CkS*dD13>eC6wCRp1U=*4SiOPlL^A93s} z{LO^72C!C(YBIP5px2jRZ}q0mHl8BMb*@U+R~m}r@_D(b(hSuM72K*Og|Wz6vHpT1 z0ZiD|u3};-xqm3S9LO2@C`)(_p3~)D8Cs}#8rNknp4w_WRgD9}>x?z@onPO7KnPl@ zv+p*&MbZ0Wm5!LE`OWEfRp)zS`q2o-e6eS#i-JTQ)9Eojyb4P#M_#jbT~s+PXCJOl zB1rMf%TTE_olQ-UN(R95eBQTtF5Z)M{ADfm0^?6KPV?Q>Q8ZUwB*`+9(7AK4X`XaV zMa)5tpW@l-oCeE)YH_q+kj~J>C$8;v(3b??#KDl1m>d$1UUJl&SB$1@xasUm8ug6J zWM*s4BfNFX&Xo~U&^K+}4KT3}iD4nWe#)xAgfY_j_2ELVt!rQD77ueGA7W@)Hg4q_ zym(fc39d$O&c-dN2&t$5hjITuh$=g|_=p1;2ooRZiJyE`(kDAH=NL*Mgr>``u{+}- z#!YoeT}H=BtIY21ITCqydjE~8`Ne5QR62XzpJe*Q!?S;qO<+l60kLcU_3eXUQ#jL_ z94;i-R06xlOG4;SV*05~Nfa-kV$B4v%POq?5U+OwIoY2%KQh3I3ZdKRz^9%4s$|(ANLgr378y zzHo4csn5;FA8A=lE!Mvsn_5xC3wJ0@#M5#unGPSj%htMa2IuWq0n0yR&2?#{UAQ(XeFVSTCQKxXF~)mAX7=_w{B? zGS>}5hqL9ml?&(tz-0dJ+yC9?1`v>Fuq^4fs><4g0j}D?LA6-EuC%0pdkN7QpJ>?H zh{J>it|GeHM`({F1ubcP;}0{&3#niP3Q_V$5b&e5z|%qybkfKK%pYkOgw4i7`+OB{ z(o}=mV3tb|=>SI!;;!qD-+Gy~@qi!HZ_*bc7f>6vbM%)9P`bEEmordQp0=$XTE>>f zOjXtX^I3^8d8z_0ViWkC^s&I4sJ-S%lr(hGN*dw=Ivy6C%w{b&M7hef|#T~95|$&(#kl=|_#vEBzj3#U2}x7(SCJ?7K>dcT04vkC&g z?pV4tKo+u*bJrJj`*5pH&Fb94E1=>-$fJeoQ;x`Wk z18uVfbP=;d4g_itp%^xH?E<+C6#B10^w4;65Etk(vnNQ+lSgP#kZag7={5jKG}F*s z>8AeO-z@nFYSRA&b>*)@iVj*15qWDntK_1x{%`+7l>TykjM4gSqi|hHri|%;!0X{` zCsg7U)6td~67mmjOo37{F-^*c_{&8umTqShY@%{G= z|Dh_Sv#Hmec*s)g_e#l~NvC7mHrA89-+ljsx4zEfn4{+SFy^SMs?Hj;{0=)4hthn@o_v<` zeVfIJSU|+*4F<{L-p;4Kmhb!5?awk?QBi?4Nhb$)LkK;&yr(Pximg|Od$`+=nC~N! z6*cg9-he)&6uWh{nz#VYyNkEC&I=43@osgezklIF@Z^Rle6N!q0)ZPjc7_14Jwi&N z?2X3)UDUrFKYOTed-*eWTiN@1;2zG}S!$zGm`y-t;g^vi3GW*951X$h0iSm%Mx9N5 z!Q}Ed6lif(SKeu94EkVkoVn&5bVPyp}@sL=1+vP7Ed*_E0R{ZJjQEew0ts8Hb*JCEm)h_zs z3z9(cI-7`WZ8HcLS<5LvYbSA$I#}7iB?>2_*1d};E0Zcxxa@F^E-1x_L@+tKx==rn zr)suxvV)VvU<)I$-Nt5 z5jZKk`p^tU^kuncasS&EMvXVn#}~YGvp3+0U)VFlf(D725$VZBB)j-WaK3bQi-!z!zaO3Ve=FifUl{h>5iYy$m4Pto8$Yi;4ylD-3kVvwd`}{XH`^cl z#RhFbH;UM)A9(>!pa$f79N~|X*?_yC*twqT0mQA3&Drp(1<;Ej$owhTN1QAw5hV|l zJ7Z!i-@egZg6#dUm4@?X;Qw(5dU?9~VjqbPMF_u*$ESuK<1-6>pTh>u3;f44aa*1A z{J#F>ptat2QzxhGcz@TmAR^EiFz;=6)<0WI?E~?O;cWP^6JFl&V|%Nb;Y|_r-iw33 z=l?lr=yzoZy3r#2oF(p=o8!DJZU(*Ft|85IpDr`@>4Y19p%<^r-`4^@^;(xOR5_V- z$|tXKzaYoYSInQcN42jdoz!#xpBKdc6?DJ67!>|U-thO@8wC*$oV@3O-d-9*)H7zD zLGP1@u7r}r6rAC`x7{bPIbYz}4`T2B>$9K?SMi*ri-M@!b{}T{BZxuJWoIu-r;q{| zgzr-)2o?%ZR$cpXP0YTgQGBK!a4$WH=x_Txc7GM{1RSM~xa+))U6h3SklMoB{+eXG z^K#W+M4*{_M%QP-UZ~-khskm54pS6a09PUtTL2f7p)@|CtDM3iuV3!&T@53uG*rHT zCr1;0)=WpftJ74ngh#wJzi89usT6bl`4Et4on_W7SZbqD#A@_2(%7oxHn@*9+m{HIE|VC}ZG1?)PGWb7f2+iF-AzRN-laj493sG-AKS?Ei zBv3rJ-;F4FifE}xS(Jv?4S&ZmE&m>_-+o{a0WU2!(sv_4WQ6jB*h7P$?ef+(xD6;| zLyrV*0(q)wq>zxN3KQ;4^R!GQAslfRkm`cxaxK&YX3 z5i=zw8iF+JUl9J_A15k<+f9?JdK5;SKrk9+oY*x6J&PTs<4B%dHB`%Qbx6VIDBJ*j zeSy&6%I$dG}VSB@x{1(>Hg7a&pL^P+HsecT(|DvW&pDaz+wiGFlcey}?$VDviKIspG2VU$q zT=4zNAyhnUe>|~HwZQjz2~w;n|ju$N=f=Y{^%+B@mK28y2K8 z)-1KWCj{HxBoQr(zQkJ7x4oSNT#VvJ(nK-Bdk!(CPR7EaK!kw}0OE%O*1zBQ^8cT* zM`a}J%a7@iqV`3laSs5&3eOu2$#P!?T)hdGT*Se0`@iJ|jM&NdWnFbGXeM2+$NM|v zp9?>a`=M?h#QntA%{$*cF|T)eiI)n+mgmlP zzR-yo_rBkt$h>JBuHN;6*5f@iMn5mV-XQ1wxOdcRIM;mphLcx@J2HbBDbJ3osAS;d ztCo0cR7%2qrY4JNZaz9pxyJBA%EG|L7?NyboN-K>SDl=O=!)3i%Q~Lc#+Gh!LRwa= zI_~%V{oi+;NgctT~k0EcRV3X@9M^Az4q5N%ulv zS(nCNElX`a(tzOT=t%KuJfE2kzE^*%byYJbFD*rZKWCFvc`mIGDkTqHJrmbmv{Bpo z#2We=#)C2;BPXG%Ps2z1K$l&?_%0SfJJ35*Un@!bpEu6{Jd2z*LfhYD<`!7Va!&3) zPe#|u@)t#`{nPW;ft3R>-|GGAYdcuDb>$lkMEw`oRRg*XP)tN{OEA8#HvC57!Cr!I zjFzc{O(iEM%R#0pvv8>?qvGd`tkarjYfxpIEJ%ysA~$qoc65-XcPNOx&F*>+;&gTs z+jnxe@RPTG8em=KW#-Esp20t&)MiE7Xt%zTABUc%N7?LFO-C!^2r<}A8Ar>y7``Bs zhu1dOmS!yufk#k?MUJ$v|FQQzZe%L$t%6>;%4}nW2q){Qmefc(ujnB#At!C(q;6yF zC+GX0Ef*jz?Qbz3CJoxH-BKc)oq)HLvXPNefMznFakP`2s0l|y_#v+0;BO-H z=g)IdYFtaR}AU%&>iOe`-8p|2n zVXI{I9PQHISsQNyF92pE69tQo7)?FM0SW>4~%xP&6tNrKi!6uWW7W^GXIrdZKb9iS(H%>jeCr4p^UMQx4SyYTa`~M zl#eMatGR>}%zO{?!j+~PNgU4!aX&g6EGY?FfUT^16Trqs5s7?+-Zc+5t-;_pP@YjV=`)I?wC3 zyc!S8OTfxg!1c!GI#41ypVZ)_I2mU0Cv>z^Xv^75gOt>C*V14tM^`P zsq}I9>a!NO^(ii6?)T%5*7u$~J$H09)~uJu+BZZKL!YOQfY(-Hx1%txupw>c9Oka; z$`{YuYM>*b3tKLjk*J@k;H1&h)wwKaXFv~a<7@IClPxCx8&UJ}Q~8kGxyP?Iw#0F5!&}G@b@CC|R8<{& z12lP7kRW1q)jZ^k+@E6XD)fJ@&KF%d01r(5O{Q-LCRrUvGk;*n5|13N*#A48AFumK zR+SP-dltTLRb;j=l0{6cvLd8#O4;)%iolKm0Jxnr?Q=5rJUqg#;Eq?3`Q_I>O~oxQ znoT7gVAGzAUH2?x-_+%k2(y)Nkd=;G>8PD^x0l{}-xjryS$~`v$PA|Y zd2Oogqc**qN-{M-xA=Sas&&Vp&N}Pi}mR`2;VwNEnktT#-uF&ZbpYAbiV9A+WJ?+B zihaxToKJU20dndG4G-RktGjg2b_T%Tv8)Qpz1zpVjbUZnfGRD%vc*TzL{!OF!^{ax zQWZPvAvM56`FCrM`5=0w^TBH&TrKSsT>De1XbbJgN`6df-*H#UBgcDE>`c`)3S8JT zX_ZCexI^nxvw#f4nXO!;*|*L+GP!PcUy60T#PsIi`jEY9N>*+lCc~qpc^T5h**gY; zbhVL(qmPqrv!Dt%yAfhdO`br({pg+LL_>i*+?3YI^F+}2tLOaqCJHj57pQfv1(BZ$ z4QeI*d_p=picoacuzy>i}X| zeXy};!Wn^_EuOq%x|rl7y~*fHG*T1<2*ZffRHfDR1bp4=@@S`Szxbms=uPZd-&aB}*u=o+=4EK8P1B)d zadV7-ubde4uAV;s?Vy{HY8fZ*Z7KMEZr-_H_~XrI?u}SZt@{Y; zcBD3U>4b8&*X0ftbQWNLuepJu_&kHi4Ra^_GbTRZW+QzdpPNj)JNi2c=;SKE7|8ee zyb-XBarT?xE&%jK&k!8|dNSY*ax611j^-E%cszS|d&<+9?J1dGBabshB6lPZ z4W-UVyuAHHS#rly9(;C)xeB?t6hinujOb3bjs`rlPe-UFkg;eD6Wsy-D&Z7sC!-$`xV_R5=rAA1@say4=+^l3U-+##QTiCk^2qeE+xj;C_grl!sowfOcM0 z3eB!v#Neo(OWrsrLj^Zp(4xdE03}Yda=INkhE=q)E3Z*WpN$2g82O9r8OBTV(QsMh zv{IuK$(& z2c;tm9O>q)_bTF6jAHqe)}HoqX1h^d?8BCtPb4icsUH%isjnqLu>5)46~21TBi1a$ z%<%{N43YUAK?aJvk;T#QX47n~<5a;4uV6Jth&!}IuyXb~NCa~bO3F;3dA|^wtM^$7tL);|ld6b?GQS2_O;3Mi zyM%kUDqCqh3^ex!K8gf7{?=cge}>89(UCZ?40-v~^SsCs&+{t$-c7k)={5HgXsJj@ zWZLHaYB)>PQ557Ao6W-Y^?pLItr2a)dn_LxPo3sY+$Xo|@bRg(cPhI>4@3SdHF%A|nf29-XxzH{3v0b; z*uoeP)klC_BOX*U;Q(B=$4(wciqO4?8?Jo*7P~N@^sT;^by*uOa(Ad?Au?Saxh(cA zJ!u$51s1t1WGyruEvBu@t?(y2mE!aXFbr0lb1RqGrXNs`nj z{{uM!1NkU5q+PhcicPc!6|+@~A;D|JgpwA|Bv2j?f&{>m?}Umv3>RJshzbS6Mudc& zkAe2xRtsPLz1`$Q>}O&XT(6Yi1q=;*OID)5$M7a^6z^;Pc4NCynl;Se+ z!EJxSU{c5@hk8~k2F>GS<%s=qKY$JEGs0iKGB^!R{zbn!IvI?rR>IE2bp)V^=J$b` zE{ATolB&2va5^C&27LneyL%we1CxwNg#0N^r2DSX!cDdz7r{n$T!vY)ag}QZXv3@ISz;F_w9&o&#&FG2Y|)XX z?$^^;+sROQ5VUuLT@HauRB4t;jRKa6KOkM3VOweY^iZ*e5Fie@AcnRPka906HHp3$ zSydiwEwCd&*k=Y>LkA0YE38alU=K(SyG)z_{3I~(kb2$dq~A4%(<>RDZ8@%^=tlZA zJ#9IFUAj(cm~`E;6t_0VUGzF|i(qA{Vz|*Fr?^1yw%X)=10I~OyvzXnWS9ph60oIu zu7gN71X0@Ow|qcHbK5K?9Qcc~dijbvId)QUL9vl9Fe}0WhPAK0hN|xXL4XtsNDkX5 z!c=g%J{>rTDc-4z_XN)gL;~PILV?|N;Ni_068@hYTOzU^O}X9WR;}<_`fmOG0~pk< zVJZmyb94Li>=G#tAz2h<_uY~S6ng5!KUX$=x^#ziX81XE>a*_QDHH-fB2RS0-JieI zu_S$S{m%P8wIdzBQP^K@m%R;U+aif%ZnR1~4?VNAS_40($exS-)olY7$d9|<8Fk~vhFW%WtkH@ODA0C~)VOaxE{3C;Zg z(bK5Y9sKs}0zVX=XZ#&TpTy+eF8b&L-=);^0@xSpB7Y0@sp-5HIv6jH50nRCk#6{_ zmU@pAg(}&H_a4Kj2L9VAVl-4ENVs1}5#=)tzt9i;N#b#LfL|YYx>mByIXYeX|B$}L#Gbr`*tSUEK>B#Q%du0*R{9B zH2>Q#v3pkd{h*4sN7$u~A(EV{bHl;>$LemKtELbsi~P1v@`Lw;g;eBqyus_@S8Vl~ z6TuO=MyRlKU^|ZtF`D2}HW+Gz6p6ucx33jN@k(s2qt!WlSl14N$~AfbdTGs*R`=$~ zCWTMJaJv+H>ete~O9HSVzO*hggZA?BFzA{SToEOAYebr+9h!M*l0t9W$&QfI?2+=w z;>PQ(d0q;-c*3=QBg07<>4E+H=TKna16bKu`P<7Bi8K+q0^|0rMm8GziIXFGcp@;4 z%psu9?4ZUm%i2L5)!tp-caO=Ug9ynSsZhL{bLdKFlF!(oyPLL;1!ADn2lXe~#94>g zs6O33A8GWWUq1$V5NSBS^+XCs>{tsHP4-#2m4l*e5blPxbA*$oM8?`x_r}sfjxPJp zLK*@%KUAP`g0ToOO^xC1t2Yg_yz^{IzjA_|v^f5LXeZO@M0Kpvy#pQESi$0ezUjWn zVGSbe`co?#60|7+L~?ag6+Hhve*z!(SR>2&fnAh|6~bpDO_lT#!e3+7#DPNIFEfyMY${DYDA}|tA4thp?|AOqSFUwKMRs(=;#9k zs1JYtk2`c0{!bBSBVU-8h$1?lHg_op`u?3ZUwd)U4yM)4>QQ}=n|WXmT>q&14mR6_ zeo^?XPa4b%U#A8O`E&q z*H`Za`d9C&stb;pwyHjLghV5JNmc+)`{k)p4SM@F9@u^kKD0~PWdGPD;+s+JXj;z( z%u6vLk9dYMA^=u&M{C69?p86xH7k0^-8Ou(aZz=N1t|iMf39Tkl)Rq(QLvIOzdcJC zn-3L^iV2h_dUQ$ofgU40(0tTsa9%=)mtKaOj>e?C6h_E{I<>3tvy<(L4rcj7l~fs1 z06vBW1*PFnn~vL@TB45H8fh}oqoZ{`W&#!qvRR)!>KLinrU|JJwgL&7T9W|KAymzX z`I$SWR=i`Iik6Rx#OycMybLbW{m(LE0f)OeF00HShW4+DWX>9V#TtH@8jF#QkD$w+ zoe(I{I}RKoUj3^He85p~1@5Yp&cTah|M87naRPOmHt~AH?f7LrQ{W#4=6?JzSU1HgJ(B-RG1$FrqHHpwd}^DBO?8q=20Z@(o<+3y zKiuIM2ApW#R@cm6Y%u#ju{=%Z;c|>J_xK+XgHDKtqrZ`|-WW@o_P+Fku<$*rTy~$+ zWNLarSlFv|6wn1MD`imas6@mjoQ?12 z6=;wtFaCF)&qrEs+udQUdQvQqIK0P~{CXrBq%PF+xQFBaHt#B22sqqz`poOS8*EH& z-r8t;8cf@?k9%uYbYpXq2#%~24LUUZ9PQok*(( zFmFds)KU_On8uAtpY8H|u^ipbUu1}YE>c5xQo9VnQ^H)wnP{iEiPFgK*O9nCr*_S^ zZRUr7*C>?Bbu;Fhp~{uO{O!R5<&c*`dmCXkil~wL=&NDrUgxv5k+~ zIG^G7n==*Z>Kp|dU@zhIWa8pE=BryO!6a+d{}er1{TZ*{|ccTLlAefl*Lnh==WoG3{7s$&%A*6nKa@V+73 z!@#$4te^Ja;YP&lmYX$)5^~$xNskMgsVbaGh!d5q*g8!N^Ae`>Ljg|tzyXw5_cbzU z5mt)&{7u;l+S#};n_as!@2ZuaN6sh`Bk0%Z;+I|Lcfli@ihFJ({R>;s!Ftv(5Tr;0u zK-(&tPl+-Dny5CunzjP}NsLnm(!TlQM*J$}Q-;!7p829&Ch~kL-fa%2XK~@HjdcA& zDL7J|=0}`-ubax1upGYUFO!j2de|hRUX~S=&T~62ZH1Qrw^pVPaIqCKnXic$1Cqf9 zGv=f*F@?TDtAdFQ=jO{fotPD~m4p*f(SNTzkbdX6AHm>CR^cB_jNOM1DG85%7HXa0 zQO>0T{Xw7OGFOMtISJXEi|O4$8uE?*grA3651?3CycglTQx(p#d^%+37n3#$>?LQH zRa`AXzhNDEFflw}5=Rfgr}%Mi`8%;J`R6xM6=NZ(mjKN0m6pB{k}ECw>^19_6}Fw1 zc8#G7vq3jimDC&LoHiNjyno{N3a=3u3S(g*pQlJ|gzQ^M7%cPU5Mfvd3=~5{}nLRC!jBT3FzCMnl_P~TP$1MG)XddphFrV=+BjjcT;vuZf`LNB@ z$faBWZBTAUvU{CDyQ`zpqsM=*XgX1+e&(K~F}Uh(A~POV|RN!*F)9T=gn5n-L0H`=ok{YHre}Q ztrSkG!SjkESJu4$-D_4W5zPB(yI}*vgM-!H*AWS=(VF;&{ev0w*v-A=dnY1aD)H<& z`fLBCSE0@>z^|Wp>p7vA29WuAq$s4v6wk-f7~~jG%lRSC7(+R2fw~<8`G6?wC)v8l z*H!c}6Y!xtm(!ZxM7`zb-yBo7((-V~p3T0%H+`P1jYJ7iir+oP?^6cfWISvlGPL&c`C~ zpsYY+ZOKo3Aa&>twb{kW$KghkM9M>Wd^Kr+Zmo{N_a|;C!9 z5V0Q%p8ySyDgooS%_oG0%=if8Hf}pTyC(!`E}Diho7SPFm=`I_K@vQuWp19+`ICG2 z*|;vy=JRoa1lgpGAzStgq4l@LWY|#*^?}Bf@Xwq28{VuGnV)dkg7aJO(Ge>m<_abb z9{{)aP>X<5C=dGMBU%F&zHZ<+Q zz|JEtlWFfgSerU$sS6z+m1EJc*Rr?^1JC2l)+`vD)nbK+Ni~<5z-nw=OZZ7gI9-?H zS21PU)4r6GV%3|)5;XKtzQwO*a>|^u&W|vi5t#)oB{K^zG0f?Pi-VQ=c6pM%-4ZI^ z@y)mE!Nh`o#1rSUqQA;FX#e@;2aX{DkZ#q``YoXiTHD|$nIjj{mq)Tl#aIFwNN`1K)GFx;vR zsxT+J`oBgTPv&Lm6C3K8K{C}scDjP+ffsLRYuyW4k_T#4ORHasU}qAO9o(A_iU0xv zjtT|7e+Nos4b8~)E1L-ztQti8yu3oKUg&%HeFi2aIcHa|!zj+Av#U${ou&_hdkaB{ z&CPjeMuXN{9lmueNa_sd*5{wZ-P~MkZd6M!(BE6Ihj)=JbrvB0l2G^2`4~BIm2B#x zWeiTdA(~#v#l|zi4~;v3|GUZ^J0P^ZExLgj|AWNwGjaT7rvY$AiI1L(bDkBN@ke%7 zpu5u6$_=7)Z=^9po)UhwB7smbr;Q0ngM3@XFHZcd$n7Ni>L+fB&sJn%F@i@Gw$tAp zK^~t;-`Ll+<0Y@U_(JU(f6rC5c*&9>H^1mn@WOW8?}I@e0+GSiX^)J>L_Bsd9lcu} z^d7QuxEWb7p23SBCIRz&Zh*R30FPu^Jt03;PWW=B&jk`A0WAfe(f9o$2AvmWE^D61 z9yxB^uMyMTPoIy$d0&n8zV8hy0B0*MxgDQ1g*+k4>W}h#K1YRpXX3_kLH$pY9l%ZB zgVD4mh6Zms^6kTT!*@bytAj!3oz4q3D&9}wc zY6Ty!uBSWUmz0~`>-M~l$Ai2NDIbozfgGqLlA_CZ9mn?jfIZ2H{`bSMqbo|anuq<* z%UGZ=k^@6*x8E8yNs)bl(Bf5lUYC^`A?P_m_$Twl20?jO+S22ptgz381&j3V9RK_E za3}J}{k)<-YWBu@_I(G;5!AC&rG-|$|H<%DldgSH=jxIF?Z1+5pbf-X;UDE%c5ygX zV?*4A9y*a*8{>Er-ORso-?yomK|7Yrs1qA`U$gg~gnd%fu0FSYwrul+W1p|7)6%9o zjSp&juF32Req+;BHW1H1XIrS4L>226g;7%So9Mfl*_nG#DBvfv-ML2LN#K(Y4~OBG z<^LQLQIN2t6h2DPDOItPF`U~qh|21G&x%5HVP}bEEVbD-sk)llmqSMGbeof`t{NU^^}C2q zE%r<>?CaN}ALdg@UT8!h##JcIS3yV~Ty-5VMu@PHJmHmmQQs(R{=Drtyl$E}2KOU9fVKkw9_rh4Z#1A4%opyrirYc^)QW zU(c|aeH`|pg40KC2 ze7Gx%>SokOW{3H!$-je>ZcB~JZHs(`%j(L3m*r#|TaIjttsm%>QMu#s`HJqr{`^aE#=I#P^Wl|R{AHk)AUo5q*L>k^3YI4v;t&w{a5|d zvQk-@s>>X0=>SZZlc8JPR9KrkeNyu;cFLni&}gSu_|jIh4Y$$W zWytfUyJfm646ogSv5c&I4HUF}cJ5TvrH5D=@@kYiIcdfP*8CXulws`=bPUv#ywvn* zKGXP;rPO7m<|$f>YwTs&V5WS=DjwPiXe@RE5{`3f+$+ z@r4=refeRBF8q_l7W)<{f6)PCx>xA9fD$l;zNB_RZD$)fNsob^ems0ERlr#UKLIUm z#!EaOj(6pREaFmF>0da&ehH>MZM-Xm`R6ZL6GfX zYU|U~n71%qV2WU7>1&89U?tAov*>}C?dtv!)7H2V=gQbWx!6FIC* z5eb$_ETV_{SG}R%oWxDy4bR3>HZJ<~5SenJT&rPWOkJb}ZjQF?CUK`s4K(M8Epr>$ zk)=hzmJpDkkln5ZHlmgEN+Dq-bqD+|wP*+$P7Tg>6b9@O9Tu>VkhkaEdzBXMZ)8}3 zcGqW>(3k4LMn((c_u;`l^CR6I_yoD->yEJdG1e{_ge_o-f7dq^N0Bo2Z4zADCJww8 zC@`bwseq`hi1P&~E+ap1BMYY-?do zV@oHxpyZxsS4>=$#AS5?+>m214{rcXu{1_n_UuD$f+MDLFIQ6Z7PQ%N3dYlnqIQUF zh7v~|BxVMpRJj6I697m#vZ1E8d3o5c4S3hb-t#m;1@6bMl~Ir8Hu#Y3BzbV>D*kOA zrBaN73F>oNr#+E@gD4#yV*9%n+}Zf;^YU>jBRF~~r-NT%Ow4gf#LkW?n=}CxYFj6) zN=%p#-G<=NQ$Y?{v8G*^Nl}qhkoSu(S#iWgt0}8^zIR%?{qCNE$o7@mz^v@8VkT!w zDwO6~Pfjh9?!+G%#roD4bjh_h0}E!{muwrcuFRtrGRd`G<&_peL`c()eQvXJNp<8f zPW-*^fM5b5RJg!Kj2sb3GA8L zM_O1~i`KEjZhk+yn&VtJ_OUEC-o�xf~v(TCn`;sm;E^Bbwdm!9E5QXynV=U7f#| zsNu>X6upNv69Rpu_R2Ej4g5QXx+~8c)74Cx$GiL(?(6~}(ybY0nEa@GeoB+8y4HSz zr25nxjQy@?5p7t~<2<+@aKy;DJ3q)!-TaI{T`e)VS#@%9J`lgT%H{FUw!3c-9i@>A zZgLdGn~ywrlA_EmZ2zx6x+?Z{l=!`)tkdsIgdvgMYyvS%FE}AJr`mqR!e@^fRMK~i zcoV5IyRq-{{D?2O0<7eV@PBsPGKOmuvlZYMqM)%*bYkE`Bm1e{&iU-2<{<9ZEmJga z&9rZ`cd|ni!wU59kWON;F|%ajG?~jDZ}%zmd#T5i$3=q495_nj7G*DXsSp|4pqw}S z@$X52^{-pOuZx@sEECf3!udv3Oi`9#9eq6#S{>44g4{`pUG@_2tu-w!j3yn*t<7Z% zxP{%*R9gXSvZ>664^<`13N4xifN@=x-g3Ju&Bzo?%1n880vQkZC><68AdF#Vb}${x z?NK>1Z~ez}DQ2zxrFh2?tgcwej&FCZhY2E^lQ*51^7*@7uvM{-rOV%9%`|P zU5&AWEZBj&5O)kIItr7qi^GZCu-!sN{_}k!#8$2OE}^!-8T`SIO+WqWFmbdJnfexB z6v@wfv)VEW=)GJzR(y9d^CZ3x z2{cd8mj8u4yA&J>SJQfmn76ZWWM@`>%GJyR5q{$OE2|YGYNU~^WJQD*LvsUw;C35eJ zuxC$A`+WzR-&aIXWvN9L5_Fhijml>+I4)?zbBNLOEXI;b5@g+hr-8IlS`1i`DJjmM zI9b&;F+ut+?IzZKnv6nfxNZ2bh&N@!*Bjr46s>f~TZay5(l38*CGL{MSRS4^#s|OAmRyu|H-?oua`gY4kIhdi&SI86I07QReqO!>0De!h z=9i8f8@=-76t@g7o;T)tfTwCNP z8c8vMV^cy`y>3rs1p*|pyRtsN0_;x zUcb_tpC*AeG9YpAP|n?fiKji9>03i7O`9$_yzG<*Otam?O;tB2pQgG~`OdU_s$rI^ zU*Gk$lQ6F0DsZ+~jN_sZq>yN7T;gw)EHy5Ao%|$;IgeL1R8<&GBM9gKWxj@`oJx-d zgCOPUipauY?+;2J&}W1nZ$E08;tvH)hu;gt(jxOn-pX=fUR+`29~KIK z13b?zy%mYl5$8+nQd_rtl?*jEgj_LmP&ZPEtU9}VQS}S{Sy4_hA~d#G+^(0aw;oC8 zFt4D5xUynSA_e_j2`uJoma$J_aMaVf8dcY3DRQb&7OTUVKm@?s-ye!Bt|Q6=ty;O6 z=eklKV6QeUnHjywkK|XjlrdyDAU#e5Tira0%o1;#;_|zyjV5R=U!XPjNc;~sR zBvK9n6uv`Av>uGs&`yVaWEB*YEZ%_QWZ9GS{n~I@piUFWOHX4-{6v9I{%6t%L%~r7 z^J*y}#q+1}pQNTHtDX!lUGz~C6cKpBcCSdXh`sm8IB=Xz4U*3n9wsk{s|ok3sIq{W~(;w;to z%LWgD%RdxSET1TYTKI{}9Zp;HL6Y&*(1p7}A7LX<-6fLR_(wk`?$O$J8-+IUdvVZIRdEYq#6vBD2dhNf;%`#Zg+Ynq|+d%aE=xu769?&O&rj!kLV|D|ikfYH(rq#vH0^nn*3yh)P1`(P|41?XXus|wQrRNvR!m>#ob-1((sjhv~HenyO!6uX(L(l8S75irWP7Q(uk)TA|#G?YIBsAW@; zF41mN>=T_l6@_)v&e4rHn*ANhxMz>eK0*d`7m}CwT}75cAc!9i!g;m1SQyG!DW@zf zr)UzfkL?#jz;rPXy;HI_#D@RGpk`E0QZQ*Z!XM85ONcPQiE4aHtnavRpzY@)M85RL zH-8-)eRC=#t+gRx-bdbNZ#UZw>Ls2$mZ4Vc9!%PRK^i}$iMYk?@ zSOM$BlnM~=^GsZ7pRw}5Hva{xj_8Q?%WKnn>SPuP?A|^7jg3csd_0u?e*MNU=|{iq z;6&uj=Um8!kMzoa<$q5D?shisP=E$C8Fy$iBwTuaSY0Q3?)I{tKZn;K=3xC-=41FJ zV&{bgKBPV_#ry*u;U;=RJ%hE@TA8LBP&3Ihk4~fTeY3rGK5#MC(zmY&)|C)(pR(OHwO9uO9%v+9lyyO6A_c-dUbbA=lE*28o(>Mdnx|MZp9sObH~f0>RY%>)3Aqd@t7NjOF`PV z3oEV;7x&!*$ecz-_H(0hK!|ZRaSYdaN zyc{r_5jzn3*xY+=3B=2znSWaV1c{@o-{gxH{MIsKbL|>mt<;Pv6>g~|5n0H*0KZP^ zbespn`t#q8L$dyj+EROY3c+)n*!KUYoOq~lAsGYRqznhhXZhGv*nNBnk zBTlPzY9RD=ToRo-Abk54#_sFWLQN}FWA7GOI`(_N__Kp9la!v$7PR*Q6bW?S{rIDQ z*(p9c32Au*J7~L`8En^?A{P_KrvfPRv60D&P+F8;=mHx!pN{WLlge5gc;BTPvA7@t zghc+t6~%$oP1Q`p;@ex#m1twPA7JzfLb2CK6I1f^a_%1)mo%J(lQ+h&g$OP_rHeu_ z58ue}k0IM1wUsn)z6^^_`WU`_Wx^LnVshbrfg`vgB%-OlB86{gEikdMLv36pN=XTa zUiVN64-O7SOg?MK*WqaJU*+rxteBl`HuLl9pZ`lUJ(tpKPvRIl{CMrp5M=y@IQVU2 zk3!nxZ;E^@GAWew?%2?2q?zT21beq%2!8S&c2&vm;(^JxTqB1Bi}ao#>l`b~8xaSo zy2u`;d72cwvHBIlYO6Phk~cj1w~jaNHi)c=TUVirAO5_q^+=O$VH9tRuQyQJ&F%An_n%hp6UKhKSkh!;>wLi?CZ zuZs-MpC+yUX!-X`{x@+*Y6>=%T^^lC;GJprX;st%pqrhWrLm!dnv(&kh3i574+R1) zkE#>*fO3wT(M~zg4S7*|hO;!IdExG&J?Z;2RO>zwvCS0;ZDngkrKwpiY0NM*^r*|m z<+_NbA}9+NaXnkxDDE08KyV1|?(XjH!9BP;1Sf>x?gV#t3+_I6 za2VX}8}d8ny!U=p_f}nb??2z|sy#C`v#0m!?zNu1x_j+sS=E-8SeiGZhH+DbJ|JMM ztxhYZf6*n4!5xrTEz{80W0M%K0eG|vXs>bD7RC>ctEL)F%jw#T%9{H6f(U7Ys2FL| z2!Wj6IM}(^*Ov!3TZ3v_d$@tqWK`a7OSKQ%V!!&}#Wc0FsM_$D$7Ld!Gre2vsw7s z^>{Q(D8&``klGoL^M_g(Q{{oZl@RX3j7qAapdZ36f{2l&g8AcSZ;v_$jd9`xJVUoJ zS|wqbAZ-YjIB0_EXgXUA;zh_)0jAIL@%f{?hw||~K|EtMXEnD~`dp3q*PSn}a48O{ zGj6gfLHmnOz=@9SaQR+GF6_sS=}*Gxh{j!*-kk?Iu%9$oh>8;- z>CE|Nrs3~7^Wm+P z?b{Y*isdye0FI4UTPxfL$@-bVQmozr1N}7Cyp$Lg%#@g&^X> zA>Ck%DDv1W8JA)38caWA`Vf;{W^lKpn9EjL!L>l3gR^s-2=ZxW$2W!B<8{B(^HC7_F#Ld)YaBCE7%f}4;PjSwT(EvB_RFbX~?8h z@8-zCU{JpHS76Hn{RG@MiR;VpZ@H28^UKP}A{p5yKQP&+<{6ZoXkv}NNF0psI+Iz? z5h66=xJ@u2;R8<-tfwb3*rpE&h0(l^ZK}F169|PVWHK+dZH-LOqsNv$cGZ7gP?*1E zeBE1gFiAACF3~mXFQj~$on>A19wMF$H~HCyIZ61h_~Aw-DT74_B*IL(CuPTLiVEwD z?|^HBCT%4XklxTmpXW}DtH826`)AZX1h@Q~#a7_M{_J<-7HH*9fLaZDL>Vft}8 z-M0QAGaMcFklTECyJ#@W>yCZm*F4!bRy_pWq+uFS&DpEid7H6f|2Sn_*O&d-$iNoty9% zwr)6km{`STe~wXM6vu2;4mtuwD&e6Yp%*Qng8Fz%FJH&Q@eb`T&O3PzkAv1kUS1*3 z#`>jlmqGLUb?XcB**Tf3AeT;NVNWJEYsbW)`_pTjjNc6o9XmJ|n~ek3W+%5Py?%G% z$vY7=6jsYXMhaW8m-4Yi!C-L($~bl7<%%73Cz_EXgAK30Ast(aQ))H9Iz z0=+e*=JWCa|1#Kxm;d+!MugLT;?KF8)6|`WE4#g`39MZur;n%A!@FOJ1kZZ%%E0D%*YjSZ!*fZ|59L#h)Tt4g?1qZ9%J|UtdjU(M=dSdzy*VYK2 zQe4I0+}9~VgAn#g$59_TrICq*8o8QQpo*D~IL!6Hnljc+fgx;^3>gR3#=7_}7;Fh& zb^VOMuxcHjYi^lL6v$raNI<%IMi5R02j>`~$aLK8|8`l{Z11k^`9L-8U%)dmSSw)c z8RFwATSSe|A9%i3+-Brm81HbK`LSYd;5JK)tKKH1B$B;^qWQ9MaFv&-#&rhIqXQ|4p z9lUzv{Ca48Avm#-p503=HjAV5o+*71xd#IpXW!SqfAFkgj60Tt^nt*u-4x;=E(Giw zLvfW9cd>tE2Ql!g?Glgb{2-JUyp9Yb`6|3#%#uL6=5j3O&_yc9ju-P)81 zp@3l4<9rN-@riniqPiX2yZwr(7#W>;|@H7s$h6KupC!>MUQH1IVA zBO@76;cAKIQ=u9#D#vs>oNfJ zy)$Ir&8bEf(yG45U;TKjfp~7>JiirP<-xN<&i$iFeogn7g&D zXV$Noy#Fx_XlajWkdlP6z&#)|H9ug6DXhSW;}{9Fx8YvW!GK?IOwiL?7QXpfI!MQ@ zb%>W10-Vo0aD^CX!WkOGc6UO`CIGIit@m1)=j6jjI>cw6M6vDjBF@@K79r-2e6wSq zPk?G=KucwqNMH44s*@<#22yT)oLQNfSpkrLkHms;@pg(Ozqo{-Nto?hl09eQYM6%zlH?nvCy+$oydI=F}3 zahRqbG|24Y`i9hZ@$i!XVVZ-Z=?LA#&MT*r7^11hmtedN{}{6m$*s|rKz7{P*m(#n z!|L?Q#V-^Zws4h3s4dn?B!(DyZ4gOj{H@sv|{4g_$gEd;8=M z+>(+w;@pz04vNz7Hp|)am$rNHGW4MG_DyM=u+u9 zwUf*qDHh;ms!g%?>+grJpZfS$v{XdpmE_-8@%Kc#H2uC=dRWJsgFhyA=FtR*dwl+z z(+lsNOl#5~F?@Z*Pv8Q*$$P-I@bj z(Dt}E1?J7%C{h*4``z#yVyq8TuH^m_{en18p@f;T6gO)|DTS2h>f&Jgy736xd>|$T z2ywDK!NT5C7;gD{>s=K6Lx7ECbRc(k2jVD3f#PH6#x$u}G9|!~$aivZn5;{eBwkuu zgHHD--w~n0yp%tHH$vD%>vX*D&7ZbhSXgMxvckr}$&Jo7_V#|F;e`Lo5mg3O zrbd%i#ONsi4tM@T6{1yn3ZE&{f@pG=LJQLNQp^an$Xp5%ZU|aBA&1KTsTtfkGdnw& zsm}^f4$8+MD-twATpqxOdqOSD>g-zRqVZ^p-^`e&pzZBOSIFDe?WbHg8Pv zmX~aZS;I4S%&8EejB*XyYjH)RkApjppQ?{XZ~X=sHp|?7m)EP7pnYyCDZP8NiFpWRUJv+VT zb*1xJoNO)MhrhrC8=ITMKxvVF_o#*12^pW zSLe{iel4r=#u)r!NY#xH8icbcNMsO@P2d6ksslQ#1sJLnt1I5Ll!zNZ1IDyeXQC5 zZ8X<_R&a1aNpY67KN$exM1wk^pdJSYJ8TeLYW@^*iUV={g`@_AY@)eAx%_Q&L-;A< zM{cV11KTsacb`2ns-jgmc%|b(87@{|Jr*stP(X3E<*>Wg9{e!RamhvHDCyp_p2H$& zg$sYyLptn-C<9^Qv$M0)(hyuvZ%N=l{ntg<4kpNZ4)NRoI_5#CxH&mEy7z%=ZN|pN zoA-ZsAfd=Ge2IFMRSQWjgAIU%sL2y2mcX^oThR0do$#BEOuy35d#rUoXOwLT8{30( z*ob|A9H{*=e{F0(o99uf5tWL+H`(+Q$siPf9DC%kF<}PHrb5&f(Jw zJsgubC;7&a9=7yiD+ASj&&a(lKjX#nOqK;U7a=TLg}eEEiuhPrn3ntDQBDE{3upb9i26Y6pm@%C!36x_ zwVRvHMz4^@W|c;4iu-7LLr~gkQ=0~N>sb+u@f&s%egS<|Dn7kB9r`lW9}cg3`#c#u zKdrw<{Rq1SPY-nhg;efllb^bIJ35{(Eoq5~iOI@FX_UF1xgs)UZ~={gwO0_&IDt5u z7O(~ZUD%)_Z4!}5%gWjs0g2+L4CUv~)ryRb#h?YKDw{jGK$HHG(iC@G7ehwYBhHv2Gk zsEyJBWPH&%gO9wfa1=}WeM)LoT>RgU(J*z_{w%zfSCt3;a&>q6%`UO~06bBeZH?wy zHCRIbWG&xpWM}SW7Ebd0_LgA^dka`Qc*4#2TH6f$kuBl}bpnkde3p%zCQ&S|vie!0 zM$1gt((iRUidc;Luas0IyxpVeW)+>o>Mv%@t5>4tl(gK-ab0KQc|jP_9Zx{{9-zqh zfy!~DNmEmFHE)aNn$5V%yFb-nr7*;Vj%UtBPIh~P`f$jHdavEjv3KcqgPYa(kpcfx?I;-nk# ze6bhtT=U8k97f1R*w=XQ3isv(Q6y(&-V~Y(=@K&HH9e~E@<8uuab#6<^BumnptRG* z^!@ygn;4A}bNv*)ay-E0%6IV6Aoal?uKWtBFXeE*k(1aVh2l-O7e{`w@oHqDnfs+H zIG|0mxa!PkCBM^do6nwH&0U@x`!wweNdb@*dg%};XKMi@!T^o3=Muye0*J`5RG~WO z)ID;Q?U5E$+-i-FTnf2eEowj9N<4@&F6=p1m0dq7#qwZ?3cnuSdMX?F;MzaB*2(FfvhL&; z48RO4v+)bC`}=u)<`xV|z1wQ}nD{2;2*FM4q*gRDtR_+M{OR+^4hE|QWwB0bN{-!w zvM~x`gk{0k4sEyGVzisN-lR~LQME9#QXR+7?)yZfbaZs>PCGDT!5!`Gbl8XmaNXLF zSNdRs#`dsavnB=sZ$2L2er}u4_cowbmVpj@aCu8(WAK8gAEk%Am_1aZ!Mbh%5-vjqxw0iGL&fHOEH;6m4>BR11MDiP@%es< z9ktZQBP3;l+EWKw_JDV7hB4_uQE_@g!G^VUSwtvYyK!RfQuGh(C-IG3wb?Z}pG|FU z!*V;m^cL}c_^AR@O8RkKDdBr^dL3yz|1z|vV+84^Z;p`RL(Co!#NR|1_HT{8`03r} z%8l*@&Ef$&Dgav>P$}@uhKM)iwG9pIpdu(JxDWBko`aK9a8|7n^IwZCFq_eV7-9SH z?`|ZQDBqLEy}Pg=boPuU4%1p7cTI2TOsEBHz=sH9qSRQ4=fj{55d0Gld=;uu^DJ-z>zhHh8JI1vtRSAiRmWqmt&9iO11YG~Am%|S(DlWbo zBhs?_Vmyi@tWD+xMV@~dQ0?1s-SPB;Q& zkm~nN<0I;fO^7ytNBsS^qtuA z!KSXg{rSsbj2;6l|LqBw9z^--VZw)7x$HQ#bbg-jtA-|`KLrD)GNGUcsG_2O$y}H( zkHU5?2cETSYsG6$b)aR=TVqckOelokxk8y8j$AQP(Oe@-VKFwQSt3TNZV3n@iGO)m z+nIPd$pVoGOZabNWD*i=MzKmsXv8XtnL7nljf(_Q86^UdKHE~%$_bd{7$QC9G< z6#`;Myg4YO*=N%_dV>3IsuKZd*{eKT=2B`O>}$ed9;eB}l(Dk|Ft^lxhP7u@P4Z<_ z&9Z1HPJ2{xzqj!3RN|`e69GXWuoe3L`T1GZAyOhjYQx<{w?bqr>wX&f<+VF74Cx#p zG5drp#YD{rCAO0B{0;{xDUv-*a9#1}H@xa0+lS0y!Q2H8md>g|j7XlxUo*RHeYC~D z1~O;=gvddNDrMY09pr|7PB>c+a2DjNxZ0{F68adM1X=s%hCPhHMak z$Xiz)r(Z0~w(9L&c)9uh*tTm8AfDF+y{AI_OJ(dsO%=&NPj6=rN{&$pJUjE>>m?J{ z6$(SIi!h-xhk{lnlZqs#uEPc8+LcEqm&Zp2@YX()MZqoNCo6?qagu$EOleN0Qb`<+ z?q+79_*r@bw6qFi7XEW?!!nII!NkTzwYVA~oGlIELzR)E=kB@|C|_xax$U&Sm7umT zj?mJ?s=}7c4^&Fv#fAXIAv0Hs%A>^%Lp^}QEk)>Usf+V%z`X}Dd;HZmnk>4;b6bB= zp`(5iX7LYMrw)h)a&JlR)5mZeBM?DyF=Qb19;ZQmf8W*V4k(xrm9ZN{M{9`m+ivte z&4!-;fPrOES)kJmEWJ|FtGU>%SyDnD^|_gdcAG;9N?Ziil0Kbtg@IHq;+-{T~{s`|(}tM+?6za;xN`V~-*%8ZXyb(@uW4*XQLd!Tp4qF|?w zs9`P`PfPy!JtaeMRrQlPU_B$fo3QV zwyjslq=w?e7)+Qor=0LvN{JXFTL%ZXyPzZbxVA6L-ht2sUwwtYx%1J$wY_l|V=83h z$(jVG)xCi7L`WzJ*~oxFA;OJqTJ-R3{N0!ON0SGZD!v#U8r?sg1%eIXAe-^G_teVC z`FSf^WeBr1QB(3Fie}Pz?-<}Q=;|aN)}`%_nA*>NtM}GV!nqXcoT;ImhmrU)7qS5Z z?zj1~7m;bQDfmB}*FMYuG9Dp?e+PMM%d_bJ;HL)~B}{&Peyj+wZ2zR> zf{$hM*2bN$eI1{F;0~cNREIwGZsLgO8g>0_TbA=#ts39<9Q;pBS&Y!a@%i~=i=&)V zF)=ZUR!lPek6ml4^UG_T7In)~5Rk3|N(yGw5I=y?CfMP!x%B2gmV-u$P;aXIFsD@X z>&e)I%+ohL=Hyth!)l1lF(hV)Iv))*C7-TWdTx8rEt!MRsZ31hGRVn3qD;4fm`(bw z8vaXll50CV8Inf}8M>X^-1e5i9ka>W?dGhI;BI<|*4c^oR<}H94yP-Xus&q8PbIqK ziLACgCbh}_NonXJjWNqKD8<6Du&JXg@EGKz1_en&%k*r zkc4%DeDWCx)V_{?d-bU(ui-p5KDf}TnI4pYg1P4WBLm0LQZQ?7{OpVmiVLc9;$Ui- zs1(H85IERSBaBYAhJ&T-zRRm%lh*n4-Sa11zVCe7AD>ImK7Rl2xx5$-ai|B|2-mCv zPmg~RM*m~YDhvz^v2k(2!DcMWM@L7+0+Qc8SZy`^q8YK#H75<;$wZ;)@Ea>%nxy)5 z;fZD`knWI<{iQ#&X>qrzQcfniexSGAZ?vtP%YREtKa*fXMU#WJf19ii(Uiy%o)WIQ zN%K=^KGcpBl?_tIS^mbUAnSGnwf2Dec$EIn-Q59MN}T^$AQ~aB{k=VGZ0u{V$vdy? zfE@s(pELxlTy;e5COl!Kd`LGl5+xI6s9{~|6A!Vpay8B;xcjY5d6etBqM^YVwx**< zV!mvhpdCH?5bs4;;nqCyO{F^n!mO$RP;B`>^w*s*DffQXz^CM36FR`%gXh0;cKtW+ zvHss_!2Xs>@kXCZ`?m(G6=9xMsJd3lPlyH4Fw^aJX70(L> zeM8dIMa%iKM(|crX=R?b&tT-{1zW0{j0H{xjl5Z3x|>1jdq^(Wi5Qb!d!1#kv7mnH ziCtZb=?)46Rhr+7Dy!S=-b)*1STo;r@QdjbSmY=TC`E+AAu9Hy{zY3Ss;DkOt~-&I z6cT{kE~d?WV;BwXBk4}<{-X>MOhnMfUaH`N{m)*xC%}TAy{cuQSz4F@G|mrfsc@g% z)4%oYT1i9%HCL;);9YjPJAO8_!!~his%=#TXNs0ZPlTpy))SVxFT4)wq(?5W`9N<^ z%LFXr)FW)J0tg8MV0@4?87t>N8=dfjm)*R>gO2Jjd;0?Erb@U@kJsmDq>lbz`!$~9 zP;+GN#5ku1U5(-9A_!cc% z?mX_t89iRVEUgOb7W~fRACw?M_}FeRBT>ad=j9xL;Zq<@upt9U!Vj(Adk5PvTJvT^ zD4_?xoetr~tX+ooXi#t>283%14o ze)1r##-mUjTYSwXYdr|1Twu1Tr8Cc8o^MrMTU&#ejfvaJN}C#@GfZM>`)Yk1DK7sT(D7Gw5j9VpeFuMWZiho{LqRRMri}{cWTyOl;h7?vO7iV_ z^BgbdhB;&DSo?Oyk-&i|y9K`bd;^6YYesV!%50R)M*9oc4~Jy6M0tnomm{1iyz9u` z$d&rMqLy1W+OM^wg(J=?s@oVR^&HG~&x1DZxF1X%P32T3KpY<4(o~nSH0csetFm{?6mA;%mVffCH0*ZO{A1+Y#VBefW%oQEYJN@-%^ea6QA0K@>({V^PWMt)}xCtxlj*sELNzso=C*iJ%1j)Ip zsr}rOMO$6-cDHC!fKPkayt#{-HFd2gW8|kNVfHQ}scCgMec5=G2vxzgT8>D?!eGxG zw+m)UjJRp-tBtLG&RPj#lQME>q;9Oo3gKd>o65zhx6>mJ5#NJuUtZ7>a4xZ;W~3Td zNElV{zcN4*-l1f5{V<1qyi>RERstat$@82qoB7%J=@%vx7d4Y{aq(CIfQLo<#Uyee z{7B|%7Bgpn{Bp>!%VaQquDmzn(!9h4fwRaQtN2Uu(Zm7`?Z_Sqd&RD{_OKIE5(%!i ziK}9Kle?<;dQm@EeoKjW)u(SUoE;)FCVf=l{QP9J+;vEa8YCaPcC+=8F}A)e#|I?F zqpou$WG{?m*rRBsu!U0(+?ZEX7qsVjZ+WzXmZr}^xj}qX|A|S0cxEd7lAr%uPS@yz zde(8e(26y6~+rWRQ=qEN{9xVwk=Hh;v5u=ZNm~bSXPS| zC1R>-^?^6NR9UHUTdb-kvOTy4kde3jdugd|zNfwYr1fHF{nuE*i6n@ld9J;;q}n5a zl&vioqN0JH)~$^Mh2wt_>}cHYrNO~c1_&(A;9#X-xYanURsVNm94WMm%ctTaSl z{dQtG0JSf{3DZvQwyx%+Z!>U zq)I(LW@UW9uVYaPURq}Al1fTkoX8S26Bh9c#MNlyZ*QLE{6rTJ00tXw&TVI@?Omnl zBB3Jp?a^aT$VL$bsb4{2rxqcPELc(|&k9zpQoD1(vzj-5@WQ>F*s@&0nWwoJ=Iv$r z2)I&P+j|5U`RzWLw2LNG*3@@~+qtD8I#l}wu%l~K8-JE_m+Go7KP8w|0Ns%a}lI12c=>mn+bJ>H3T zF=9=x=$QKP7xe)#7oX=Bhqsyj&zm>%U|`)tMtAsz0gMfh=1khC+3i#))%~nmC6Kps z$+ot?Sg++==QOLTevepw@_c?aD^I^rlC(0hib}X-g*82_{B$>0yEkP0D9xCyn9!z| zSBvpMMVbnH|EV8`lSXhMqIM>myvcj$&rkv8$1+-u#a$k9HmY9-m;8SN6($GwdpJ!70v6(i*qJn2GYr0+TgMme;pZ&SPd+?7q zr9~c_D*C?KJit#?FIa@!1yj5znNz=u3=scESxwbYX*rjaf_El9Nn_!8Gs)2}eu6x= zrX=n`YmJza+BmO`i>_^N0-EIWPcg!hyKl7Z?pHjy%oH`vpYy9FbhY!D1#68%Y`@@d z+CJ8^0U#zbYNoy)jotkIWtp_dHgd^D|tmc{80}o~dac6^}-u7>}FOG;?MgC1QE2@D5>{X3}D~pOyMHW;?y~7fj@PTMAA$e$!B%qEfsZ zKP8v8(n*+dqg1*6!+^|cZs$6GJi;<#Et&O;uW~#Vj`~oP;2guMqBb6b*?J_q6<$`WLz(s!qHg3!B@#~uFWt{q9~Z1zC?j^~>aNhOo9k2T zK+g9PmuooJZa1Ed!dD*&>H1=DCg-Edu6cU?iLEQ=V4<%O64ta;JY%}G6jk7GnNAi@0%TVISOB+!52L6IMeEIQ_b5$ zIlRa+F+K!0;p7XaB`Zxp~qzQ9lrJ4xt)lUQFY9uQOOIdxLJ4o^Yw^VM(2jj*0 ztY9YPmub*;X z!`2KL@#Z#s`%=Z3H@-C$q=j;sBX>xQ|Iu@Uk#zsJqS9J4xBr>L@)GFXRwZ=(u+ z3jy=pJ;aT^5;<*#w>8HJj2u8UFpyMW7FQD#ddkRl3UDVn?NRhb(Bi1eb?|iZ5_M-C%7lD^Xj7;Lz5x#NlXYy`cOc zAgSo+mf2d{O~%d>+|K-SX)`|$+ozabbC8qnSQGkC23bvTNP}Z zytblT=CV98Qm$(EkJ(wNKN1pU@XxHQ?1rn3%NWNjtxCG<%vonxSXC3IY*Gs@&X>w> zx1*C{7XXnHz{l;!qZubWw*{q??`noglWCcy)|r;p_P0*%>8Yei3v>JGjkz_5u>aM* z#lwJnW!MbNC_>CH1&P?7X9ruut?FWS4^O1ccV=aN+l5jY74;A8Nx*8Tsi`$w=WpR& zpdV~BCtfDz(OeT3=T&sEc={lC51+8LSUY~^;lNENrY3q>)yQHIC-`JBflW@CXg*j? znHCeNkY%<#D@!XAg?MoPy?5raB$4G(%EChpFh)nlU7S}7iTrOI@0NPqp* zCR{xdKbhFIOG({l8bbPgH8a{+?)7Q;6x-pr(qAQ1G*uQ|_PIHbFkoOItDpUDUl9l# zwdA~XMO_(VzY}7GWepA%Yhv}Y8jO>h|NJ}@;#d^%O@_GX&$O~89%1C!FW|wUl?CPI z9Mf56*2IXtp8Z!JNmK6c>;%ahnCOx7tWS~ORR9KtiR-h=GXf&QkZDmn#Z)h3(aYs2 zjw4bwx|)g-+BTM2pVHU_xZ8e}`{WeX7k4o-6%o@in^zZ?hO=N`q_1eH#?FVe9yOnY zorql%^O08O61Oxp{rC~Elb`2}Cqp%>I!_?RSry;8zAn8jB(AFIYD)R!iU|E*Bc$00 zZxbXmD)Vhy-~mAh7NqTPP4dqtFF$!VtC0Vr?}RSh{sdF+2GwhaA?Q5?{^t5$=L*9< zFM|K4#{a#c{QaY^ukYXgzE=!78HbsLWoCZ!PJ(0to${*k4il(6Mxf9B)bA+qS8oHlFzqKV zmV;3~f*dPDgm+93ewSsFF?7}0=k~8YoG1UERllCR0={$3RRH21sTVjyO$NN?8rXM$ zuF~oF7mGj*!f1|QmGDu?eIi$eUmj&R=xOgI2py@C$h{mb=_pCCVO(T$QFAH-wd9;) z=WkORAQ?)A(NLG3T2D-q-34~}{En&jFBlamg720kkDULfQ_IIOZ`R26nsBg`6)x61 zhkRf3Co4=|mxP$R_%BI{r@AaLEm(m4oo!-1cYG#YNmnA*LZpt_rimm?M~1lx(p=X> z5P{!@W~G*h02FBF!KO>q+^lRfY(K@wK9rF6{yuNCL=z#EAB~HB16s-&0$P@0&J1*?<;CVM zY+bA~x64VnTA5+QuHo)PoS@*xQRc>aev&j3ga&on{=YQ@`(lNDy94&8Bq#-d=V>j~ zwcP<6nydaP|C0Nn6}MF_WrKy#it~n1m!MhXE0tVL*#M2Jts2cqtXcO~5(fo3<1J!` zdp>MQpIh|nI0_ee$FBk#s*ctcD+q`9m3(xq!CurtF>dCo<)n=QB!$W9E64kAD&J+KSx$MPvx9c7keNZiVaZA1fhZ;haDTbPLYQN=G-?Gzm z&6XL548B?Cz?8y8TK^=QX>S6{1Z}GZoiF6`dbHRQ~ zTMgq);4$_|=#oth+H)2PS7&vgG)XM#b-mo?8sd|+^{T-ac29PsA{>rG@_7ttF@)5T z>}3V=OHU~BXzj{3lEbzDsq&qr(N~884eAqo?Bk8=a^sQPtUmN zCHH6(!QD=!CA%ikMDQkSP)`}M{Ou_f-p$zc1=&5DYNe-E-50Xm#?z!f+m802SsGa9 zmw%f-6hv+ghv@<-MG%2Y`WY3V+LH85sEcV7-@aO>l_!j(sox{{{Xpc2VdX z2)X}TN|f2*Od%;L>CDUw1Ox;?_}>@lHk5OAzB=KXpPvVy8)85NcI&?_YlFND;FPDI zdysgK5mWP3N+uRM`WDK+WDA&tiWCL>X5j@*4#o){cT~_ zqGay7Q)*$pSL!JQ_R2RV*!tFvD)7%m?@e;J`uT-l`5>5dU?zHzP*I&>U$P!79>&MV z0l9`hT4KW5Sv_BYP*EnYda<9ldkGK(tg8$#uLKE4CMNd&CB|l1=r-CN)WcP?1e<$B zZF6%9@4?;JJO+SnW1X6EqKyA*F}Ej|$fCZHNJQosINfj9kgb9(uO4NkzK zYpH%civ~~WsYxj)?4fuuvf)fzBf*%yJl=q$p#uj8pOARUA%9bc-i%un%U%cv&YxYQ z!>YNvb6RwMi-|#Yr~0Q|hV(811Bzk`S`fCXLP^KaR257_{m z=aJ{p`!gh|E?#gMNx<}3Xwp^Y8S#*=Gq>~J*wfgp3eE&B!$K&-2C(*N!C<*eNC z)oezvSzf@aD(h+*b}r+AvCDZM<$ojT<-4S&8z`A?kWxiOMGoTViJ^P`1j;%(X}m$F z6^38^P%+_~tBeiNL|yY#pYOs;T0REPKZ33BC6nL;6pA-*|XfOS~EDiY;m z2{+^hW~3`% zQRSoQUu-Ptl`J#5(he?o85<|F5hYz**nXj@2Q5IieBDLR$#3#&ivA(xKbmJtTEFTj zIXRKnGI{E7z#Lf$=Y?hQ`}y&0ljEVe!)t$70f>OX*Wej{RW1;F?dhunQI z=L0lZdFmT`mbE@>|H>{{;sfYyHv__0{mEqBiAy0;o-+S~qW`gedT$$J#p?`}@=BE0 z3rofqfL=AOnDumbw*QY#!(pB`t3MA?+&wr8YbWzw>rXvSOom&^ew7@nYfiU(O%J6T zSr2^%atI5!R2lR`9!+HOX4Fs(JH!41sORiYJK!Eb@37^rJ6c|Rv!z%qrS7JZ6KrMRwOI`<#7(Xpl2s*9Ja{F%VcHoCH(Om1EITt;3M zoRcs2b~KnL!zDsPg=FuKTR`D;Z{IQ5+>McI9?mzg)7~!c47bx+-(<*o2_9F@_EtAC zHy5YeM5|_IXJtWl(iye9?A)}L7eAP3pY`CZ{d+G{kblLqS#%lO7h}9jY>eP~OTZ+Z zn5bTp5eOcdQz(MbxVXpNs8DfjQ9kJF8F+IUQb3sQ;i<)H0Yzq2PU&ShO3TW$e1 zu>3EhnU9({GjDV9Aw_>sUhJY8}nBDI5(8n#CY$G4W~A~Ep-14FkR(5{p@l#@$Kdn zelO0~pDP2=`vBa1ith^Y{OmJ-J@UR`wf@_lBGp@Ix+Mv?M@=Iv$WMLoM^-555CzNaH2LlR^c+Dxy z%wAC9Ka11Ssd@u2UrrO6Db9l^rno+=egBd`GH z>Ql}WiksdZe}mYU?2mS@WY-a{AIn%Ku}qzY$k_rcwudFfJmGQFgLQRIaKD9V)svQR z0KakOKDJ=I4EolcWgERRDv(${Ot)40y?9M%h&U`iBeRD;ZF}y)8bOU;SFnp<g*f9y1MbJurZ%=MnD4@Fxji}s;(k<*%0BcsD2+?c~5Z4 ziGUaS*%If?U{CTLLZiU%A9GYYeV=aiTU`#1=F1klDT6p(Q&}xI>{iH$iMxGGv5~}) z?3cizz#+~}9&^CxsHmz}f9Cub-|J*p*%?B{=}L-_CsKA-o^6pkj*>qeemB9>!f zYEAe>)9r70vvwk$I}XxokMuPK@t(Wq*o}2{&x@Z0bu(t;lz;fMuV3qe%VC7|m`$vs zT+h|jkauvZ)nz<-YnMJv2F&3;K=wLzh6Bwfk=be5N0VO9`#!kwe#28+7p!YR(`)cL zy(QpXsM5aC&<*vXRJavC2|Mhy|Lq4Icc?hhmp-jw5WoC#Drz-2dbV_|~Y9DoKXHa!zqzB3|WC%rW`i9Q(@#CNelR2_alVk-=G z4vwS`_E;&(3Pr>P3o~CL5YsiwJ4aEv)$*Me8^#l+*?`zI8-90?XQ&&eDjbId_%;gO zPRA=3wZNL1#;=0-*-0c2F*1Ziz)SX|2VnNbx>ss|0iOy{Ti9K?x^86wCVOI$H^DkX zv)36jv(vO_8^^^Z-M+qMz_a|)azeL;XjKR(qmuXH{ z1X1BNR@p+iZkHPtBO@cvxn`Aio8Ov_8#JwQ3O}g>?x~H-<#{EMKhN{k77=IVnup@> z@7>Vb3!*!MF1o#~Q!+QJGnFi?l3A?@GDlH`$kEDxoLC2AqVeNwh^LjR)_V%E%DZpY5Y{{b73oTEF zZj)c%(a(bhzIIwS%cEt%q}JZPzNjQS=*gK=oW%Sf0#y6mecg$tm)5l~0dyWx?f4K_-`m*=3veN;vs zIG7(v_glv%3|6rcPG(!18<5BCAs55?ZsJs!`6D|{$%U9aG7%$@b~2ef9DI6b1Z zb9J21gECp*O6v{nG^8K+T-JrL{Dy?vRnPz-xXUYTHG+J#HHDz{=7I_RxD00fqCM|1 z`ljn?H%fVr*f>rXv9*=bRju3FLa-o^*Gqxu|R9M!n~3nCsGIwJs~TpFrSz zdZXQHz@YJ@V1HA486nYLejXUzL!93*R>4u)uui&iK5O(kiWi_yxRAa-vE+Yn_EuqS zb!*fpQoKNMindVPTHGmK+=^RqD6YY^cyTLk#ob+6ytqq%pv7GRgd`_>@9+En=Ukkd zle?8CGizm9-uE4IjFEYy9|4CV7X}@?_)@t8V3oKD7#PRuf3{s@;9FOWN!hQ1MK#V} zGmKA(&P=he*UxnK+(urYEnjqUurqR89S(-nl*bx%H~|;C=n&KmDFH4g{qgC6zQ2Pd zz+}y2b9|>WU}t(p(BgK}@*u-I1{vDtW_NlnuIZRXO0ErpBx15&!~$8hh(z;Azo}bw zJA={Nu{7{RdKF_o>NWxq_!Nr+T5AX#sxAI))?ml~ zq$sbJ$B&~Nf9>sMdGeGC2^4m<&F_D5wBa)C^4gDRZ@!J=iEMa3InV|c+5Mu z9#`7|?&i9yx>rVBXTocF$%Gm4w0b?hW$6}QzP3Z+in|1yAFl>y1N`E1I(?rGzb+Wo zt$Lgv$I(OhX~hH0m*b7iE8~w?wtox6n|8aN?fv4gP1Ct}IGQ@EGUTuRt%}6&u-<5g zD%>l0BRfJ2ufzqmI!fUSNsD71p9hJT9UoZrn%!Xsda%~}*M*1WS6@~*_dPmow4zEC zX(kup<2f0RHC?Cnq(D1pmrn(~PuFUIQVD}YwCiiVfeZ)lKDsO(a{$|FNIsVF=NQcT z{EksEY%Qcek#1uW)_uGhp{+CS8dmv2Wuul$pc}_E5m3Pd+j_ee&LA6p0c!V!gj_<| zGPsNdgJ93$O3QVoeI8fO9XDj0rk&pBr>n7KT&CS#^L&hx%gV6-WF5Z!7@U??NYjqCmks z4wW^_uBnN5fJY$Cm~DpFjB^_Pcm@^)1vNpUsqMW;P0yfP=SNPAS?RWKpXdAFa5y-b z`rt;cbk?1+#`xfS@r)9JgG9Z9Jrh=~KF{~8RFCi5z-c*ubb{|Od6t`dn#OQ`0c<#; zSCv_LkTh0nb$JWJaq}9+X3Gd1>AO#~*Gv7oL8Rove*}CKCzI%b?A1g?Z7CVP zSU&4Jq&y9}I5->k34HvRW%Jl5os9mAMoxE%M#%mCIg=<-w{A{^0wBos#^s)2VCW4e#WrKn_k z#q>S#j$0uAL#L04zzS;M-b-V4KG}4xZL(z-mo}Y!G9&k$iOd?d3{IfS??vDRtU>#^ zjKN=Q;=T@&PfbQ5YOL&4^Xvs=V37cvSYUvKBECsH`3$uAQ%;!*_Sw%XdMJKVwLn{T zn6JNmc~!sC6an@NIa6~)eRgO8I}ut26(DN6_5@pSNtd3SmbT*B(OG)=I?OS>zV{Mc z?)$@G%f@24s!o3mTTV**`fg@X<&}*>c`wePBjC_7&Kyvy(=I(O+c;B^60Bh_q%;2@LC)9igx#$G~ROaSa{o#L{+wzI9E7}^t@m~1fY^yfn@2Fzz31=IO{cR2``1wc>_pvYu zYGFTUVL~6#@v(`o?}kLjnFI`)4^C4t5zkm_y{LBfF260I_ruGr$BCWqaFB)^jXX>Z6J}#dxht?Gy#}{yD zn;+{m`+|&5Tdv2gXIG%h5&V%U|9eS7(!=)nAM4tux$Yo1nD*Y(_0Cna1rV2$1U{L( zMqPVZrBfJSJ@ltVq}kLPqbuuN1~U97R~SzcVao00{IDXfl-q5LlQ8r=QSdE9DP`tp^8xtE!C>` z=ZDPVyr02a6g*@IfqVfcG3KK)GuHOKZ0du-=N{8@lO}_q_4$wYJBwJh8z(uIAHE9k-8?>PWDwpXRoo6HC{2M-tLfQ$3}m2flHg1A~-4 zEPx)5x5Xm4HgUdVWe5k1@03iAi9G{al&Kan_ZxJ~J5HnZY5D=Qlt_D1)E`mvQ_ z=tW!=8I-Vzt~xJY%m)?@@c5Rpy`OD9YnS<#Rf^0BL3bLz<4y`kdY*lQ04d)fah0N> zZ>6#6*66{Yb8!*|4}Vq7>MYhMMSV~6V`)gfMR6EE)dVA5;468d*?^1R)_lmU5!-u2 z7F@Vmm4H1$lbzuQtu*OHuG%KdNMPlusW}K@c%Xq}0Fc9@P(5;w<(i@e6BAMbn13N5 z(WXq{ZG>hwD6mcH6~x60jduEaznc&BG9 zCEbGu@M1=Svs>&~u}s1T;L!Un+CaTd}t7l*kSC_Z^^sJ)YM!FV_q$D>$t=2ebVs1(MZ~`61lPpeC>Zb!YKJ3WN z&fA%q%=S84>Ga~u8e{#XeWGR@RAAwBaPZaB{6H~pIhWG_wEs-Gz#)c0<>^(sZ#*^L zV}_4(sT+p2g&V`w?I{a}fkCj7i*Cw%5p>&45$~Pe+P>JS+8RTzv$bBY$>T+4JIvb0 z$8`=Bv2moj44e3Tevj+LS3<3> zjY`05Dyoxmhb+uCo%;?3&V9E*&AZ>T`<7dv*}acmC7m5jAV?~zfxct{9>%jr%2){%FcKiA4b7C+z*ggYZ_t!dK>&bp3< zjSB}vbfFeUUmcg3nQADR2zi+@N&#~+r@`CW0{__Xz=`(ECm9eABXVc>$C5 zJ0u``_lorglD=UGDqwp1z<7$jUSWJ~d>SFZz$Y41FimLGX|$D;9v6PR!C{Cui&APB zjm~oQ3x7IC(CfTN%d#<{g6hRq0y^@8`+ur^9Lz{K*zCrgQgeemOjF?d{n#bf#lvt< z{aRsyRXq|Ots|OguDq`8T!Zku?MmtCGm?s5W)>6Ev}wFJBQzf{{7nzZS0duo>ur9b zBa92Dzkk6WX$Ct$oyOYW>u&F=snK>;GuFB|e^|7AB+B0P_VF$;p0BTnQo%lG!#owV zw!Cn(DFi^~uI{QHGPn*N_p63zQF3RhH{5SCL(VHWLc5fWJEGGN}!nS+xzBm4}|NeWfViKmlm34JBg)k$~VZ-2=O4Wnlc$9Ug+YOB!pYcZ7TIW-zxq#|5 zmoZ(tQ)FsZd>$S}fzQ{A2!?TfX7TwTZ`dV1h+Qne@TubueaL>*Ig2Qd4`Z8_%TOMX zfCp||p6DW<|GoEeXWH*dHR9SFllw`5$hu8|8TIvBXtMP3(B$MxE?779kOl7uiNAlB z+WG?D`44k=U%9WEZMxUjroZxz z#ph>(*j+6K6wkA!2)=-Rj|QM1&f*ci(qn8t@9hlvoeLFRDRZ6@y_tC`}rSX3=RAJ#v?Z)k-dC>_bX_#P5kteKIjU=#Av$a=?J z$VXQ6!!{!|oGL3DLqb^FRLsRLT-q=4Hu=gmZmUx7Kqp z0}}(P1A84WU}A>+*H>5$AjrHLr1hq5YoEv{=yqc0WVtr?`LW+%K?JKB`nV8Ixm*Y9 zcE*r6R(yPMPb2ID9ggFX$FJTwkX8dw3A){_rAb2oRH7cXkhQdN??*6=xa;%G2dj+? zFF9-!34cVH<>_+l29Z>Yxu1@BRz3LWR114Nug6g?$HUu+Am%uJnSbjArVR(gL*H=W zgIb~ToTfcqXUF@}eyx|+*R^`Ty1vd&xv%t0lHs3i#6O+z8G4zvd%J>`T2QJ4aywlf zFKZ_ay-vmJ{UW!r;v}H{wkN)lw@YWD-Va;nam=$d8{G#J6}$3INkwO4jg2t=JdGyUFl4_SV4YxY~W!yPr(PDBl(}73YooT zGQ}r}j?Jlq=1KVJ946Iv#SY!EWmFr9saOrEQX$lEZFa2e{2y0XGRsIqkj3LwYmp^? zSyLoT<%x|~p!+jp_UEHw_Q%@&(hWxQ_DOeM>4hvwU-{{(IU01F!UOxHI8cPp{ju<(+~fwO2LaR=bbZWe>6D4URlP9r?ln0#xe z8=bP@_-;U(d8kIO%L=$Ond3}VX!WrWoB(e8(bgOPdwQCw{a)T)U>P!U&u$toT$a{7 zoHK|vOWX`!<}b|@ z<#4#lWCYC(yJ6sMWp!-NHl9Z-Zym|5YDlI)F!Z7u@qBsNlZI-@NT$UC6d|U0^@bRG zlV$5R&Ix&bzhO4#5=N)4ead4#mrJ}<&bR|6_v3HQdG_wK?t>1*o~&kyq$(W74Suad zlwQYx;zs=?o;O1oKc?(&n0As_tx9Cs2WGs1W5XOFYB37qf7nJhI=np?K#|b1h-o6l z)KGf?<6b64CN3^|ub}Bt?QXW-g++s3O!eSP5}{RjKY_X(*yeCqYiPp70gkS7u264G z!iCyeHA1lj1CQ!qG2x3@Akh4IpM);w&VU2*x}}FnMs@s~AHOuTw$4`%^>$q)sRY4-NXzysGge=5@N# z>3Jf~i*O|iCL=@O65sAsB~P8f{>q4W=GXYZ$Ozlzk_)qX!N(93G;CsKb=a3}(-5ee zXsVjti+Txx`+G=ZA_}s%t0a<%vh4-2*Cs03pT73>)=k%O>_4H{YdX%3V*fTzo$mOE zWMYK46VaLoL+HI^$Tb(|@AEF2b}4;zN#Jo!4aR@(fwED(aF^58`iV zi{z?5B^x3A()9pzmtQ>h-)hsooeZ(HqkV9MEDrYR&oqt=Z8RzOaS(lP9Rpej$#UD~ zm&02lVOIeWz0$1r@AJphzed56&&gAm_YoNz80CGWN zZL8Q2%mMc2Z=mF>j>0(4z?UeYf;Gu(ncUBdX>Qx(4dt1e5Rt#BA| z2%u@2D_PQy=E3RJHR$b?HPlw4WFTHFwu}7;a4B2cqZ`tWnPt8CqEDNYFgV-@5c`;; zj@Ntj?zz?Lf#YnZO4G^jyzA88zR@(JE1r^8evIk!kI^S;FOHjrxW2%7*Kx!7?xuCu z^>P~eTy^t`Jw#-E^8EU&_o92hb)Ivmz<$kadA}#9d$;~I$7VNHps^QDmqVXf+u!tg z)$KO<06l#dq|LA=&!KW9;b?H)h-ot38Vg}P#+_GR)+so)9nL@YZgr)UY`Um5_C>eY zJ$^=yW}!T-#R$&5p6Ek?`JP?)3~H>0j616+{2eUMWQRJgd^cfc>`#{}8qI^lt7~95 zUgsm~ER6lN*OT3|Y;?b4JOgR(Yr1@WE!6+aaZ{y^i>9TT;r#bGkMCR(lvgyumu2}a z>s+=Hl8pCJrCGe}+K316Duy=k?NrGJ()5R^{K(%gTbz?z1Fd!TL}V&)nG-dz#HtDX z*qRyKiA^0Sd_MjVdoA42bJ4V&H$ChpenR_j_OV9nm{?sI@t(pv7cgr69iV%8^J?=A zVLfH8(ZLUF#Yie5WvDX zmn4aKar(+!*L#^#47R^OklVB|@VD{46oOq-+3spyZm`lRkGxWe)nn2E={0Pap=pQ2 zjC?JFl`fG!QaXtq@)Fh%$4r(B`1hdweG+Ll$zDBaxyl2ho56G4n;-@MZag?x{l9xD zIjV{k22pbB9hZCfyB0GNF;}q>-a>RvK51D`85G&W`QBSi+8p;u#(7!Ng@vXSg_08r ztM!IRm`JN`X;2l)Ue0)0&+tUKnm8z*%y%G1x19-5Xn)ET`JrJ6yrMcfI7Mwn&LZ3Rq%V-D_(3&zo027H%_K%RbX_>Hic@ya%yT z_)Z}X!SqcmuxNea{vu-FK+uQ#^|kNbky*yiT(aE9eNEm*5r68&yRNADT>7i&B0xd> zFGf>ZKZW#5`aYFL0-Mw8{C1L)uD^C&`}U&IqO7M~(rl7*9P)~9Z4Zirb9c;a44LUO zhYsr6u||i-0P4d;ir<`kYElw9PQo`EH8+@MCH}m#y`MGNj!3>Mj{g*4>czq@d9stl z#za(;^5zhu~%3QGa(FW(XnOq4bMNu*{i}|g^Ty#R$PVP^f zg`Eg*y0(+;Pt(fa>{}0xk#~S~ydR}Uz6Y=SqPkf2nzvhTOg3axmaA?Lmg7|+JMOdp+Gn4FB0Rt6r2Q!VMm$$WrB2i$;iarb+2WIa z`rtMlt|4-?y2imvSyyl_vm2<<)H#{<(=Xkl2L}N`2e3l1v?P90rB}=JyZ=>cHk48`Xr zEWMhGRV#y>XZ*r%^{T0uce*s11cN_TEyoDH+39+8+B+j$bCG+j$QJMNoY$Ude9U-F zKAi7E{*dCDo-SdqpedHSvWwp^ZFQf$FDk8cs8ep2{kHH`y|LhBlr~LkmB>$t#9L4Z z^#aWB+m2OsrWkUjA!kROhT0-+F)qZ~sAsoD@~zHF*-PrM&NVanMWW9UdRoN;$i4)T z`^C<_saa2HS)G<*$#^St1U?&d(x2$QSbQ~gwJJH6u4~B}f1KVlSeeXpnMj(&|?KCM`u#5oO zABw~*D)N&>>W57Ofgn&4{eUlo4qG6SDIJH zrPdats3hq&UU6=cX?79IM3}V93TldfI=7=w`2O9G72_sW9#c2YlMevVD+2}TTP{k` zjB;s_;;s-a=ZW{f(Wsr*BCjBrS z$E>m<6n<;etjc_iwV0bti2C(UG}(-RSB*!({+l!E#&LP&U^&;*uV+h$on4Lu+0re^ zIene&mL`DP6L)=+tSwvY^X|&GPOc8^slZA0}cbVns8ecfT8(CY4|vf2+GVI#%|B zz?NfLs+GJg{TAUSB#vgr6E;nT2Igw4ds z=4Vl1LS{0z-f&@pe86trh1UmmqJAug_8=GkV9U-=?eSHXKu>gaM@G*etuUHx*a zdhr?qxlP5QPX8}?0-i3Z04X2%K}oo-C#+HBrmM`95MKx+OP`_h zRXn~sQD8}p;yU$GpM@yUMC86Pz~cVJtP;zf|Jk67^%T^-HrpKCmjZa}+;J0)ZrVEe zN_Wa{R*j1%mQ?Tpz@EXYsTX&~;XHY@i%l9F`^?D9SBH98L#JqJ^vi7H^owxSfz>rh zMFBN9piT4|#6a!#tZ>Ru?9hhwHQOXd{nw0(YT7m0h?Of>xICUp#z|yx84?(@a4)rr-*&WFhJmpk zod_X45dHtAjem-WiG$C^bH{$ReisIRlgoeS6QBZVz@R3lZSJ8V7#Yo>i`KV{aGA{5<4(auQyK{geyboO z`MDK;sU;fYw4Kb2E@37k%Uw=b)jU+_G#7TGa^Xk_GjxhDW@AcVOcU!o@73gjj2+5! zXv|D?iQ9YLC}Zw1F8_>O!vfq9I@=F#*5n;dv89pWs8g4!3YO$`ob~9lyF|M5H=s)e zsiq%_sUh!+CLo)yH;vxmA8Z)hbs_7~9j_skNU-0pIOf+7N{Tr9o?+V7oSoeGZ~0VP zT8h@`oU|TLTov?4nS^GgeK=+7KaqWI-MC*XC-;;UxH_L-sZy0q3TUV6*vbVwdv$^r z`CH1xu8o66;2%Gl8tUfP$W1V84EhN-WZYucL{`M{6P&cTQDc2idiJFs7_?U`ggE=v z29no<>7AIv{+AV(h8rVqo-XBxeIP73?0c#lVVy4;JrCK+C^`35T%DiMChJMqPl(^w z{i?qww>8q#;;$PkUyiFO7hs-1*+z_y_ZoCdd~0VoRqp0Q)WDD;$&3^;4$1Cpnsq?WPV)ftihRzuEJ?8dj;{Cwi-aT2d_tQB1N(1839Ay z$aVr1A+3WbYboiuKha*s1Kn5M!(8)v{q8vs`7s@=t2yO!Xbhi~|FWqo?61j=`|pV# zvg=`|=Y>C6JH|t#0z9PjmiBK{{ihZcb_WR3D~gJL;+4%nrC^2^7I1BTMlXl&3^$l(&44~4qUhg)B(3qV-lQeH62cE^!DXdg;LP&RZyPwN>bD+s~*xY6UiT{ z50Agz2)O#clN4A?6JM>{=k#8`bE9rpWrKRpeF;*Ce$cNfDca_qvZGsiEFBQ5ur~WT zFrfi|z*#;O5Odk^8E`5N@Zok9G@i2Ce{D~5=FnFg^1jN!ovuO>7=B>mo@b9&RV!pv zNlwi+n$%_4u+}RG=oa|A0MYzVBO&N|)^l0*Lawb4lr>;2Vbo+AG!&?G|0Tc}Ht*MJ zf6>>nbisC1Q4M8RmNk*~=NX$?5GoYk_rwLfW^Z zVd7;<_wc)Bb~oaS!cn~bRUh+ZF~HERSF4BKy4OM4%b-Ku^4etQd3m;m7(+k4Lw|JF z_kB-mMQC68;=X21S;{5Y4Z&P-SH)a|(K{ zOTPE1Z|Hq!@UPUDU7)FY{LkmtObsGbnZEB`PJ9f(g!*(1X-)1%N^9BhZB7MI*?M3 z`+KF$q#=YZ5ZIEu*WJWGE4yA(s5(fx@uf_WIJgajFQl(bF~%XnM9n0mcyX<`5d?C^ zkNE?pbJ9&5CK|V_>%wV7b;&fFnF4N})WkSk5itxGO0dY}YQzawQFzJ;?fmqZ;m>s0 zcza!-Kj(9rcig{G^ed7QQ_M%-ybjgnwh7_th4$sl(vYxZfZqcY;Dog42eRK7zebv~ zZRHn10&DpWn5%A#^qRMV5ru$*%FFFd^`m~J{lSJGJCWrWgU46KWf~-WikLc>28CK% z5<=nQwfsxbeeWo*Q+!&3xN2QEkp%dwije#TF3Uz|^Pa4&GH0Y&SFZE5qeV-I13xo* z*VRu)08Q+}QSV2;(eR8l(OB#d#nP<9FO}r~jcXCyl9+Nhf5jyZe@7PQqrqPV-NENJ zv1 z1AZ_a7g8Hw-mcbMczr``hPIH12DeRRguOeRDK3CM9Vz1Jn;-T|*JRuFBTqg=a=Cxb zxoOG0X`$jC`b=L(Ub2~rCH}y^U1%3kE#2E{{Fgp6n3}LqesXSbQ5sMD_mraA534HS z16Fbd5VuM%8>O!vhBi%rIIGjyO74h)m728IB>a4kmd#HFHE2#DeJ)OfDW*l= zPZkO;AHvFH+|WtrvB^Pb>3xZ`97LP#*!fzjqd)+#Q zuzN($u~PahlKP1>Q#ZX!lkyU~1u@ckuJX%IzJcwb!Z*-QDJv&a>WcC{GCrsJWR)vk ziho%6>039e41Ue@*Y1Vmf&VNSL@atM%(p_*tHYLa4NrfkJldZ;cr(;dlOV(4hBx(rOD>`O+eSqgLE zVH2cu9xsmB4#1@D7b9~x2U7`%T?*PoOd4zm z?pz0qOagLRMK1-d(!Xib(%iCX0Ab!xs0wUpn` zKyX;69k#8F%S6)hONnRZ!$em`;cA)_CUIT`f@D1L(tNr{(c^aSElvV>?lD$E&J0Z& z$J0^UT= znnJSeHg!`8ZR9xt_6nF+7M-KRF0|gR@`vJs+V4P-=9EG9IV&lOYnOIWl|B_P3LeEz zHZ%JSjw%}07a|{|Y$yxm@8(EO-CNWxtWr4Hsq1$M*7Bik<1$7~1NSz#v8ljhaktL4=FpuXlH~4wvyv(fGIKQ_&Aj8qs8K6U$zIv=%TW z2Aym+4XFRSzcxO|j@s0?r;)jK4}Oqc;gw#y_MD9q;UKD7kvinU<7t(hM>#rcjC zDNeZ5a!VT)s4{Pl{*Wn#V>rynV6X_q3^~8rldBrjf94%8l zl;~{FE$uQALBE32D_3>*8c8wOnuWuMt#-qjnsx&-GcKMSQscT;RBY6l&!R~>)9tWX zjQN`CTmp}noPBENxbCy^a#`&H&C=fzt&@w$17*^ z<~g6eb9I$#>_3OcyB%^iOZ4&K{ufAkWFr~d3TrHk+>^qe=Hh-UQKUtID0t(edX3jd zjz-X=WB(4!f7I=p?SBl}cT9d8Im2tKIM#1`n(u2Kl*!;C;2SM-sb-t%aHwVu1Ih^I zZ(-0TVm(GfdE(X;e>Rk@C=H@|MWdZtsRgNXlS5Rr5Jl}At3<3#cp?OKc4hnk{+rIX zgZE%Rq>BdaT$;wwb#-$0_2A5-o`D9XO65jin4t@`Gg@BcwH^WFc&6Pp1$|LA&rN%|M7{8s{`pAIqi z{y`o8M-vT}een-;D62>(!Da4^zrRB+f54h9|{Fa?r5naJLVXrPpA2BQefW@(qYMm zKQ$uD1WaUzXI{TNp8*eSk9`(SQFUUTyuEXAb8)**`1JMYwN>K}Tf?n(BB+L-XozC5 z)|kw?`67bahj{hpWBuPXWH*s1734`ka@H`mnyK(NTkj=>)fEp*h@b*}`-zxlV{9pp z-tAaLHhRuP_N-n8NUk9SzlMP zQAOzbp;2-v+;+O{*ceYMquZOYJoRA8VB;(omwAtf7WpSj?*1!M!Gr!!57NF0M&zbk)3OnMozPgHK4i_Z0FIzNJRd}EWmeUK*Yz&UhJcmmwYH&mk zf8^W3>cj4TK^LnqmT-3;^C#zxCgu&D_@5FFsjjE96YIi~`FZD`Rw&U^ehSt`+?(KV@B7u=KNPZHmh*jMldF zeQltK9sQ|Los|c55;t$N+xt1MIz2PG!QMzbMER}D$vYkE5w{a%wqHG)$vMIn?)E=; z%>y-~8bZt*0;w~lphUG<|EN3Q{Tr=bA{lMfaTYzj5a1CJ;o+l=jUN(430FO?N$&NR zkpj6#jY{$LWff%%3FQg}eyDCIV=yEQJ9K9Eysi9fa&pOAxwkmsZPT%SrWK=8NK6_l zXX8nRmLu%HXJz@?{b}*EO84c?r_i>?F=d2&d`Hbl+=FhBH<4_sK+^sTtuhT3e4IsI}&(+M#t9!at`!Zrj3p@5D-jwvc zV!+{?3J*>~M4qcd(}ZfmfG#PDmU5)YIiyunxbPtR!<=!A|H1d_Xo+Y(6`y5+Yz-uu8kKIix?mF) zxE5(bvOuk&aU&l@FzfJ|;pLsXPG?(?cXu13{`LK8`&z@Q?u4H18IGDL^Y^jko41YD zqakYvB#Zu^c-ZM6q_)Q4z&huU;p2&`nGX7*O;IWTVgz{u1lkPth1MqXx84v$t z!*So%_`luxA>jW`?dLqh0*&jRgqU=txhBB+s>W;pinlU{nQ0QX4E|V*^6Bg841PlEoEdH5&2_Tndy+*v)y96q}3khk0U$bO+|UIXzilC*za;J$Cw~=jcnZu({GF z?DJ!D#qmFtUr!>3FSXbyu=@|x^-88TnB&p5kZML0D=+Z+Cte$L4g%GN49=J9Q; zAPFW%g0UZ#GnpwQN$F*EN(=F-MbQlm1?o07rVOi9rrx&PGWl6_2~!&=VnTfS)EC~j zm-_Ja`-%#{a}G)F7;8eapzpDDph%#Xb@GHUJ-R{H%Vj1qn(|iVnb#iZwPKL-Asm{c z8e75E&p9pD@6~ySwy{zsK=}PB?RjO_ZOX+})@Azd=#Z_P{pHW0<768vhHinmKbJkF z{t@ZQfAudDTNH`xp<**d_wkJO*YBkAm)D=NQ?_>vmpOAqy-pv-cm$k4e%5Cj!chY- zH-e-=b9FbVv!Qd4IN)h7$%1LhwBv1Id5X@gYEdGVH%hKT-5BPp9?z@2tKyM_{9X?B zZKAYoi>lfO?ilJ|rr3e%pO&}oZYc{T;aquQKDR4Z^9QwAkM9U=l~3{M3C4JTs~40E zcW8|y(1`gyJ(CdFEtZEyP^oQDg45QnQfwQ>c+ngBVBzWOX-WqPv?9LO6X8Jocilva z<;-G@bx7Icw6oypzc5VFBvCO1Jnj_nAh@dvElr8r{nx2q1Y;iPc7iLvE;lEuY}BYF zyr>L|BaX12xKo~q<8z7HTPX-|@IT=cf|v6}6mMUQHBN4*mK%nLg4Wd>`@USSF@Q4ZTPQt$ zmTEEK0lbx)GU+=Z?Lmv)*1O`)dJI7alo^7-t@YEV(O6y5Cg&O!|aK{x=U>@anVH$-`BXCBaDhH8{U(_a9mqY;{WSc^c@y%?PZ!O-q)kms zuqYXw_+W2^R?_b6tcpP91N%tJ`lcOUV>XD=hUeYjrIRB}Di&Heyu81LJwt)ziB}Mpc zZ`YtuJ;#9M9BI83!jw2u&Sr+Wj~&U$+{4mx=dS6hVRrUP;J)W^rV+O#HBzqhZ7OG9#$KnL4`o{|m%zdlMsk*j7iO!;svd@89 z3>-UJ`KV?(;rkdl1I*1vgfjkP(M-kQdF$Wd^m{BqPe}-Q$e`ti2FO##GzbTXEGKM0 zIUB#R0R+x2tCg5hlNttOzG@hJ_SNTE8))C%#5qepUE;nzTOzb)Q0I{f znx2io`-G0ul5V-QvmG5$OBs)af+9@^@G4<69^K!G#)uhH zV89VNWC8KDjoFB`%+mDM4=CX=P%OZCyKKZ#E^i(IZJz1!&|~W?RrOiPT&Bk{m*Yhr zN{Hgn{;+IWYHN`IF*TO$)t^SKN<;L`rz}Fewi(qu+;XYkUkpC$>CeBp=O~lF2~jRt zAYmA>Oig6&Yq>BBc$M;~MElKPb{l!YJh1;4%;W`YxKRo%S*E^R(ag+LWNu~L%iG)A z-OWWK)XTDeGN{t<7hlj*4sD9eNQ?wU#xEOEVUOKu2E+SQd-d`k*#UYRNXR+^`=kTP$#*LoaUKT{vNhR2#KNp)7oSyx-j z9*vE|<#;IB!TXk#y{bA|xv-$=1-8?Bkq^SGADWzVzU68b5=j$^OAI~_J}PaxF1`~E z6J5%FO-qpZL+rieusM=}B4HZ8Q5_2#iI!04QtXN$bne*76KpGQVPWOt>L8=%B+HY= z$1|H%QukQxn!045t+V_gSo4pIvyz?F#^B&5;{fddM;~PwZ%Gx5I6fXDYOX828Z(D1 z{{aZO%1U*PN45^NoNQCL_z9H`)E_H69SXX-yICc8 zI@()1x>`DF>=PA>6Yh9NL^XWTf5- zD6{44H;nTvALoiOrY$wD+_j3%6XlA%7Dyw)zgcJSsUJ>+v_3T+lTxiU6NOn>4fPba zpEKU-5SNr%dEMi;HuJ`PzxR91n$yXcVLGp;Z?N#;eLVkyt(sDx!XkOzH(^AkntW(p z4yF6X%O^6P<>JrjyqC?#2l-mmht`vD^?JzS9Yq}P?25WRNIjQ|D9_|`m!1F1k(zpC2G{EUR~xb)spbk0PiQYl?^CDAd- zi9s$3>Xw~E7GyvN^zn-TDtSm>Q_(9nH7Pc_xW0?Z{-StyQ$EabGoOhmd!Bz)p$=sZehhZfwRqNIsR5^`tIXQ?DxL| z%~hT{#4x5`5l6aGW5Qz7i%?*u;D&1I&~98B9T8Df*Ue(ksxy4g9lvB9oHkBEZ`ycC zW@1=WQrjSoK_j-;S5}l1rle(dj}TsecO9Mi6Y0#ES$dzTtY}Qd@a*iXnMu5#iMq8% zTz*(VBCa4sAV^w)~Zb zD9efui%x1AKnqN2X{s(OLkpbMkE4=Dx{_kBJq@ij8O@hK#E5}C?5lO&M{-Ocs2l@-Y`k;&QR6J#2hM8b{q z6{N+5ghf>}^`UkTmEM+$sPK@4bhL>k&_PTb=}C`|439}{=yTT@YE6qVTAKTaW& z(Aie=6+|R{Cm|Szn3{KI|PKlBnc?Y86T8#QHHb z6MR>xjm3+qUcxks)>Mv~tjMa?er)^GXhZEa(cx$dl;f!MiT<{t(%Lb!;fWJ)i90NLmum}ZRG8mKsgC1rX`m9E**rNpNf_?r9PASmW`9%0 zgNqlHEc^!0wkBd{2K^m%CDjdBcZM6PDlO?mjT@CvRhSkM7M@q$Fo89m*n%(!otEkf zp?O`iEJ9g9eoIe(TYXhSeQi>7SVnOJfkH(M4vjQcl9d=15#Q2}W6}sUy-*$c6y zrmCrX7%hEkO+`&}FNuuaWgI%OXy_P3dqM|l9NPQQ9?{uQ-Pk>x5n`!rXQQ zKqIm98sd0;c}YvpFqJ|=jaE|^S`2bqU3qOwA3D2esmcor2`{eeqA?hR(Z1>$)K+Ab zRkbGh>Z#da>%wj=U;2y{@swR81i;zYEQ=JgsD+WO*!xM2F_m(MkkSd4SD+NvT};5X0~2U1Eg8znB{YEyTp1_ zc}=W?;&YF|?s8*o-3}tjNn6b(x)Kd<$_-G|u^Acb(3cd8s~$x|BCH;p`s9+jv!s-i ze7)T@^hxt73X~Op18Gxqm8wtn@=)@MsPBeG7m37FRY8Vm(q1+&d_c3 zR3gd;W?B8l3J+g|1~ItoDhRXi6gXG(}j8YVZ9aW5cCnjfE zLp7=@GPxaNF)uXCymPR5_m@A{)u_c!x2AZ>>-bL2&Q``a$Uk+WPLf_~DSD>VPco?} zb~8sB)m0>-tA?29j0QV>XUxt{C%NdVTZPV`S|*ybm6Wp@yWBJ-+!7klfZ|{iHA5d% z{R?#szrul8YMZ8ngmYZU$Z(gHny9{CMscX6ws|m0(}bo(1v$-b+H7Hfm7Yrq>(w*? zyN-kcaOo3CnVc4G01mLxwu&g}E%sNCGZ;pD0;O9=NjAQwFY={^u}?OdV}Egk>|>L5 z0+UW54E1&Qb~ac(R&a`Km>R24kkfCW&JLA^i#$@vZRqZ4$P&LV9ADk)^-RXhJDtp6 zvd|eA`_p+W08@HRBpyj=7&$rET3OrVH1u~C1c^wh6*cvDS0_KZBN|^+Vl4m2J+WeB zu*34Pn2CG1jjmc?UN>5Xf?y*>OFt@kQ0K91Ow|w?lId-tZXQgTnj%e%_H_4DX9X$A zK5rWyver@vE$YJ-yQw&{yrDHW;IXQKzl*Job-*}{h5bl6fkY?tnrO=h7qqY#6tvAr z6dJZ+LoLM>jcR*_o3jJ&3Col<*BeMlBsbvDs9-Y%3;+CCW~YYilcK>%T3d$1Lz(!} z*1^sSWf39YoSFzL4VzGO+`W41dN?|%rs3L6Ebg^O0)fRK1Y4T8#Ma?E(qtdXW}zK;a*{?NaxT-+ zne3mE~{x*w~-N8a8~am{8v0 zZJ^{3TaBh4u8LMrHRv4bcqXe7T{(dE)r2KLlY!z6i#qK1OvyD7+fm0mtJ2c* z(Rns;Vx*_1r!3J!QQn}BNVM0HcT2^Zk%ACQMN=QNlb{nMc{2co>}5!emV`sGLie1UidZ z5Mrfl;E7rW)=;^exN31fCEv%^+%uOtQlciOS}`;;J2h;sEMo4Lff^G}J!xgz(6j(+ z9s6iBYX+_-B|UQ-H)!!(C81_;ib+P5;)s+QaZJVfR)Mk&>YAPzEHH@I915cz(QM#VXYa}+2W+|=u(xS2Kk1u0isv3D_ z_t!>Bi7V$e_4n0gNZz>@UfRc`kx}BI;D@5zOeLjcG@ctpWz{fV%{C@GD=M0fqgN8! zpDM~GHH}q8+E}{9PxO>YOFSv-C(lk%e62NYqAR-dy%iOVMo^1^Z`78NE@&SKGL|>C z^|CO~3d(7o#14E6nM&=c%`#Atl~+=;aPVy%rc4pqwPhbUMi-(c%T`tNnQKywQsH?Yg%x3=Y2cm4m}H_uoXMc4xa-|~q-5{xY-RN1@v|2lIMzf{s<^0hLTUR@ zXQ}do`vEzPVODAyFC*|Y<|GR>RkTzuLrE>`_JNU#c&D59l6~Q>29yeP*Rf4 z>zs%(S2FX$+V-*t8&yM3I@S!5tgH9ZslYz01uE&PDd-@8aU8Uu$#wQ7G&lDV^tI$g-BdyeoeMfsLl;u<^hEP{S zcX_5}8eIHK05(*ODebL{wG(}8)YvmzpXq!1wrn#V@AO357d5afD%#KK3}$Jxm5ia| z1Y?#lRDA>9C8)`mJtskA89JW@M^-9IM z#e9E5?H3Wlt-12@8ui#m$*;m~o|yROH|P3kSqBZZ7wRZK)UovK>uWGj*RALy(MYJe z$@aWJH6z!7?rIYaQB4DDJfper4jIk%`Wn6xwx8#DK8I<7`lL@ctXgUOnt)42CFP#MhXM31Lt!TsG8 z+DcLyc7CYiF?gm^+udoZCKq0U^%{+-9!ff{1AXOM;xZ)z*xzDI@zzx|vURaEcoCF^ zmZT}&S6|j?VOD-G*U`DsDqC|Af1RBNmDlhDXnz;vQ z@)dQc`kACedJ_Q+O>xoDwvQiePLov8Y#N=MnIVRnJ@<;M8ttqtsBWL0nJSHXDJ-W~ zSDpJ=VL%0cR>7j=4e znu!m!)mM;GHg}IDF()}^H4OT=r@qQdcI-!;XR^1ILsVXxkExbT1hyRbmM4me>2)3M z+A>~Ab!bRYu(_s=Cu4TPNM6ymU|^Qqq#+}h*^c%P4z$}CJhu*`P0xXw>0aZ7IpbTI?(ropX8^J+_Uj>nrk8QZybxnVU6iq9PMs)E4|g z!-~CB{Y4RSYSw*2Eh>*5#W!N>8f5z1HLi}_lPe+q3b3bQQ233J9XuigNu7-C+TD|3O>yG6n8ldYwrGu&e{emRHdbJx>0yx zBX{X5$VXOSaTf((1xsIU0ItS{6a`yry$mUdbAG7&678mw1I0QjMs0)rmYNC?*hS{q z!Itv8s+Q(VA8jMg?&d;tYFN~P$D#sueoPFp(lYi)XCG{@io)%z{8I|TZBY;3T;zQC3E~3ro#xQ+RI!6r+mKX*ZR|zJr~8 zqKN!D0Q(xL*oG9L_pv_3Rqd$*fsA)BdmLNY+g)E=)iU&IiW2Aa^r4pBIE_hs9e|yq zDo1lhDUQLz9*a-=%V;AqS>m5}3MB58BMIlw=hQ5gef6Kcv(qTodvs2@?suJGG z?2s8~qHP>F)R`?Wt3J1nyqYAro2uA^7odk(z9wpBLEI5jEVNIeWhbC!iaO$Bt|up} zZWo;UYMN-LCF`7ko!^hv#L6n`bdC&JJXegU#NLQBZ)0`K*8!L^WdB6jGqni~AMdU! zs;W)%G8NbMKu^i7=}*B{)9Qaf(Ne7`Wc- zoV?-T4qbJ*`0BxFCIx#Z(VIBlWTdPRUp2<)D^QYo%>Hl>GmUT7mXS$m<~Aj>GgN1}ZUfa|Ui&d1-j?Db> z&Z;DN)LM48JXe&7EbZa6mQ*^cF2zawnI+0ai4ISm+Qp(Hb$X&+Q&BFtZW!&=*q%1t zs3xJDzzx6>@z}=`Q?WMcrf!*C6(Mq}rr2kM$g63rBS1NZG+vgIUfqUeSR@BELsoH3 z1^y~37Fat=?=w)6j;b20in6hAi6f6Ts;a4$4zSR6^)yv|5mnip@1yeAY>4@aK2oQP z4%_BIe*-1|)Vj<7V|9xF)V`reg1VC7&brjBB0K~8G;fyHswyIyT3T-KSRt+X^>IH# z53p1>_0L5QsUw})`Bm+eNeWu}J=m>5qvo1&SO5+)*EaMaPR}rjJ&w;GC)P}iRm8|W zHtD9IMxB`zY_F&yuWRi&L}LFLKkNXf#yRNgxu!5*&CI@;WCsyYA89%j+;f|i2?J4qq_~3CLT5v{>(R1Z|6o4%rTY6=o z%~cp;t#0az+NmkZXl_ncKMKJ5${wj$&s!L2t7__or!$Fo0%L}e=4Ps38i_V~khz+% z54MgR4T(-dGDcXZg|C0Es8c^M>}8-~AB&~gY%l#MM%ax}z2z|q8hUNxR5FpsWHJ&Q zv}FvjLls|_q^A0Ej74zQQF6sTmYS)Eveh#3>utf<+5y?IoZr)s7_MQ;S)vYwJK zD^=4#G#WEKJw@*|P*CzlDQ*%Az*IW3G1Xn;nH^fHSGb0!3i2rxoi!yzeKSGbkBk$2YYtBIGI@_yLo!c+Ny=FhAm2AZ>uFv2N(#?V0LE^E{v`ls z;KthvO6nLhuiEp29^95J?8KuM6YY+Z)Im@ECwHVZ^IFG?6WoO)AGxKJ&(gYelw=~y z(D5?cobILY#Hqix{E3u&Q8xkg*@+&{bbV7AbAsg5&C%}Pp5@O8z*b5Up?MwXCFyR@ zb!}pM>S7f%jIiT_HTptB*(0qH0x(!y5P%mK1mMNApa6`0j!PcwY$z^oK#_}t9(U9g zRn*`}6atY%qu{G@lL7*QQuE5j3FMx}nu^+X5{*vAZexxJ2#sm#8KY4tbSkN-JUcKT zFsGuG%3u;l`-%#RyGQU;60Wv5x4wOVN~Lx-R+LmXk!cL_cwa_*cwk6)VRZ{iKUgop z{(^CHS$1?n?ihth8tF=j3J!@$>l-6+Zh=Oyd#5Lc@-yNC0|TOya|dv=S;nZ1zKo$; zSYlLoYGDnD#=wtsl@*r`PLSyoLUn#}P*_|=b#-}7?Zm`Ld0t-oz&MpkZmlY+tnb2) zcI6fp4Ng$#q_LvRjK-c(5;|cck%v0#Vj@F>gF`|>g8f6HYTJ4ns|%~xcM=Y?*W{H| z<0;gUuDY0**rvV-7K7SUniUin5SN}mFhT5Zt3g#0X-vvcjh>9Sdqh%XSZGmQH;us< z?{Cd5EFPLb>p*C(EUjL>Or{XV`b*1-`$ma0R6}}fT46Pr^@`A%si>~oG)kq;yFH3RqmOns z#D)h2M<%rPPtee8*|%{1?ETwbc9SB*OS)D_8>=tG0?_<#?2HFy%LW06#>$*m;im-RTEin=eiLPqtCEF}imB1DNxkD#26?O?EjA!1IIE-%)!0-~SksL5TU<#_PF36BFJIrp zZd4wr$j@!*Mf*IFOu{vmqbbogp<)MqNiCj$udOU>?Hfh=ReNngaDabYM#&ffg=p;6 zWD>r)s-hO#f$4+oHIX3!;qjThV?^#~?9O3wcT-h)O&ght-tP9|l8O-mnM|ChDZ=&^ zbR6|GRiM3vK%>)$V?}6z1A{Y*Yw$#3V`WiwOAoe4RNBNqYeGaY+Q^m7J=j$yHVX6A zU}cnwwsAL+K_;M+V_H{jVQ^qTT2VcjMkApa<45z7Bg10Tt7|GM>YL_nfu_-@ZPodK z0cgrP5_%bxSXY!D93I!u+*DLpHaI>}TVB}E$zHaWYIF#rb-)q}i<021`_#leB`!KT zr2xAH9sBl1dwfK2NFFTuWTPNks6Ej&25u)3kD zw4|=+_2Xq29&%8Hs6w8;n~J*cO^?&Pj6 ztMBL^?P(}1ti--pGcj0}m)AWs-c+8CjsmnXyX#A{ifRcY?90IHV|*Yt4Rs}fv8j1O zI5LGyMu&MF+Gqi2qZRd!;?eHi-%=44fT-eq>)>>6q)zF3AwM)VFy|}Qzu(*u=2{Hq9+@%HeomkJ?+gejpf!YN2Axa>U z@xysZQQ759bS7)Cy*e@^Ff1miscQ%wksUP!!66Y<4b9~xB|Sr9jpfBPZCDN64P_u)P4E*r*i{=^}6^Lce%a&S~4I+TiwD@O46hO&Y>>?M?bG}F>LJcUjk>r0PC zO?X;SSy63AANxzc1QKzgzPzXzn<)c3*dsXydpBAO^d@4RNY5ze>%piQ=|jg(P*7HJ zMRiG8=OCU*9xus^N1G_Wx}8krd>5BM!jDuH6*PB`&>1xJrWaK=)|D4Gc4BuFqrIi1 zqLDyhZ|c;Tz~HFH?lE*gp@wC!qrRxJ5$z9zvA)v6(thmgC|Gsu8p)$Q&4p#PoV%~f zv6dW9rI0zNF(lNN4RscvJ{^xbmX5gaV5|?SDlbEAGCGhebJ3a15caJR)Cdtf>#Hl+ zUkw}YYev0QaAZ>3zyyWUIACXAl)=t=Y+s_H#po?5F6kdf?Ew*;Q#F)k2Koo(SGCg^ zO#Dc9ac+L^C|U+mM}28gO*5HBAM0+&&MocfY^^{qC*rCKa+`Zb(EHU{S6W)ph|Y*e zW4)2L)YEHVhdiwgqqVp?DT{vr{G=xi)G+AqDT6Lm}6fu8|%f3aJowmviHlz>#18SCsCisJuUKPUCcq2SqDmlGTmKTLY-$D+Vj2s=3}O9^-J zjvc^rzApM_Lvtimq({bOR-qii9R~j8P&?3Fof#66h<#a;JM6PYB2&9-v+bNcYkS8y zUxo(YQ@}oVY$!=}wzILZcPnb>r7rA8?*Ldh2*8UA0`Ov5+yG1@k=VbcL-^>lL?V&j z`qjsGAfSeu{4e@NLzGr2i~ft&i;2C#-nW3*U8ksL`@>0_xRAF7d}?TiMeh^$$sdPZ zp!m!_`S`P7t;+ikr8f|Wl!dhn*bnvmIS0;SACm0%`cHhbx%(2fL5Pd9*w{Te3*OtY zYoOfgfp1_h54K!bxAiBk{_n!J&l@`+`(S?m5@A~an&mGRd)NDzeQp7JJ^}kBxlg%2 z0{{VdkwE}nObZOabARvToe!}4c<=-Uofz+G>lt4|8Y+LG_o4~=*}~VYFMA?173Vqn zFWcMz3~JD47(_p771NMh27|#J_^a8GD0Ey`vAViOaTktGqs*URZVu?*iHWhX3EbRR z4(=q}XPl>V&(X9PYzSun>YS*|v6c)i8P%!*G99hVFO^}_p^3TAu%#k*)#hjBmE*}& z_L#Yad1Fd!1ZM!}`Rkc-o}&NGjhY)c@8R1sC6FkS=9#6fWcF>nztoI9dPmK3L+4F^XE5o}HX3HG$@CfKn;QbXl)KQsO#RD4 z&e&h3=RiZ|567mSHw1ga88NRO3TeDFGpVYjA3NJ)Pt2Vw+x+@|c{%oI?%|s+cnur= z#^e~zQx5c$T{DLBbpF(@AHKCPuV;q-KQTTwK7swFPJKycRyp>qf%y}>p8nTEep#Q_ z=AQoY0G%F>_h%+$v-B}p7Gazrwmnw znZE+;r`U5MnK9OuZ)|1RGD4xgKFMZJO~A3&i$tOJ)Rm=XRpQxEkXz5ZxsoZ=;f|UR zA6I(^r@)x>-ZAW!$Z_n@L=$5Z%*~4ps~ZiVQi*j1sYO+7=Q?rR z;sgSf&KRysm6bQFAEEqmJ1@K9*AKaGAeBxpiS)8^PbN*$=gsf+=-1{iJHj46Z~k1| zC!E(ZS(GFfJ!6+78k6;_L-LpBbJKI5&w~cejYW+Kd8qM)l|gX__VvxV;d4{IRms~! zemwy?LC25gCxzMD+62aBjF4F5z6x_oljd=HNratqKsuSuoSXWs+U7sN;BjMPW7sp! zQ0(t;q4s^8!eF)K_-Q<`=_5{J%gi17c5MimLLX`=Gt?0}Kkbk5OpMp@uY7&1VfmWVF|zn%-I| z^hzd;5aad2F}9F3J>B0_?(gAb@936NSdaaoDC`b&?!Jj81^If7!3CG zjaj~ieG!IOm7Cz=Xy@V;Sk*qv{zQXQ2R3^Cqt`WX_m>M1ks@kb&H8FFwy?dq5&NI+bnUP*XrQ!UotitnJ z8H`^pz0OVc`Wa^aVxgyW=43;rud4pbAu?hKODxS$G z5!J2T6YP9kf($@r;ZZp*|JzRljk zvbdW#*i>j|Ze(a^l;psSIcx38P6j=n`sUH9Z9tGztgL|@Or$wf)xwncaW3czT-gn`|kYAT2-vAAZp|3XJe{w?HW2rV2=0H`?|a|H8V3Zw#uyS9c?du{NUuN zTgus$Jyh%mqOqG5YqFxPOiYbUOuQm8aAZnVM$`)nb5j$;7oJfAB<65^x}||>U{HXu z-ZQs|928klzk&krL~FLv!`o)gZWe~Rj{b>bBs!BuDoPGALo01;omSpXWv5CComQV2 zyw=-G3R@EpqYtA@NV zU1MWsSFeJm{+^nQ7v?4=My5Vdd1NXs$krmJuzh-Zx-mQ0+#!U_q7}ya7#SNFnZC%W z?U|gS*JOqn=omUVImkSa@XczTAAqsHjnt5?r1rFVlu{CHaq0AFWkdVgu2CwLMjLN` zVWb;Z);&EvS()HvVi!(g5Ys~3OifHoEp2mZdZx+!&gK>=H3QRAtg=Km6VFHj75kAP z29ptMt0Jdi?C0yKqidR8(Zym?DzlYp|OFnxou%%KY9z$vXLp2j_MpI8w)ctV^b@)x*j}jy!GV^1CM|pTT?wtm+;Z? zAy1R%VFhhd)6)$Z{(3LGM#xNbj!CDC#<<(0lyx(RgK_@OCZ?uF#-`!v)ifrxIupIK z=&d!f^-CNd?s#dXm)STnJxwo;a<%hHrccjwRc2UQ7#SEE1|$^XsWf)aj+TyCmKJJe zVr*(+8I@JToSsYzu`{%=cJ&Ud?-@fuiAbhR^wqms8=2TRI9TbwbPXpE2VWYRXEhE_ zPc!pl-Cp`7uwG3!6~l?Okcy_-YYV*?Cz`~`Mz@Rgj^|@jC)-OVQJ#=)ii5V<< zb#CknOLG%rLmTIi9y|-*mi5%wxVFC3(7>#!mpDC5PV}~O^a?Un6FG8TD6zbywJ6oe zGl?=Y)mEPV(h}Q`9DQSY*ngpfOk?#F1Pe=OVLyg9JIf-Ewlp@EW&~Y6eq2=3qIHBa z-dW*dV~!3RdA9DjY?_eh@10!4S)*%v$Ni9tY(bv&;ad{#9Ks=;;XsA5Z)i0y7KF!R=dyvFr zk_J3qSfo|ABziihSM*O&M#9}+7?@f)nrq*ZG3*#0_j5FjE5#1g`V4sP7V#OkhkG207~6#89RfXjzFQ%6MN(fXhp4hc&azC~u#fVl@;bSfQy6P0>0s znAEcLNGnSV6GKBg@5n(4tGzT<&)Cq()g!B}yT3lq&H}BziM@B^FqxL_uCJhC65#Fh zT-P|UxRp6M+22&`U}=oDms?mmp2iw(t8{y5g{C*LvM+5OK)VuWUqH<|oiq?)V{Y>j zwVV3J)?TfnH0DUXp}uNo}L^9b}w(nwdZ>kA_z zLkma$wjpc}AyFwK9n}V+x6j^?2uLiYGRZ}W{-`G~HMLGCXq9)`rxKswG~EMxf{Ynz>&PI5MS=8!<6;ZlO!v2y?;W52`_28$Bs@xs{7$H(c#lV>L3 z323CX=`buZ)oomHGspiKX;!cQprO#&*kM)8pdBuvtCV-W4!ER z3K|jv?R=BVCa0(StCP)*?D{Cop6VP2_U1yZL}O>C&l8y=r*60;l+o#gjBpQjXZJF* zvhx)S=j&i>#6s&Ge^ggop;O_ZK^EUOV8BI z#oec*1v`$YOjdP@yNa0C9L<$4foTH+o+ratBI9i8}{NvPu zLIYVLOLsq8a|27Kke+cei%u#@4n~bTYI$O^t0!kBiy~YsEu90r9G~l%B$c((nGC`} zv!9ctA?nlJLb}F2yYD@LFAfCY#RUO)F)ic@FbY4p!L}BjacN;bw$>)LK2ce*J|^xN zeKk=+H*T2OySh5Qloq=mTG*86^x~}mj9!lYW=Um^tG%tAmHwmq+KnTGFgsPlfXtcM z+3v!?|Bt=@@NeZf@7q2wq?tbtgMsC!<=)@Ip>^n&N=6t zKoTT!&X^fY0zi=XRS$TMj=gKI)~43pU3~S?AuyQfuCA)CuJ6orw`Xkj$^Kl3Z_EW| zbK1$4{GinKMeYeOX0oYgyt|bG;B*oIIqdttkAsf zRmcGL=K4yCN;2d8eZun0Hs@ePcvR&eZM9<<+GS+3D=#di0k>UQEEbO2kVg4=XKh(& zX}4lvp&58fhsC6mjywaA(1~yEdJDt~44GE!T{hIT+ zu#hCa!43mdb9O{t|2A*7HYB5px^Z4EGpGkRmaVhos=Z|hx9LQ=0}G0Y{{HAj-`$?zpOfp zac~5f>B|kts-C`bI^~;P0Z*faq=Qghb~cok6c>4Ud|EYi!YDQ(!_)Y3K~{9!o>bqO z<@f&6=<4d~{N%8Y1Jf@Jt{Wm2i%B`vU0+mM8sqy>a>XEN5=4cDEL|F%PHTH%WLDRz z`Fz4BAVH+OObiZ~Jkhd{wWCErwe=|>UCUyNaxXQ)FFGZ6aABXcIqViqYf*xKSWIo_ zs0zPw8c&0R9uFO8ptQM$)a23;!AAF6?|z(DT3uC^`{2QorsYcqOIoe$Y*SKDZYy;K zh9#O)BT5Fh2WpeE+h*jd>S;2mI}X`YR*Wm z9XOtaVje+u?}jqNY^7Cd#?yh zu6c&E&A#4K;1gXSkV#vzBjU?O98Tx?rn0Y+{_w!;!|sydnNxZ$MP0in61nc1Vl) zc139uB*YA^ogZn-N{o2?)PG?0^7=}X77*09EVav)g1p1_l{Dmzmy3;F@g*mlBM|{f z64DMv9W0J+7~VOWto+UUkBTd5DvC2ce&{!IrdsYS@C^tnZRirHaVt$iJr>q}xzgqv zo~9t}SI(=I=A4M!zTJs(|I8{gd+o~K!0nI6nq$*CDOQ>u95A{E?qQp*PE4W+UVqlR@82t`tf?%_eE8`8IM2Xn`5m=o#U%y4_wThWi3Q8efk{PXhf}uE z`7|_9f;)g=k|g-BWwbmly?PP?ih6%AEIem_bK=SSze_EutST?@ef(kV^zp@VPmrH~ zc1hh1Uv0B8Xt^yHFpHIt=0*5JpaaSI3(elqg?jB}dTP|x`EkPIj{_6)s;eqvf<42F zdTiI$ovFT(;*yN$ATR$?k_R!{v!g+?YO%e;TVp-sOwU_RM!a@Gh^aF3C&2 z_cUT#EU1o&TRK;E=SJjqqV2x4XS2cKF_$K4siV*@Ahe{e>q2$w_5?{Ag=--pA)8Xd zX;Wte1lG))Uf*tz#(-ZP3|0BZR%qB8hw&mN%wzCSC*2qf^YzattX$*CY}ZagxZ)e= zyREs|@6HZMsKu|Z9al_eL1b?K@@98QU}hKim1=J=BsfI?w90%D73MXue^DCxzDIaE zMD^5g&!C*9lhwY6pmYW8TF4sQind61!u=w)6!=J4LU!xiLQ6qx$&k%?BRN>+a)9Iq zA4VK1bZwc@Mg3?OhOMrw$ix~FI@IY@KtvLcza8+w`%zgX)m7!eK2K7cW?0+ps}n%; z^t?%rz`%V4O>?W()2z+uAZs&2^1GKHose#J1^L8+FiTyWWdM1qKhS9#^IN)Xc&deKT918CyCCY*x0>5gd>zlpO|s^xJ4I zxe4=pQqZ+J-&+`4+C|%LUt0hI%$sYxcmGjkV@rKaRej&I9ye8`2iHs-Kxs>j`2lI2 zHq+Tw3J+;FJ2v zbJ=!JKzyE-zP6f$@!^5fhsVV+!5!Rol4lFeK?!-TC%~W?Ot9wj;9g2eU1NQ1Ywws? zPt&UHC=cIN5$3#M+EV>Wy0@15aw79P7>DEf8n2BHD;eHdX--Qm9|buzN5jEEDMAT9 z@Zs-6k_)S=Dx&C#FlQ+?h}Y+YcjR#&}@S(5a@uRcw$ zgQU14KkSWl3&UA&Pr>BUs{{}#WBNV(Jd)IWx&p$M($fOlauqZ`yPE^c+_Cg!vP z0rvbfU{Odo?dpOM&&rV#r_(V~84*z2Yq(tU{Mc)eZzPp_(SBZ|$A-hv67TpTlkJ*R z9mfUw^{fe4OqvrNTsL`m~RD#T}Ja-(D;#0QZ> zMspJK(Z^L&r&g9U8jYN_&^Ep5lSxnC;6ts|u0M!+`gHt2Yr9<_24ij3+0OKzzxHOw zEXa1VKUU=zo-M+x;*GwbuoQ_AZ%hx$>s*C&tts*0ZP27H>=hc+KNpQ(NQ)n8U}d;jhZRrrPH$O%?26`b+}X7t`6 zVPkY9Q9gxzyEk^cG4*M9em7;h4D$7wKGnfE-Ix`a(l`ZDZFZHu@zdW`jvd)tFOI^6 zw6-eFuWMCwHrt$-izp?3s`7qthFEfx9-FYMWUuu{evhBbo=I9$gUb82ZLGOE=6*nK zA7$Xj`1lU(NI^rVd&epRGMI&Cm4_37{$U$Jqe;9K5g58G)b|vHCDo5Vs}Z*`;HXiF z6(hhxM@mDV#1~OErZP34cyQ;6F_p(X@z3wa6~O#8u>&h@s7;M1?%lHpXYYG??I>(cMw=OV zzhe4itFJPnas)E<_109+uwoPN1SAec>MkPQdd;J#%jsZiQha{%DC82qcIbKWzA-B@ z;%Kn+NkpmT2Chm8h$sQ_jSH6oKY0S(1RR;9SIClXbkdEfVT}uy#}nn? zfo8iCmu~s{1+1MOCkOcS@2c$Xh~FD={P3d2=WP8yf9J9?Z+Q}+`Ofc%(R5W)*BtySA;CZ z^S!tIQ^n>hhfPx&7Tmw7I6>Qqm+C0n>14&5pGJrXw!a`UwR*~GqkD3L9|u-xRhxbf zyf@_(DcuS1_@rl7x!YY9lif=?&|a^M)iPF_o!vMM9b~3DHXyxSFWm|94PHDqFqry? zCp5|T10O#f=NVb-0$iwO=JIl}-ZL^w%QzU_d3r=>@0y4u8pL zR+q0&yjUgA4EJlAIkhup-tn2vsBOtlsvg~k5Y(LFlTbaa5}mH?o?&PK1&fW8XZt_O zX<4>e@s6C(gsKUv=^{SXe@kZU&5r=LCv7(A*|Ab@9IuQI$?mdU+m~Cj9(d*HE$XtQ zxWO&C^TwR%cdvSix7kw=l3ZQUZ5Ma?##}ofl34J4+uk{H`mqEBS^5VRoP9LjA%Hx5_K;kaGI6D`rT=Qe0 z3(wVO`lqyzH$ap6`~zbS6@>O|AtW$jS4k|?=B8B4GQ??;clf@VoTyBQDeNR!cCn)% zG_4kThvIPXji3Cyaq858Uxwa$EjYE8ays?AiQw26B~I0(dL*}@y@F20OYVHVV|1n5jFTP-bvIIQFf;j# znem@Jyy&1Q1gkO6aoX)ovy~xkasrgRH!O{k#kf})BpO!^_RySc+gljZ!CyBBj!rND z%z|~A_N!DF8G6G|J%SlibL>zrz(C2?VD6yOSyu5i;z5=!P~q?Qdeo(6$8VjctaSbXkG)EJJF=XPKC z3Cx8ny?aEYYo^T7OGu#}Kz-#=-d?>{IBz1XQ;*wq-&r>%g*;^6bxyX(yk%yML{-QL z?S|I_Z;YW@HxqAcVqRHD(O#DMCH=?R`P*JnCQ|D553;--eFnzFPKL=ccf^ZwUZo^( zXk+=I^T!7n)UtxG&diQA$u!8oJJ7nE%VN)XhEf5gs;evM4snYBY zZHbV$q?E&zGMpViLo+Nawmk69U|tS86tLtJqlVLGGdfn6f)qdpKgm$ug&pVKvvHS5 zMdLd+_`f)4P@^6}{5@$&#r*{uFhw29xcq;BvhhHN6VW#7+7V7u9s{Aety{YfLJ2^N z_b?_1*s%z4F;E2Lj+22@6Jfh^4ly+Uw8<79Mv!=Kf$iot2OlY9BPJ5Cgr&=wFjtKm zX()_|FKpqABj%5zli9TN7ettpNq00? zi@N3#^-m}4?D-x!FQouQ$j1^I;FOJy8I;9_jyCZN!pGC$CoILtX){Nrwd|-3TTOR) ztbJv?Ost{;sUlt&`izLuxp~N1Ay~f9j}Jf7U-hM|vqZ)7`h)Bo0^pVPW?6CXbg43? zvZkQyVB^CL^FisMN*z*y&tY0~5N1`jpwv1J91WVt8=JoH)8yU*_ApWF5<^gt{XbL) z$FQZv$uR*L59=x2Kjh1$nzjpK0bL9YP&5&AEPuP%D2lVRRQ7{!GVh3|!J027?c>A* z1EL+L<$wBWvA^y!fw~9w{2?*>k&#{1YPR{Ch`hU-WtfKs)RK28iofF;h-X?bx%EP3 z+nvrVg!!Hm&m33#OBEAzd;w!x2!9?UvxVBsoZ_>QxH$BTUR;U(FTN1px+V}mqPZeh z>G@)RW$;1f3aYap3D+h*+ujn};tgOu{?TMG1fSG#$!C#{;zvWuT;Ny$2O)vJ`KUF^ zv9l+vi{EjY>AY^jj5&({2|r{$biS#vX3E@e7I~`M+@sS4l84_6^raYd4lQKw5uLne zyxI~|Yc3I59D4Swm;PhFn`A!9T6sbX`3SYv8-K5D zLzntTNQ=(rbZcq%dLOC{yAEIL>&Zi=BZ#!ELPiPR^rHbHr)OFkw;I7(fYPB-95cPk zjMY%I8xLDa!;`m_#n;wpcxC&JsgE}e`T(_tlCMqW=2|OZ}9d|1P^gEET&} zUMBpOfM7KNYT){D-SO-AqIT$RsZf;*|5%h~2GaXSFh1xm5p^~Zh#<+*oX$a8|KX2X zlHgeRPW&eST7^)N3E@sq9>C6|un#Elx|37uISdiP=x!oN*SaP;JmC%zuRjAlO+zr% zK~O-14$!)OZ_5p2zZ2H*LQ*qObiMtpzh3Soc#6LbM`%zZ36ahLf0#Vel4L#go0Alf z`B{>TAO6+VTobL?$y#7#h?7i6mppcSP=rq9@l9?_TzX6nf;~}@{WW6X*o9635^5P| zrsSUyb|7Ta8vbgR3U>b4N+FIQR z0TkLP!dcpbSob^8tJy7=Y=T~dzWa!q+YeS4pgDmK_&q9P zVGP$__wQz+a3JE=&hE8^6vz(;pQilbbE5rVAk8Vj`KT{ifOk;RVQoAaD|2~4$n8D( zE!zido?RY%oZnMrW1SrP2*ih4*p`+t#2``%KBtkVjPQ_QUofa1RU*oDG5nA#&fp^#TIepk`)?D}yI4wA^H&QGAG$_dN_) zD^jCrZUbM^Jjnv>0Ot;j?0n9Y{1B7M_lZ-0y`hk{p)?Um_nIG`BZ?A|;sBW(A-+6GAzu#D8HThHF@;O4K}&L+>YMzQVh+x>H=D<-SViZNS`=Dyr@{S$KUxMaEu#V@#tzf1z!kWM&! zjl{Nj=O1${1^?R|9*_*Ax}hisRUJoe#e^Cmji>ax#2s&q2WqZmNdjfI{F42(G*71V z@3L#>*DykepfFk1sxSryP#%icdxa)I^X4XqM?q!&f$B3QtnvI470I+ z7rq;sy0w6`f9z5(1BRu>s49wSs7FVrO82Ox?cv54DzS;k_mHV04a?Qk)L=dN(BZRr zq_)eFa)>TiOF^mcBET0Z|Jp%^)1jI(hJ%G6&iRkenwreK@lWxQ$Ua4eXLHZGYSG|= z?c|6$*QT1v`-W*z$ODUgv1cNzWP&NGup5H#f*UfZzAYr-`H1p46|C6M)B_3$dBmXi z!%5=c<5W35y3thcU5TG8(U0c>KnZt5gVE;G6r$@H!6-ES$bPq)d`*n~? z%kSL7PFDPzMM@`&%k2IVz@PNcO@yq|)fkHC<%OM8P;!lCHez8YoeC18I_%$zl=T-J z-q{^aZ>4OT^YCH@wm2E>!NeFGl2ZwaVzs8HNtbZeCtM1qSB2KCK)F;lHbYBJR7=Jv zFgdKsI>Y=J*xs*?YYc?W8u75wgOP9w5sD62#x6zRtSZy%6I-_gi4inI-iDxQec3HV zO$>X*&`g8q7bXvUBs|aVL?Cw*aRl^KR#lKBQBtDyaWX#vo?tG6R&8^%3j}@$2m6B% zHZhTc`6+jhCY3jGLrW~^aoFLiO^Fz0YY9T|yG1ucYv-V~N90yYxM(hmc?7n(Ci^Tx z&qFX&I9s@?lrrzI3xkmU`17MoR++$D}Yr7%W(Ij(J9ZTn&?8^Xc$m{aLzO zjquKV*0f~0>rLPpY&JnduVy-E$|k*9`KNt5=7ZUCF_{dxFEGtiwi44uNkP=+Y2MjR z#@aF%eChDb2RV7By2VYnS`CI)Lji0f2#)s431*m!(#grx-%fF*M0so(H};3_S_O|s z3?HnxuCB(Y4CJ^qppom`3dALKAgU}PVWh_4&P;RDTFP5cC%6smv_iOipI5ic#e*v4%M@sf^$- zj$e09d#O-id2N<+H_s?B!$Npx_1JfYmq*dK*W}c^&)t6R1|NdCWRTgajddpgHs1To zEZw-_gFV`Umj)hcr49!N$~Vb)wmD?n4BonS)y(VtjK7u%ugg??Knbpu5R1XJm08Rbm0+X{U&Rn%`ify3_$2QBjyTk)H}woRBX4mgtV%9w?27@?$! zu)*0mY#VAMzkLb@k_cNdX?RH~6){q(tCI=o zdoQ3k6=2zR*MUIbELQ=AR=U#o`+0oyq%56}71UV6lQO>V?Ohuf=OB0LF1Iue5Dwu(cFrjvCd}$s=8FWjHJW_2u)FJXMHG zRuUQK`1^#>eb$*jN0WU1!gid zl`Q)|(OoK#Z!4DjkCg&t>KPN0Roa`|mH*;ya63tsz%%cmtcIF}XodI1!#v3~310dj zD=p?R8g4r!f~}>SKX3QNa3#xHJj~365*V||l*>E?L5NA?TVcXgQSfxQIo1?$k{9F; z@o&achd1CyEfuA>(7`GfDM!t!MO$ejpFB9&`wktB8Y>!`uMuZ0-f5MVk)g8-cFnJ6_`F*lghEvG!UG3rJW)G={Dd2nQC+zvV)ZUSdyN;GP+kWd!p`FLhE0qI(K zb-GjY1HSuc9nE80f9<@UDfY$9n$F+@@p;eJl7T>s87<EVPoKvW8 z6dZg|?lM$XG?IKGLB<~MCQr5k!=sBVxru8ZTF0(K?eZ7lFY&K+>OdM&-k>tGz|B~~ zSPBDEC-2iolMYfNo1c4RD2cWvq@)NkwQOi*Cn|8vD0DnD&0TH2ZiT1%p0>`HRZCnw z`QEn^9!Cy(LVj;Ids9y0)59yXJz3k*Vf2SCM4zu=+1SV`THI})i+h<1pFbAVa}Tr` zh~zF`K3+#J$6+eSRWk$`GoM?m2V}0|mH&~V*3!`X7JS6jhsjnm3PHBYwkH{+sVmUGZfK~l>Zp7ne+Iin~DVB+qUNvDYNMzO2r;e#2{F1^!B}I zk1M|q8BCH!Q08ks(%YKV)YDR$Bwcm)%|W?ZUu}~MVY+Ysb>)LL6C!b&1 zn3-z~U2IA(BSKjri;JzRfY-rICp24yEVZM44=*n><@>)BZ_-MF@&akW9lM*LLpH2N z9@6TzQ|R?K=DD0KdA6-Zq?N^IqaF+C$6D*1&|zIK-izeKrXEI}-xglf#z^4=K&nxi05@8u-ZH>Oj+2^mf!_MVFkAmvFEz2j(8j5G(m@P( zh9%jD8F6v@(}L~(uMvo_;0OJ&Qb21?14_hzpuFnBroWjzsNR+Rrur(Aq0$=b{u+<( zOseJUpgSwtF^WsR=p>1@?aiMtzGY09rw9yW)uIW-l!KJjPGb`d7?UI$7q5_hNSP(J zC3hi7Y2B?uPbp7n0Y00q)*9pojn5OFwB-XsM^jZB3yY^|cOQfAamXgR2Y)6CWuopc zbTNRb)6B)As4hY0xc%Zo&fa&@*FM@Yj6eD`9KMG+8yp z)bF+D?V`+(yi79OeZ8L4|B_)N5mR|t0P|M~m1L=Z;AOCT2wT$_vvB zN3Tly>oBpi+~IB^QeuicFN^kRaFC3(zOf*f zccLVXBfa!qmWGvSi9IAI*3D#G&i%D}ZK;nwpr}Ay9@-HK5PR7VR&Yr{;~L>w+(|gS zL`__<&z}q739Iu2olq#uW1)@8iRW%HPO`PEWp{$Nr3kgS8*lXD`Kq5wNyQ4*s&3ey zus;}WpaS=LOebjVx-aZbvJv@9h&nIK(R1{jvrq(ns zGtRq{P%jU6cr*bsUYO9dv(8S<749kx`i9);F0;wk}lV<#W)(YH7ihaonJ)w*Z z(QPl^qZ~C3!MWrg=&N+T4#S5Eu#uC22c3$jhl)UOK_$%76$TGz&}CC2vC?>yvY};a zPdA6dV?~RAbXXD!=?&fVOkMSjrL8Spz2rm%=bSw9v3I`Pa4cNB;Yb+Ti@!}=m8>CF zd&o>}ZCuormTvuIJFohZnzC+oZnl!zbNfJa8c_&g+k2A_hvoi>rgaOVjOCZcj~iK^ z&4!1)JvKw3{syen3tGodt8H<}y`ClwG*7Bzg=mk?O@%+rCJ9P#%PR{Ac?+ry4C~pp z^R|>_?qr9?K=Q`!=NFuSy_qyz`M5OKLpBr4$L*GY`;ikgwo0z#Hfcha?i1alBG<&h&QbL%O3q= zxu>4g)8w0aU;6W74%Ulda~mtRnRNmlnS#Ximyfm0Q@9(2dhr z$75Rz{o;x}d9x5_1#(Tb^FFE=^1^<^#u$R|axMoBZO5;W{Zn$@rTsnj&wMcfHrfc* zOh)>!%RcPhK!3zhg4CJJ1sZaxv*Wzd1U_(X}$BqylRTv zdAJ5%7Y%hoZAo1TH(N`!h*(00h(nHrJ{SogOGZBEl=SC#UA`Y)%Ejv|Pv(x1EQCVF zW$OI5uwDd=(yr9^qromq`-aNt_L_rPwev$>5zZ-WE7ikmlu84OyZ?T`2v|OUyar44 zZ=M;xLvzB;_T~Q>Zmrx2tE}}R0J|&>OC4Qq53yL>Azk3kV)H{?XpY=WZZI!Z>NN^~ zbvD(Ia6g`I3{kznC?H>Ic$h~mG*fmia{zQZ0LTv4#!zN&Jzrm2*Kic$l}zE25)H{` zuPpYSkqX-=q~s_nuFNZkCrZv)*6hem6MApg0)7}_I*8yv_ilc5$koh*Z?3uo)U3jj zQ~BN|xS@lIrY)4Vs82~oR@t3Z(n-_XWaXd3Z+e@#D?46Y3yXMmlPidb^6(w*1m5)V z5q2jz2()ZyEy)h;Sc`dkYpS`anW$V)$q7+C*6taNrL}2VQhAXtQ7Y=CpustqHa8vI zcy*mDD^oSLZhk$_g>1$h-k$%hS41<=Ii~m{O^2D5K^N(Zow#C9x5Jaf(Q*)_Gm+#_ zGTp?|kn~$;$aKIZ+D_Jo!RA9#+y? zaX$?XNK(zniw=*@f{F__nrr7Y5_abD3ZEk4&KqgF;1ID1GHFGZI@H~RWd?6g{n3C0 z)In56)B#7!!iMK49nXroE*Hz!40PZB4;Qh8L0?Bbe~iT;j=^ z7F8$?$aSa>fVcouOLmjn;t|$c0Y@Dpa`Mlp>Nic9$vPe^?>JuOP&Zk?3B(_kESA#Bu3E6hL_<;OveS$sFUlQlUf(U|d=#-UYBO23J0 zie}n*&5{1V-FIgvKdK&@Ek$j^=C@Y@Gf+r6vt*%XvG^2wH->=$c3=;(2i&!{9ALb~ zP+TeNGY|ki!xO&FAJ7E$zm1!Hu&3EzWkf;-dr#z{hJgwKmP0{I2wpIbDX0YyW7V}Z zrja#EAWGoh6_vMdW^1op%X>T17 z#@$wst`-D#7|MXn;J<(zGyVdo!QD%@qF?tENf{!43$6sLA4+7iC>L7I(gS>;O|nM< zuF+(m4z(u_tgq3693&0^#jqHytn?n0{PGdzUiGyu{rV0QF$e3&FU+#cm8r>1V>CS~ z>GQ*_bPvelFimxx7WHY6oFE>F8_}joUB$flxW%v&10q_5KW09qJDPZ*z<@u{>Dauu zAropRaR?p6kJl0qvz4+7?StPV4)ahlUFe>FsB~MTKkLia`(dUdyf!x?@98{%jF}xj zSYt5Ywq#}8{bVO-053rb4=&qQqk#DAb(qFK)uXwSUi&5v@h{b6U(9RDrXC4^RkFis zi-WXeeh=6^$f?Kf55G?7?)%SS+Lq;L`7i&;`+eP1XBn55(+s3}L?;aA9QU(2MWPCD zRw^-Wr>NBo1}slak&lIn9y_!t`Dg!2XwIH4+*rUw@JmFL)MD{hAcl+a^MwYE-2zOl zVaQy=XV7!G4%DjDiVA%6o+VTjH&>^HcZ!IUXG>r@(+ukRnxujmL=S~B>fav|MLstf zy2@Oopeq=it?N+MmrMa;eQ_4e>fx`ynn7UzpgQMTub)5kV zqaOD*K@Js6&*x=m4LxX~9Nh%+r~twDaji@*?4_$uyojlme+ZrCo2UP-$#g>6{*vb} z4La_-XyStzP7qJ@b%JsD5aCZnmjFre$eiN?0p}nZ!tCmX9arJX51wM~ZTkV9%G*Q( zM}<<*MMM1MR}+4TNC+GYFJ6`f1ro*x6!xn%wb$nhIDlx~_j3*S;FX_z+R>^>tn|Gns{t(tio&!Y%168EC%(WRe{DuFWGI2PvP5sbqB@fOWDTd3aGM+oS0J#~17Nd+`5MQv4HwN;N}Oe;@Y0PW)dV4x#@BBi2Ee z|MUOWn}z;OLfQhK|6`+nFIy-2S9t~$+yC0eCE~xf_)QqL{d>hfYuzCK6$F2yy;nCq?ikiyz0FlE38pzE!?B@0&_p9avYDH$qrRr7Pki)u0!u|)`sCEaT~K^P-^Pbh z&Pwr$mfi*z+Aey8ESs6>Li|DS$%YbAG)hy2 z%YPX4o0fq7_Y?f4k*5}4{T{Nq?z{PzesYYwZF1RpZ`V0jwl!kGe5+DeRq<@5oGh&> zeckwd8BOe)dJMOH9kpGRLraHOd}jIX`S}87O%?GwzdEWqFx2c^IH!uJy6zAB{+ur( z(z5wpNPVTRwB)2*a(h2y>3S)W9!|91@_k)-wSdqB%D645)yp17j?TZ)`-(~hwT>{!F(?1m zm~HXxgP{F=PAoH%?{kxHL+TqAu#Lu8<@3E8s(Rnec;3%%^1Jbr9x9!)_y%LWuOH9& z-gl(B+~4*NS5RhYs>WbH7OePuPm%~eJ_Uw{vA0Z{?vg$E-1n07-g)))qUX@pe-!RYZV${0v9vNa#|01PwDxbcwLo;k1s7P?N(&6bv_g{@jZO(Z|HU0@3Fyf z9Zq}?j)Y67Xu0~lE#mV&Nn+!J{>v?o(p%uB`(~>?06CyuL+>eD_dniwHvj*KuNZ#x zK}8JQrV}GyNAdTg__z4hsoTFln&FaDJcc9NwLi>$d63u6O0PM<3Z3U%o#4 zddCV^(yWjd&RU@t9JIjPXuS_g-!KOLr$6*V`j;0Co09PVLe^*RTg4o`9q7`r?zM-p zYM3de!?2CXc1zQN5&xenzli?rwLAI$mv4T53jEiZza8FxIKbweLA-y{l>d(_!dn+O zatF0^K)d%lgIKdG=})x z=A=>QAucV!mdlq{Gw~`v<`etyT-{>a36LW3+s8FMP#6hG_q0Bv1jDEkyJkh~V`UPI zjN5_2FU$i$J^y5_KNuebeVxmtJ?fsp`ff+^PvlgBBt-{j0n}2E3Wf>7tiX_h#`c)+8wQAn$CdZl zVo}FMlbxC+Xb(=RxF$aK^uzXj1wP53-0-QULAko(fJ96C(3LvEn%tD=g66S zz$FBwFaRBq0ak*V`|&~25a(YH;)sCfy|IQeTrW=r+s-2LXEORRMz%o|_f~v+mSK?K zoM4!REW5HYxQC%mp+No=maG_wQmH~92x%@0|AHV3hA0mROp&D`N%x%K*4fn9usQNa zF7XCb`%|^Kejrgk$EU82(@=_crnrTFGPa9ljkqbp9*ax~>HEfqP|KiyaUu*^o@|+_ zIB3xkF!PAI^l4t8PmUl2u|O~ADmxc1I|Ofq5>BKkqC~+=0M)o?hhWJ(&IIWM=0g0( zhfpv+h?h`aq$Oqjt70iQ*l2X&_tlv3DNZp?Knch|&|Kch_1w7F_w;Zxg{ZDFZB7|H5eZ4%kh*q`KX3tE^ zvLK^;0RH|Q#iX2^2{wpin>1N0#2h96$TlK)#UiAnzIj7XOnqoO#FFJN&%nocH+QO7 zAz5%NBxl49!Dc`IbMb^A`1(8r!BoeJRN}}ZatH`=Zxn$V)wLaSC1u6BnZaCc_|shT z1Xb7SCO0C5-w!gL6~M2+ipdfciso>ldHC2RJ6X6H-&N2sw%`+IEYKrF=5l6-$q{{6 zfJ7+Sr_mETUC+9kzP@Q-q3%Giw2k0c!uKZ%njAuYS_!}~fmoZ@h4 z`)qR{>mK*@W88?qK@7A7rgw0 z3J5@n5i#$XAW*b$THpKKb>oC&u1B&%fO{vyE{||bso5bqz!g;b3$<^VrgikZ`w%R1 zV^9%&ZeWBL6JvlUK{s!vWIq>#p%ThtaHc0f*hKj0mSGx-j+=*@7Xt-V=5G|Xy;#)y z^EQ7uYb_16`o;V6OkbP~B`6~_+pUhRet^Hg1)S=Z7jC0tNso+Xm^!qq40EI|ln=pp zxWFHw+_MMEmh0_nP%sGK2aQSx_I~=2fsxA|#v^MA%u_hek%N<+lb`p%(?INK_f>Oa zV+)(5MFs`f@gmVStODvk?1JojQHCi2K$_6LrSTDRQ_q|jZOl1VGT2b;U4o&^s5!CW z3;KEy1H~#5CeZeN0EP^_t1KwA;b21kfGeHbM|imh2FcjJ(4G|iuCRgb@P-ysOTP(t zN^!R!qDv7Y7C6nJihFyxIAoCek38k8L0-YY_@@Dq^^U@99zR#1UNM?OSa&a$q(SkG1I zeQ0RD0Tyh*Cj4PObASz;2^ZocHadJ5>K9Cx(kFj{7vWP&YbGJzBUA)Ru~;tXi}V*6 zqze9m0#c_*0;&O@vouNZDz-B$wgX5H-~BqGH2ADw7R%n5JLvp#44WybfPI1!zh=QN zgcI?52Os)mI*v%((pj_QI^K^cv4=hKH>a~_gJZBS%jzP$$P}9=FiGs zn8v^BKsLc5w?U77FnDI^{z3PY`mH1dhsypVoORlXmTcmt2VXB2NFk?4;7Xp7bo&Rz zIFQjGOOgdp0G5mCEay@@uI4mNvbei9<0s81R<{U(t;*>v1*kWSDLX`wSVP-yhVU$H zYlZbebmbGeE5Y9==8>kDl9aq#T>kdq;3UlO5@2-f!N_!RC`hKM%K7uy-JhZr>niXQ zt2C!|LD>i>mShH`!ASk(2ZI6?VZdnJ+ZKx%x0Cd)g@W%!i$5`=8q@ekLt9^lAVS+= zNPM~AEiE7Y`KQ`H@M zxk5=n!^I4yv$@;xtoXsJpKKrprvHvv41H%&W!?Wute=~p7-Ux|JZ?kzyvVD&$Cn$; zURS-qRTn+TE=0Pky1pC?^R~?&E3!Trn(XSB&u*6VI=Z}_6|wFo**5Rdaa>BWIzMr; z(xpBthv>WTRJ+)<_8u0lI#!w-3z2Qj21OfW&h27Q{SK)4j<*yl>j!7K{2pau+IJ!j4()snxHxF% zsPbO)YcGqoUR4dYIQNeknlE zb>3X40gj%i-nTptKDI$N72fyQbbYyG3pu@B*Q&r0r#Ld)2f6q@9Q0Ra1p5%Wo-F6q zPo#C$rT9FWof^Nk-}F3VSI4&i(J(O@+hJtdpwIKoOK4ADJ`bT8)I&xxsWUAyOc|f& z`{L!(+3$FLmFl%s+`D=H&zqeAm(hju&G}&QXm5UZCg&uy|%pUMR5zs=(RHu$#?hJAUIJtC@UMZTKAfl~|1;Z30GJkH98ga(> zy%yVOoPPKDBn}Lq!?CANPE6uf<*(LF2y|tmqMg;3G<6X0XrKbn&zOm!A%?BUiPZ1! zpEgp?P7{7hzCH1;MvrGdzplJY!e-Tj7XvSM$rl>Qm>KBCMHu$Nw=|9jui*ABL}%v< zn#1|EURuZ(evWdeVBzSnT5ikvo$vS*J8@Dfq-Q;CN4w_|)0G&)qBhT_@1iN$8rw9l z2(M)nB_zc$9+b~{uxgy)#h27_+DW%B|L9tQ*^|@)_({_4ISWpLMowA&gpe}Ig?Z!8 zj2O9%3EV})wy=!7>TX>1uo;K;)aIB-qkw~&IBs_348D8l+~E*a)I#0SVuM?)Tlnd2 z=2BVpt-A74Wlo-~5Cw7o^P)Occ8|Nm>?KIQkd~|}Ml7}Q$rQRtTxA#?S3hX_|p^k~B!)qIF4eAbI zGrEnM%R*FadAjRe`dnfMc!ZX9kYz3WxfI1|drpBdL>sA)o`lQbWXp{??1!idThRzu zKu+2*?A#gI!#qg312938N_Lp@5E9zUShuz`x|)F*FVY^fX zd>sw8(%?8jP7@@@?&8&n_PRFmhx9wqkKDWD~JC+}-+y!k`fhgIPME8Zx(xV3$|Ql`YbhLM3=%*G8H0fL8{ z#4U!co$nqH(CM5P;rpy>IEJk~tAm+3+nURX4Ff6N+MQ8uJg`@@H8@}rJr(+E4#Qqh z&(~gZqrI>ChydR)zs=AgL!Oj%4nFjRX7Fw187u6L>^HHaifhrOIX5qhnC<*wkjJm_ zTzK}SL@W(<^H`cUUvEDNK@Pl-^H}l;rz2MClif$;IQhVtNvm?=!8+4$H&%t6ovea3 z$Jt#GzbnGbfYT8;xyr2ITvsoctKdX)3E?};WSy%~gg;f?J+vlPIY0()iXI~SbGw~B z#{(34Ly*bys^s9P54L>`9W4SoB7NVp+p*A6_0$mo^4Yl=Vn#`yHDH6(MUG`>BXdD} za}$5Mr{OrxoVP#V9_}E-JaUMV63AtbCO(CeuWGNV9YtO*}lDPVBP9gh6_mg`K%U&&zbR@ z(TK2&CqqV>wg>ldvbR3dgdzDGCY|o%yGsQIaYM`3B}%rKxSlf>QT9H`R%lGX1<>{U z30L3R?FqC>C)hctBh8NZj&J4f9_xS&n7E={8g*e6+(t<1P*p|DT(EXj1&g=s9 znQF7dW-Zb#C;JpKAxQ$ka3Vq+7gx_kDN*{>_vuriU-N0e-#&XCP@G)|` zyitY1pn-agx^rASkBbm-C1h-u7{-%m)%+3SJrKG7Zvp2F7mUrJ9|$K~>UiT>*-UF< zy=eYyYGMCSm`b+a+|0GnmwJtW7WSSVvja3^9^DLErD=GB){G8HpeQNoUSwY(4?M!X zHtKF0PfHB3LbZtuRmrM7uhv^Xv+RXECq(sqX?p7Jv%Y6 zpT1x2AYUP@MOs)Mz1JhWGvPN#)_Hhe)`vV%;Ilui+v$DIgzm`ey@! zujrNHL<|1-w3E}n%e%fA`ZH$=(*fYH!oSQyOqytf&~htwN;g;Tk{abcjD*pP=G<}j z&)SHYA`|;b)nt01U>+ztPw;+UWQJ}kNa8@}q@)n{ZGAq_v8^|M!~g$kE82r%u&pzA z$hq=;qSZr+g(8HKiQDp7__{WJ$sl;Y6YELcOPK2eF(N1b-MSxI)sY5%a%Si<+_d$u z10{>!akHVv6NwK<$H&6n+?NoQ#P7J*CEPbHt$0-H{FD=Dso?o#vGx3_hK)X{wuYRA zr2pHL=FVm%U<8d!pH%jUfANF;{%81=Qn;>ftPou z+3=ZW=bNX0uTSx{r^Xu&gmrLdvh{U?L%Wf2)&9QGYcbqt7w+Tt2=E)(5!{p7dfAxI z8Fko;EqD8PPun`#RN}mVC4J%dCwCI;y3LDe3INhRo4f4#)YY$fc7AQRdf(e?o*g+U z*{KVamm-9R4d8H*sBQ6;*MI!&@~O=wb5vUiY`s# z`tc(~W{8NMU?KF2q@}yUk+Vv!-oP=DaX4XQ(i{R+&*?G&6+Dy}s%Iq`BU2knztbvg za7|~_Sjrhs%S`Y^ev-%wbjTWojz*&20w(E=?2BoNnKk;CG3_w3xtKu?RJuV08@!dB zti0w6CTVBtyU^d(WCk84o}wsOhRD%erWJi zh5o!OxM)`Nu9(&|6N84IR$H6Y)uJt~2X z)YQc6xImKSqJ3L>qv5yk)TeV;u$C37&aFyu$om9(WombZy@HFRv6ngs zhrx$z^aN8XFCrMHm|OuUs%23OmibHtqC~ow<$mwmGt+d>o4*D+lukW?arbfPYqh_7 zBA*wIE6dvmNh=%{EzKNYTwGiNBUFtN5P>eKVWccmgRlAjqD|E+yx!QmC|mdKZ_11CYX{FjbJi?h zsIk^DY&=O^wSs!~7>hUy_Ed{B9HODx7rPlA&B+mP>ujgliCg$OclSdTZd^XWO~x|H zZrm6vD#wX?&H3pUK0k{aVEeC~J&S{OvSy+Qxk;ZC#m#8%8D(g23|6nZ!eDNvRZ zaJ?cd7%}iAX=@MJ-+sM8!RhOu4#?}>%ZAc&qz-%~lTzw#B|l}}^m*Ipom81#;I~kA zHz2UtOALJP>SLpkk>#+4t%#TW#VH~oX+J?@PfBiA$jeX?$sm;g5*P~a!tWo^mv=Zd z-zO4h0p}!-$}XTCyR;wYm`y{IgCy}&+twF3laN&}j<8~5HVG$AF=oN1)J=Ete&`dtNLKfy$`2ralo`>u6S53 z<1?QX^1;vG{YB^hkEwHPuPj=$bj7xfifyA}+qP}Hl2mNlwzXs1R>iJh$LREZy3e`m z2dw#J%{4K`c*i5~@qr@^N}LiO&yMova31v>qpO0srR<$lZ3cM43U3oD4HR%8=P-VW z^? zYQG71j?2(c;qgxBT|GISgEL=IlO=!7vNh`yY!R4unAPK7;3Yh6A02*EIVYNw9HXjX zIz(p~)*MG9a8KYV(Oi7)M~4&7mje+qYNyYTUp~T=1PQPC73tkKZd%(Kqt! z>uW`w;L9#Yls?Y=anK&KqA~KEj6l%mB;G@Wi(F4VzhV)Zir}!0(jv~#w~?OPxK_Nu z%moGQsOV3dzV6BM&2_s=55PaUVjo{*CKK(@NkL84bK`n{$X$(u_DB!SfDuX>rAZR6 zShk#b!d&>-O)3rfplgeA*E*R97NVT_JN&@^69yE%*{5kPn^2#no?QtqQ{4ijP(jO- zlz8K=@iM+Z1gLINso|Nh;$5^s1g$X5tm0`DECIvhSj8gHS7fIJeL(C<-R@!_W$L_5 z)(%U)4iAiT<_8&Zlr2*qQ`61}T-C}v#YuH?{@#e9{SbnT3As$Uhpmczk}t;&1@UR( zdr&FQZej&weH&^;hLH4%JWc`V5Gk&k%pn9uZG5# zg%QRKDURQQ4_c@`v{@q!cNamcj>3U$k++TE`W=6G_>Xoa00knRZ>jFznUIHibbytv zw%(s+L!C(y6S-4~FKDp)(8!T7)6J)trNIG?vpBBn<1Ce<7`KCj??8|6a2qjOb6izF znDP2>$I+2sDs?~MD59z9I=Uw*=YG8QIJ|Bhpsik{8Mm_<3X)Q2b#|+5q}?26plIZm zCu-5!_;9o%Yb6OwdO7y`0tBjAjJ(wWZdCM>QF7yZ zoJx&r)Mee)b(1d-h&K2DQX93060BC^Gv17^Z zJ;}4!gMjHbt6`)rwIU(8JT~c~v0&XoI0JlCxI8`TzW!d)hEIn_uUgDHydd<@Y&tiwtYD&) zIM!Agr&s6l9Z@$k&S)oQX)DV&xe_*P;T_zniRqnEu7SvB%^k;Lyl3zy#h?6 z4*n%(G_T8A>?83*xnsmu(N6D=4VDq6Akag+Kpfccu~BXsZ=|0xOwH2QR_}5pb?mH% z`O4L^uJ3RcKqbvJI|fu#a@FM*Iw|D08Zs;?>~=)H9($>)@SdW^0nrs;RthX+732355WQ_E-t>rq%Hd<@xJs*KFep zA+h*T-xC_NwN=>gGMu}z5+jpyZdqgDxIUy7zN5u7R_2XcaK&zCh!t&CF`2VoxV5#i zQvg^w<}WbsYMUDs1XKVhdfVL%OxukPJ4n92CU$nQ7vT1yc6KnwnP~X*GP&1_Srac- z^@nsl`_2x#RX$ZPF)(p3bK!k{+T|2C9yO6-`P6VTS8{f5qoaT2eQT?-)IVqe9APc} z9HJ*>shQx<68vN(gL`F^OO=lI8&B6LX6!m`*I(NvKsQree!YeFwrr#Hr@V@plD*LF z*k70!IAKArr4H(@!tcGWszsIEw4Zc#0rQcg%g1ZQgnbcWnz;1d`NBjfSc90)I`16V zz>|ikx2OfjvMQ!p+ieQPg8-QYSR}>M38Xhgt7Vm%A7E!`r;ddc-c0lKLZ3IW3BGl0 zS96|^ns4{|99uaZ8&V_Iy*Uu92sJ+=-Mh2xO3|82htLL3A55m=<-*P`#F=#xo1EY( z#sYWIQc6})Ro=u+%Sr961h+})czyoy2(4m!M*n(71LNcbDiYHs}%sW>-T@DRVBqS!wN)ma>o(RI5a8UlQFoU)#Br{eFGx#%jkoj<|8L z3CZ}DHR!qDShX%DRDya%45zkLk`uH^Wj1<5m`0crL&=s0v=WI z{Zf}G8Xn%PtkL5KuF%}2Aa&|HSHH&UAJtp_G@Sa(BNf-Fq5RC=B5Nfc(B$URwgG6O z>5Y)s1Z=b+G22bytDLb{x3Q1=ZX@N$t)82Bairp^R~q%xKz zeh6lv7;-;<_T&_?at#tPB48%B!m37g?Bs6C)ND)VR?8&^!nY7u5Qn7bW>{Y6@EBIB zlRI<(nvmdQ^bN!oP#w*wJ&r4;ESp%%Xwl^SWUyhTg%*PAdB&C0oW`eW_bja}9lg_x zYc?jQA6xx9BFv^H#&^UmCB;N$Gh{7-W`60oo4>x9Kh0gD&XG;)+D1Rc)ahT(di3P? zxv*QM5^*LUsd>Q9D!@O))SRhdfn9~5_6)lpt(`G?Vry9%UKS43$!2HnkMc^b+@W*B&UAmuiW-HK-}2_qvjq&~H=# zMz*rMTMNj+tbQ(8=mDoKq|pnFl9{uoJ-6Z3RJ6-CE84NauNHyx@7=+l8N>TCE6Zr1 z!EIX`oFGNa1!!(9ZTJ(ibfxBtN)s~cN8qC8F%vNGmu(%bFz&%*AliBymV#5U&R zv;NjI0s+n>P!LMV9M9g)V#DiSzO4dV8~|Y^^`yi6f*Q4Q3oAt{4Sw*LiElY~t544N zhu6RDj-c-Df!h~yXe~So+_1SR_~t&V<>?UNlnio&izI#suZ|M-t8in4!Fur*Eek&{ zd;i8e$EGW7{Q{sln4MpL_aaZ6);qnD9WXG@DgP}5yeXkmBc z6&%7t>hL}X71}Uu(1v-7t-{lxDOPiv2M0Tne);s)k8ldH>}vVsK}%KjHg8g)gZ#{> zLoctEoWbu~mh4s4T#aRc-|+mMl?j9%tw3p4L+0QCgvp;*Ufdl(f&*#RqChvlT2m`qn@%iO9py!D;)TU@U*r5QQR8+u&~JBy0^)z% z5#Pa^URJ~An035zuXkcgjj%;3uVL&=+!|PaY`yBCxpV3^N`I6-Vld*ci-qgA6Dj7* zcj1dy2S|L)s>ebuPLmhi7z(#-2s*N#0-58|a=9C5piSU~CEOWO6XU&0%!d{#ieK7> z;8yDYx^Sf%Sr%F0Y#u|k&tIlazAO#dWUk;>F;@^x&?l9!gGY*i9cO5~%BenlpHDxo zancTjtA9mR`1u>Ar%;UOI7`2#DH(sm`vk$UXBwYPP5kY4d4}6_{W|tX@*u*JFt=4j zwB)VA2mY+6y$1*Vx!xCcFgEYc)r1OJyfXTqlxZ)-f6PUU$v<3>klO{fpssJWOR5!D zh!ST7)jsohK39Lh`U?2nIzVW2eR`8zS7rx9^j5D4y3HFf{7gI;w)r}}F!&Ro1&!bD z^e>8+>b(xanlya##$)N2kuZSxA+N933(;c$YhjDAdQY$~K$hNs>~lxw9}zV{S=1Nk zvY*hfztXc$(&KLOi37twR*+AXj2DAF!L+o`wDA9LQo8--r^q8Kf6fdHl)_%2{e$Ws zHf2$%#*oYM1?W;h!A*}Ll@5@SVu@{h04BzUP|2m(Bs`x>mkOU+u0KcE?3rzzo}S!2 zR!T?0M=8rrPL99JJ;FvyXCVqp>1N{x^zmy9ynP-|e#6kWO|IEZ)pTQ<_rs6+;3Xv` znG_WrsN4&e1PRpzeF$xSdH-@kH)&~XOH%qGpNs6G@z=^;y>R&Szx*}g?7;m=y~kCM zpf|-x2c7aN=*#}|y+84B7>98;J zqe_zMTRz(@6-s9J4R;Urn4pjewDo?3_qSw|;evem^#4aP<^xY}*(j^z1AJ`9Az>V+ z^xrMS_Sb$>8V}!pMx6N;otzlFjRw3vGSYZ+VncPYui#^%YtFG5*YlWF(SPf`W&9_d z!|(BVAIE1U8Co}1wm7==^&Gc5vd*fiVk#bTc1ky|M=3cw8P;*oh~KSE8YmpX{)$Q& zyR0mUdH7m$T$LP)>LZPuiv$>#L}@C1R4W^o>f`&q-m;Fa;x7rR3M!aYIXSfop6KfK z=5}ls$c*ZMhXW!vyRpD7Z5X@OU4?*yEM#?5{Jq5RaFKEc$mAc?xxT-?8N80xeH9wIMv*j! z0AE0Y`craLtcxHLk+A!cyTx`r3_kBT^$`@Tf+#E*Tkn&82AeFLAd$QCHu0$@80cwe zrf+un_bX#&w&cpL`d;bmp6w=0x|dEy;)TEI6c!mnt<1sjL@S^gv;^|rhU2HglTa;M!kASC=|(@ucrLl`z?mO!aUDM7GA4O-7n zJ#ZYEo&aSXjFZ(Ed5J8mCTFKBuCS9X=1Nu0Cwofo3cG{)pI?Tl8-Qx>G7c@ z$2^&%n+?BDB6XjqP|Tr4;yuLN17*!EWwp)u1r95Q4VlGdKSl1XgGZJIK2s;Q-rvJ& z=Qk04JF(TY)>W0&v^2O_VnRjHAz>VuYqZ3SJrINaT+3o)7_+gxu{*Oq8E?5z;ZMpc zgXe^5DJoHjXo4@zITupl_bKyWiX@-jDA|AP?%uk4jb&{xH)(#C*!@z{6e=3{RrpcB zB&Xni$QbZxE)V>JYXP5luu@sLRX9-sMq<-8IkTd}tF4ojW#Rse?rg2@#uWa;oVj1<{wOx(9TUXP@P9aprl!WB3F>vg5v zVziZ#9gD@{g@lsm#BGA3X?@0Bp`(uQdu=iZP!?!5ExgK{%o({0?oK>sXOm0YG03*H zy|A^j+1**cJUzw5IiH!FAgou-l15v;1x^c`01hj{DA225{U}0<*&^hG;a8Vq){aU zcNZlsk%~zF+o-V1g zKHvb$!EE`lf=Qim%ch*_8;kcbS?&JzGUKV^A)}&qu~LEWMI)w1NY{*n812q!hLv2G zH)e@z{3BB=BkMad+zHR`)>vm3LD{A?&DvuJ_okc`qltf+y$$Hj35rJH(B4!}N5w=| zn&XqwvSX9OXMhJj#XYiV9H(*SjLFi4=Ge_FCu4livgn%IZ`iysfSWgzsY%-fjKe2-q1Yt6k%oaHda zIb-^}sjaQMO~;pq;LGh`xo%KuG4SsvrlRNk80zy#ihBJvNbTktOVbSRdb;+`u?P`5 z0i8PfG5WG=_5_elWYSZor6lwPVpzmQM?5;~&jg5U1z_v?=9G}=dU|%6Xp;*nhM8@6 zH=Ax^w$}18DRVrjq@ZA(V8xtQAOAFK&Cs^>z9nL(K`mOeg2Sj`%qt7IC_a43K1;Is zx=&KaOx}L}-vY^aBhQ&ufR3HMyuRLQ`Zp;Y@@&k|M90TQVwY41Eemb?g`1n*E(A77 zt$TxT5AQqAt`l#-)#27JWz4OGLp?TGYfq4PN>69kv6c&FF~wMsy}{*F0XK#%XXFDX zvW5Ov2;1~3+RDhbyrQP3qedlPh(QMV_k(R&NiF&C{1@dd~Gxxy;9_D~iY#_!TpXINcsm(=1MIf zH$xBbF+m}qO*1=7TVchkV%V(2x3MlDz@eR*x6RRt_z_oX#U9XAN>`WP?XOYZlyttI zt54NrVklgpF8{=aad?u<3Dhh9N1FxU5U8}tbuh7S>i~T!Fr!TfYVd8wFIqJ3l)d*- zTw4R%?f_VbOK38`Sn23!=*V2ny)%gImv0^)x+x5lk7h0v-sXy*dSf8?p`umr=sx)0 zpY%RTu63${AVB7ZMsW!H4z8LuzuH!~)O$3yaZ~oXeyExyUWRVJohbwmwfhqHHa3*m zn1p(*tI>xj|CITop-gK0OmQMBV=O;fy-b=%NQh}ARW;1Dxtgq_xU;yr%*=05zeZJL z+g?IJS>|YZl-|$~elG%64&|~fXKji-^2Z!3<>(j-Y4!%!h%8_B;y}-9y<D{LzzwqS5uqu>@cz88c63mrZnvn~@pu z+n&BMQI0XMY;yssf+XA<`+$ZzJx&yJIn*&sQCDlOVa?Im zC`ZJXcf82?saVGpGIJgt<#p@xcSG`NwsRUNrKcI_GB>zKU&oN7ys!Q@KGy+Lf8qi7 zqE@i0jrIP((tqKUKM@UkqV2s?{hmf%-9RPPmc_HNr?<1VfHQUuPP~t|y!XSw^6iwM zyw7)wS?Kz<--Q!IAIC{+ogd?o4m}SW$$jT+m%VTIHzf}a%|pE(F?oX6xmhx=4?v<% zj=ku%_qSC*3a2+r_rjCJZcHU!HJsO%MBY$(T~4$9OmDpWa;V=?mSE*+hV2ae>v>uL z*GSpe{jGu^P&;i8J|f|=#k1o4DDS=9=RWm^g?I0rI@bnc8RO&r(+-S);HK}>vW80+ z;=ZKF-;cWYJr6yV`{90v&x6_PD=9YKs3H-QML91agO9R2xg4XcoCwAbHccTtX5>~U zRA|TSS)H$cDGnchfd<_VS9M<_KlSb1av#k6KB{)dZE>%vqQ8y>d$xF%o*pObjvs_y zTo(on{84w@8`hs*+XA)%Y+ENa41CUPGW=xF#DcyaJ`CETr&7gszgCa}1bf&XN1gyU znX8?hfCe8|a})ZK0;29KtrJ)MRmh&F4+CEozOGIHz>7r92-}_`qpr60)9XH{i@js53~dN-*>WTd*1{o|c@ z&VNNW@6Lu!f=9QEyD)S?%7{LVyTrskcT%s~0tSs6yj5~ALIwQM4 zBk~eIQjk^PG!5TIQph8)g_f&q)a9*nG*Z^=o2sbpA#TjKc-c5hwsi%6EBmwjJ_dDD zs$Qs0=CvJFl`WuS^YjRJk)y4YewuY*qwRtE$maT2)!`(U5cwhH*pX|9R(XgAqRGv_ zU|k#UkJSZzguH_Rs+}vu5Y{P9_{ABOqt4Y!_sO>~RCa=OV)5eb*+#F=WhGX4a#M7V zS623IY2hDq+3>kgPO2O&I4}t&cbIKgsR7VY*So{I6(&VY%#ERj8jn5=dcb8umQscd z5c#Gr_H?l7Ut{2NcGj1WD*_W++-JYRf(K+|7bu?$YBseFwH;#l^C2SIvoeUV+U@y{ zJ7X$eRDgL94f-}y2~0$|)-DmS1=VkUur0174e}oJ*FQA~7bb1Y%%GK}k`!Jckf2R% zb*9aCw(hO(qO<7K*U^-86r}>~g#j6Fj?%2ZCY2Ju8Y;I1;^wHDtNBT!|2^377>N{&jy$MLZ{zug9nw%zR?Syio^WZUJFB9D9Aw|=UGI00(Qtm-M~n%rMD zDR7t@d?7MR-a@vPeTNOOJbT~f8s+&vhvhdrP*1o}6s3?lx!q4ns~bm_a=wPXpYJQo zMiA3_b?z3g7ONox`2%x)oC_;B!0TNnlw-)o6u4&u?Mhkui2hjqZA zBQ}DYsiDy!$`ke+qM6~*5(C`1H$+9y!=WZQ94mGc&ehb+=F=6gxk|TUI*t}+RMX{4 zB=F}^z04d9%NCH|uqA1!LcoqsSVm2S%ck2#t;RqNp=G3kNGpVYH1& zixNi48Y@{hmSen3GK$(ux|-C;-z@AKGYBmSE3i+KE~ua%zQHC&I+e)$*&j!OqQ#FPNBv?;DNckOr8xJ~P)Wf##5r-zv_@q*_ z_~_+BzJ9w;{coz*h&8A!pTnpcsW#^}9HVB*DuX`lFbMeazunbUpRx zi;2(288>Wl%%g`zw6MrB;HL0cC|A=T$mV1*W_Qw{H5&%)2PkazjjUTi^xH52M7o}GCm-_=3(E_G3OYS_+2RRgh@7y1@P zXOLM<=1P}k?9n$%`G_jgW8J|1v%7xO9uSTAM-w@b11KLIFxL6!@G%ya`fObQpV8;Z z|JUy6gQLWH*NqngL2j{x&*M!6fvyI*r1)gk12BSTKIm#~rF*P#K4v*}3W-P}PFDVD z<)qt3&@!zp2_L_eG;nUf{pdG3(3U_>72q@5>)~o$-1Po*<3opk$6}oOcvV?j&2-*) z*Oarrzn@vH**ixwAjLK$v5RV`Q6weq!9j42)xk)KlUa!Hj?Oqc?*}b9bK5vJwBV!* zxWqsoV&$r9xE~9@p-63&Q&1>=<%gcR4$~~=+r%X#tel2Lh^7s^Ud+ME+HNp+tJ$1I z*;DNOgRqPdP{>DCJqIpQuunF!h~`{;7PeM?jsoq0aQ2BL+|=hg4KaV?S*ovVZy`R~ z3GHaVTBsHfkBQ<}yOK8K?cxLEeqp88-%pV~i(Q2x0xQYN#fSB}bCSQg^EHw7o<@g9 zIN$!vudfcd%251zmbsj;H*0o|(C$}w^1{y6V&&&oLq54@Dg{NAZXR#)s`QL3hxMmx#u?TmQbMSU-hDluHW^rPj*6q1@*NBLBJj$=|b}BXO~qNF(02 zEP3lKX?U5Ss*aAc)kqc?-_9O?lD18}MbPmz-xCIiI4gJ@CHky&%MjE`J0(iuZF3T> zU*+UnO}z5|8binN5}9x(_07X%L(GO&+k$?kG>Cd-{PDjvm+{Ea-RDOMN^2LhA)7j{ z6V{omebqdouMHV#W;3K+&$AH6jNH>P?`L41ACHHpm%C>lnkAV{jiBez^0mvhu>D?~ z{}Bv$`@?6Qz@PHJ4iDWAKnGI~I)bUz&(pWvaqRWH3i#*qsvEh>yZM!S3mVpdI}O1X z@oT2paYgP{dM!^8k?CY1o-QQ{k+;u)hM1DupfrAIj9{S$wWp;R^tEOsGoPdwX z++`IMhc8ul*Pm}PUl&<1aNVJ)?RD?>3gU<@a0m%s@6#R>v8I@yM`*tSMFhNoa$mBd z>r<4y0Y`62M^%}NK^lO!nx$jzj`ZG^*;Q$Gf!Fy}BJ!1c1@*k{+mLUNRASNo_t+OW z{5DW3z}=ULubI>JHN2^hjVJ#N4j-z0qMKW?_nLzAwP>|m&qmVoJizxU@|Paw-J^_y z*ggAQ>Ogbwt5b&KNxzJNH)m~Z^M(_AQ{$ARRNt!q^LS8yfv&^nep_$OZj(RT=EHeg zuNI5{TEgo}6_N@Y=H4Y$e_+A0XXSZb@8@*EPoTcW@uZ-yiHc9rw*AZJsy@;7;`Kw> z_x`?D3snW%;o)TWOSd(wV)sqkd38lw;;)DQzh_AiZcVePIs>ox4Q~@l)*k0e^YgUUF#KSvoyIveBa zAus9v#*SWVK^k(AVBzYG~R~W3eKD)`oL~ENm6iTCb~>$_~+d=VAM#8CtL-< ztF*}ysp_}(wKGcSLzB7b_nVYG{1yO6qNJ$u=A7E}cwK@{X)~8FZMGY0-2n4NEx}xI ztIGb_w`n9mLJMn7e*I@9^ZLbHQL)XJ{-4rXZjhG4 z_^rHENZ2LP(unz^X5WK=K#>F_S4kTcONY@8mF5FN^e_I<`J<87WjP{a$Q0q4Q6_k0 z{-ZN#H$5y#CwhaI!$E~M)3D=*J<{0SnblE#`C7%O$3ZaC$ECi!hW_J9_S|xkovvaZ zH0;SwLnB3Oi9n~nkqf2}0(2RH$&=hlspwgPwkx;Rm778(@&})bPXgH7icQTBD0?Z# zP$UhcTUM+0#(w;eNJ2?tROlfsX1`6@3ThPN!es;zY1oopyP@+Q)s}>K7TyaRq2wAd z1aF9&Bia{XGH~qUTUJ%C3JAqY-v9s|_|fv@pm_ju@Lqi&G|< zH!KI3U-Wfd-vN>7m4D>ua6o7$+q^@B8|5Fd_y{4gMaEjClDgla9+w({wa@9w2nS>- z;T1bi0=Kejm|5Qz0-0C?U$no!C;2lX+(e448HWU2^$-Vh%-T!*ePwcB#F0-h+8eK(o4Pv(e{^)Xj~*1oQN%SvrpT7C2Hz8dcF!N(&X9FXEXk*%#1fHL( z|I~Oc@`*cnd|VU(3*!pNhlU$Gy$>clK`2BhKekRXarO!NG3vvY$+g5&H@|-cd8r|NIA)f^HUMdfSa~oIk>TwKSocW7QzL8aKMF?49C=qhAd%v!c zkQ{1gw`54YA&xCNM-=-CMJ5@oX?DJt{V9h%tY`q4YQhKC`Q*38$ z$%n|ZG{4$hOZBXDg^dL2ZQ;Ilv+K3M;%9r*Y5;m=m^iKI(2FDR+o_eFlB~vT-DnTO z2ZB+iMkDh|(&0-Cuae)`%m)dGKo0C3;;xT)U=kl8qT}Wr5>^;_ z$`25I@4qK)b&dKek(Y{bnHe%v)8c5&%L}Q5$U31MkAnC#@X?c$1f29%MmRZHtClD3 zSRndHcZfO?;O%V0R5~^u3+Er{ql7l3_nK;+rpr{iyjnTv35yU!@h`HNMUK?eY_QP( zTvdGCPlDBY^H6bT7PWX-gPS(h_o_cW3w?}^#EYnQRwpq|aJGgt#|!?JA2up&#;CNe zqhV(|QFFz@!Rw(0v!6x8W_E0=VDmWhaPGa^j2N@w_Pd^%88&gzk5w5VUIhS_5;0P@ z#jN8#KJuorvo!5*Ik01j@p6c^<5Yt#kS&~QJ6>_dXD z$igQn6}=6{{sz)X;G}&QIiDcophX`Wk@j2YkJkg_h!esIQ_d3ZhT8mKgP0C?X9x8v zITZrz?XK8IgiY-8aY?l7h1-`Au9simS7$>)>Y1kFyJg#^5#WngMwMdBQ7epW* zV}z?Le@D1sC(lm9^StdQrNXyg*WpXQwEycKMgj>-&@4-Z5mPQ2uU7vv?2Hk1pk1O% zmw-bOt>YLfN}NbTJYL2WvKP#lJZ4zWbjD8FplQQ)p>`^Z7FJ<~8lf9nT09XdoN?#a z`f^m~$8K}DH{v9=FTPK1K%AN}XT!)7p;^9wOF}$0OxhuBQ-F=i3H^Lx9GYrwi7##+ z86U;?k|vxK3fRK8!O7*&w2ZwbafB$%#M6N@htAEr4_`Q5*Y>+R>k%7CA(N zP+Z1zsgyhnPp$`D0*QwFbD>;K4|W*2_{ca&xG4N5PsyP&6>~nlqmmVDg(j&+<}ZkJ zEpjvw6FF>TaA|6cYy;?KZ!|V!ST$*K?-Z)#i>qB94V2Z@VlBq@?j>wl?F@8naNq(N z1BSjX^pIj>Xff5mZ(Op}K}K+Gg!K|NjA0hb zGl<+T4_SJy#spcIUdQualz6Vz1&YP&>F~HEnq(k2`$>{iEBz=n%2bJ`#EU~P*kNkQ zB+y2!b4-M%ORx!&=D)PrsL2$IAv3F!WrmbXaJU0ysZvZZVHc|yAV`sAKt_}==*X<* zXnuuj*NBs%R=J5MnnO2T-@WUWaxlS%WW_jFNS2B|>8i0rsMd1eHs|BdaVXbUxmkw_ z*SPtK{o+`rL8l=uWHYsc-Jf}UtoQ|c9litF!?k{*cM9|_(G9Z4O6m;1d4*!jJA-Gd$LmdDMdo+!utwP*r_xbUhwEkCrAOFxvI4@M$X^s{g;ta7y zd2Sb!N25H0Mj&Iq#XrY*v^$4LqiE~#>zT*#Q0xhi45yyE)8|7|zoAW5dkvwrnrQ8T z-E~2A>j&$WFjfQviPkm`h9Ow0NMp;GOXF`9t$Z#h1A3q^0ajif0y}-Ins*0E&45%* zP^D(wRB`M`Qp}Q+s02CJ{)W)HA4>{!96sl|W2%jkHa`k4pOR|X5W7i=F>P|+`ll!@ zw>5D)n;go(V#sz8D>QmBgg3&82G?`1I)z4H15*oDSs=tyEVX_#zA^(4h62@u22In?&C#2X3>$8~ z>&cjLe7q^kr) zItYfrmx#NQPLhUfv*XxPO%MI1d3XtDtmJFZE@xU)a&7GJE@aRfVl4^VXMh55SE9B%N-WA^+p>mkk~%4^IW1yjVsgL@~55WTE(Ksp6~ zhujx!=M1W#*_EaE?E4oqm02F>E(y2m){3TO#n5!<7O|3MnRKH4aU8X>08&$vZha*9PtXB3X6e$A4v4<_!vi#HMwB?3aZ^79mM< zk{YnnDmPGJ0*yqsmhw_IG`h(=n24ndZT2W!5;_$JflZ0XB4H_C;yL|}92(pqx<7u_ z%P!3;67BNxES@1qlWQUmDF(g>R3UC*XP%u?mlsIh>wX3fBrBJM1X3J;;%39Cj&#+BE$x8&meEd>1YNI-Bm(?%fz zYQjObh5;9{w0<2#8(pP@9Uf+ouShKpLn$gR&9Em#LA;t_^h^RROpBG9tq0ms=J+u# zVEKs}6PEt@H=0ob=ccLj3oH14nM(g{gN{0_AKk7Q-pm~)ZvEohmA&i54fHY$3jq!v z$w_|ZQi6SBUnzfNR7-WW^}H~y(!9NaOz^QS!~pqAK$L0PRKBQxg-L(#KY7{X5PrU{ zG=LN?1<0@pI}E}{ez%1A*>4m_b$#jm_}S;BzvpRhh#7U}XytDIaTsU5x=Zf}su49? zD*oC9HNuE7a?*wWbA_FYD&^R7(g=m$!ZL`UbJuk|Lub(scs+;CmnsVnq=D zay6|NdZFKh_l5Z%3-7E<;5_{VmZQ%@-LRe3R-Vq*=iN=;RVe;mRj4t6JFRJ6fL%6# z{tmMZ>dU6zlqG>}GQTX@gQHSN30z7CX9HOO>hLFE*_IfcEu%D-KK-SvKjUMUi4Wbl z0Q+&4F7nL-;^AMUxz+}|-o3n26+Koy#RGur@{i?eSZ|g2|AifXiTxMX ziU=CbOvk;L`0}~g`$GSElP36e_BL%IfmjwoAr(mm146~ZuKtV?~$b@dy&y-CT z4V864iA96k1N&zO5Rx~x332L#XL3n5T~4&Fea7hjcGc$pc3kKGc0IZd9F+cP-;mD& zGbZ2O#=nn>T?dno%VyS~+3q2rgz`_yuN4z`3+3=}-PZdu?XdGaY@@Jl?S`N^@lnYsBfx~*RM zp6n8MnqhpgFql$PUXS1)2qoQ|WG1PQaIH9aJ9MpBuePKrue87~ytW$0em4?IcsAUe zQ<{t))bkS8retJGaRMSZj^jih;JtpWzp0?E`SHn+CRn~sQJdDSO?Z`i(4t21iwGZkcm9P6x7 z9`Y7gd5{fT>3iHzyAY4=2<{I-)bDzCpd#Q6_o2njlM(1a0%kVw!bmd*vEc2;rFwdl zQ)ygn*;F znkCu}hTC^=jb+BxdGDj47nfXx0Wa}t?tb1jJA&>bRu@N*69X&u?0#M9r?(z~TmA)Q z%am&!tj=LOyaFX;3IvOFq5URG9?Z<=jAg}5?k?xaC1?5Ae_D*<*9SadKSuK|h@5UL z82T%Q-C%utoOn3j?(;@4Gfp>gx~UW$!BIuMKl{a~m8y@slX+1_RP#P-BizYmCsJ)u43DZqzdW$*-X~$n%eiEWWhW;VZ z{_M8-leoH*Ei4RDkp#<}8^V9(XkJ0G=O5k)-|Qe=vUpRm5(h8Km_~YjkmbpDJSKbU z*kz|-A+YO||7kHQ=I@aIimCiGSG3$eEV8|gyNpi5A%hFq4k8WP!ny(jf%{+Z8KcGA z+ybn>Y{f~tOpj|rzX|3@|AR?>=KJ4A$<~e2nP!FFx767TOfw!blU^2su-&))xB%ee z8(`lA?dOxh=YHMpOHP1o|Hi;xnZxI0xZrdD?9QvJSkdr@zwlPl1IQJXTUvYZzoYB1M`_Ymha8yxx?3E@B6mkXSJy#oW>>JGtn3F zMz^8KOH@A>FTY|oy8gf}3OYFt+~`;EnX84Dv$edKl)ku7%aEzs<%6K#V|8(>o4d?V zo?HI2Q-?}Qo}Ru+RtA3BBAZ#0;V?|UKlM@0v|0kn`~g(ta;)vmn)1N4sLnZX$m49_ z6jmeo?6sYSv!}k8lw1Jda5Uh_arCxlWu$h0_o?M!)oh_@Y;%(?%5X+CD>+L~JuyRN zjnA=(f3RFID_oelAO<)xB^RT)i|fLYsq=BV3S#DeR}7l9Z^YnwplOz07Un zrujCBcJo5n>h4Z7`EY6*cGMmOy4yuqFl`6CMJb3mfI@7dV@ z@2sOC=izRvC|J0e-wwL60q(ncJ4<`XsaY#KKMjCHT0=Shwn*v_VoZZ?Y9=HbHHa#;d&JClcIF#)EPWHh3<3 zaAh0$Ezvx6S*5T7y8E%5(>J9Tk*NSh=EbDqbCMn|Jm$5GT)cVAHHSUZEf_IMFYS#6TqI7Y6%S3xTu?l^mU@w zJMLE@)EG)r53OcsExkI$5Ghn{OJ*a8%>V;EL!Kk+A}wh>xNs!?=5m7-le7I|#cVZf zr@djGYsR&8OQz3EJu|U8HvEbnbzp@)bUdJ<>_mrFK#xL`TUU(Wie~(d58v7Sx2pMwTref=Nw_3$7#po zO*IXAng|0Hq|I}xcNccwybOUlat`0VTRD4KOKTW=8+3*@=vBn*neWceYYYtZxsGKo zqB-Ve-zWT5ssMs6BKYPZ=A+1mrK!99t(TUsra(ld681RWCLMRlaOm~Hv_ho}8T_QV zHaKd0?#<@M;ZbuP(uki%KYe8VmYNYy`&UaCEXGFq;=Q|R?6;e`%6YdHM3i7t$$q%WQ0h!y=^U&Uz}MBW_^_zlXw~l2Eb*vP#tpf+@Tfk+CrV}c9%Ia2j#=^yd5ARf*5fC0efA|&r22o4OkR749 zSm*(wcpk-Q|2nFBl076iNXW3*H z3+vh&W!GRm8+>{vksYkr;nyF<)IUK?sRzg3Gs{Q1FSWdisORMcDcNWL${P>~ zj>TTKI3~v6Sxg~FTmI?Fzu;B(Rdqy8qhU;)Wqm(Fv%uJ%nudx_fM@jiZ2Kfcz5Ma- zx#h)dX|%KciJ2MW)i}j^SHeqX>PF7@FoX1uXNz?%cFo$fw+3DHQ;(UMDO3A_UL-;Y z3zQP3t{s?N?y{agb+!Xm4_8h{G0<4pS9#x?U;83{`dpdI#nkGk^Hmi9NT2D=;Y;*F zM5Mq-ZUd32jrEfjU)xj({X;q0rIR+(!=aO;h0&{tp};QTX!T3;JZ(B}S@tewX+euR zTr3{_5#SA4J9~c<$;Y>jetT~iZ_ML1>LM?prLa(r5Lp(`=)@tftvy$1yZh)G6@`y4 zf4cjovA4ah@$TNwhli{AA07rlN_JoO?SR~IXyz*?bU0R8uv6c(pKCXZsy?q#sY{#j;Osp>3~Vo@0qRHd2^wOCl*9cE*E zo<|F*c0=E#!m!2*7P`*nor{_;z~cfgXzVShYpU}AId=*g$H?-9_SbY!-fWDYO`}d4 zn`>z7o9$!uIn5t+F%#tD8Y@)oT7u3y-^q?lPRfUek5m#vOvC80eh1XpDAb9o#CIMJKfKmp4~3Bh`XQhpX9FwT#VE zNn43J(z$}e7Qu$bvHs3~MqX;ZttT?PXlc7CZ0D_t$aCU9d3Z_`;@M^B=XWBd#lkJ+ zA3gix31!*utO_3|md~$*NfHx36322k^O8PnMccbb_}aPYseN~Z>#5qgD+s_DG~Plg z!1gC$h}QD&8ISbp1?*g2#YYiyCHaqj6n)|1qZ6QcdF;GL)rcwk+*uZa&7=W}Rcb$o zk^H&_zikJuMcAjbI`ZoQdQ%+&rbnZX&{b90owtwxsC@)S4(fIevroYt{PWGm4^w8f zOPE_Vzsz52`2oi4$O%(5{XyK_tl{8@{P!Yg;t~<7cA$y(*cGWbm+OICm(5|znWqY} zJF-_NXPr%j*1MjvIreb@wYpLJbXhDRd&w#R$ddPs7K9B#N@Rc3tO_36KWtJK^QZg{ zV>&u4V_>RgU}iZyx0Yru(PX&uIe+2jq!VD_Vc_PhYYT-#Wbr8ZbTm^b^cNO&b#>Hq zwP#i!h8Y?BuEx`OKKfdR=5IC{qw@$Mb3x;!!o=9O5&TNJnP!$YL%l_&ug2CaqjKXz z6Il1|6mcuPi+H73uPVv=(TeVThb|;Bk`$dU5eGLND<>x<7hQY9OyOoqS_LkWpC+NG zSS|`Pjwjdq+o)E>GxO=>Df+_AT*}b1XY4wRt9o`7rF!Pid6GPI` zH@;-4ua>r|omuZ~M(i_qP<#6)aYw8A%d-$+0t+RZDIn-W%h6$A?pDptTeZl*Zc*@t zUS_{ltq#qRYToEGm2Ri6^5KHnSqO)E|C@v;is)p?;snfE9xNH3KOaeIT#N>)ni%Th zr|X@+be>84S%!r!KX45f~4u&4%2CmzPC*flKyina+!Z?I-C2@pmD5T|=zw!`-gtg!jJ<0{?YFYrfztocNyLLL3X zDge5wxTP8={BXGrU04@Cl=8WX&xVJBVXoUdE`6B*_T8vz|jy-h{}XX2&E+z?#8ub9m05b=VHr^QRl}thw~snt1*) z8C;v#%#l@)FP4HXGb4EW7=gwjzJm5sL5>IXhY$NFcJD2z>c0o>2jq@M9WUZC;hR`A zN8W*|+|i1~Y3yqr!fICRdqL}?2aDftJEmj3S-#HvaAZGPH3vVUW>*jdG`4=h9d^iT zP5RZRib@{+LA1rEE=3cmKsXN`r<<+xy|B zcMe0{*2%%G_wVDSC$!#6nM&170_W^dnWHHfw~7VrN;yOSXbff#zZiue??&~u31|=! zWwmv9&FaS{sjZ0XE>3j(?%Q&M9Qvj$=&qGk;*DGonVDX;xq}Zz=oz9&W^HH{opUuXBLGg7eVsRe^FR6UlI((;Vkf8x1c0WM{lG%F%cX zmXtk+d&ApO356|d;48ew?OkOo{F@7?^0Ll($^oeaH z)*ZHf2^(z}dU<0oAp4_pG|mJ12}Buba+ro&*mKfuKZWnF-mGs6kJF zL#Ac1LfA*kaskwt{LazO{g>Y}4Yii`h7TR|uQEfs_ZO}*e*YSQ?T+^LOBrTEkWUwF ze7;$X^h|7?IKWp1KH3$rM*g6ax4T&VFv}Fv#Qx<4!;{CAMim4yQccgBgDhdM!5l8p zv#q7DrAt4^GN(J|saO|HBndzRwidp}Jx1sKN(r#e_@q=Ms?MqO&?mepr+9`*D2z5b z<;-K&pEMa!EUOuk3*EVS!tdSH`=j{x;coHlXMT*|O6<~@U)b8%RvkY0{#+qkj;G)= z%K%HW(Zdg~QlNvHQQls9eIPD+GuGXp*E4WJZTeL`30^WhzMWc>u@0NKk7VWfF6fJw z;OFhR@`s$*@as3CNn9kK^Z}ljX6mo!&^Eg}Jl$W;+!EC~;Vs97;|w?E z<^sX@BMC$g&-d&EW<_)iw4jFzx!E+rn_T;{C6~;jO#x@Kq-xim#tj?I_0>;5pA&m@>k^yM)TUjRFQw4sVs6YNYvbp`T8}w~51npzKmM47TxlxR?{n`fx^2JCl zs=VVoA413V>Lp^nHV%|sD!$j0H2Lzyd{QnvYQhV6e$N76d_U{{rY|f~&#y>RO#%D3 zBUjA}ZH+~vu+Lpx<)=pH!AT4I=Hm5`ad>y#=d3*-lM3UaJ{fMJelxh4i}!Cclg6cM z#7E3rM)_|7NtZLdjeoFxan?H=I_H4rr{=xop`$PAAb&^mx1MFpRFtJB-ze$Pz|Xuz zcs$a|*fwPA4)YEeNyta0m2sn8 zA{VTvw{e^i2KiLlHg4s?Gb32(^hfP&x(3iAFzm*$jLf-TVPWZ%2kUP4z1dWL>K++4 zhDb`~9VyIQij{+&LNYaqI&!nZBDLfPw1X&`U>w}w1WlAD@~5uv=pe`Q{QhP`k90`W zA44HUJ7UhP@!~#oM^ip`t5rCoHFy)#T%@p&Hf{T1NTeP*Sa0zOrA#DAMD`CrZeXyG zymSnppEA@dl~((i00aJpgG`-e)bP)sCRV7`q&{Xq0TYyyj6Zc-_P0c<%dn(WYVCpy_^H zn4t`l(5@`We9R{CZGC}8mUvpkIoMVlznYa9)oM+tJhr21+meaRFpjpN|7yahjI|fz zWC)2h>;2*CDRPZBURzaYgg5TnfUYUlUN)~^ww$hz8>)F5s4?P*Df})mdt10*>s%q& zN~}0miW0>dtaEyIr}*9DE&j02I*S@TCx#Bcr*XYDWbxGpVCu6{R8EM4;3g@OD?L!X zJ=~uFR+sdE74F2wp_Qt?*e-X?qwd7iJp>;pZ9g2x(|K!1YOz>?>_8APZe^+rbx;g% zLI2^{+=3>Fdr`i}f<>w9b7lLhiP)CCOfI@wj`QQl7-m>|d&6$N0N>?uGL9}u z*L>q=oLdA?5^IA*G}|?c_QGe#a(Cx&2}7It&sDCNkenq4aJRne*aGrVRn?JGGm>Ze z48hs$a@M7M%pFqIntyJ{H;f$tBKXtx`A6I(H<0Ngf37~E!g><4X(rD!7h&w?AO)I}nGv!U8SoypL>!Jy#- zdL_22J_tESXSdjkOTcirMd2e9*tAu5H}HC z)Y+N7RNmOG(YKImZDP303CkH+(gV8f@Pt?ElJci{t2KMyDp}Ajsi>*B{3Afja(|;J zY3;~gVZl^|PWd45-HUj(tt$P;WhQi6@B8gMfqVQf9OtiN9Q^#4iJv8eoq;3>P}%fe5bQRaK*T*Pn0k zAo~TD#K1~|exSTu3Xu46gJ7ka%~a0=9eNlY`UnW?)c@&~&gBu_BK$ueZ@@PM0s@pD zpG5vU^6ni{P0ecxMnhu#_mFSj{sVP>_=Wgy1nITkVtm&n8i0WLZ{Wj+fBzj0%8!2o zzkdBEiT{Iu{BHyW1yM`u^@mUpiT(}z^UuF0L;0@j-v9#Q>-G7+;8dQ(kXR)?n4t{T zE+ejEsbL~{X`^6Df>y772_r;b`~3drVtHX52gqiZd*&kWAiLR4cH~FYU4wb#Ik4Ql z5rZ-Zw=MT6Klj3P#_tX8a*T)k{#X#aJypL<*9Dxmg*!gxlM5IamW~3NCK1<}h$g_h zhN681L~P?F-e(PyYDXvN&uaj^?b^53{NJ%S0ZEw{q`tocu~T~qVIpNV#v-X zOf6hsF$z%HkWb^hOKfSOcIPtvl6?A+J#jyqUjn(hH}P{Q_d9zPLa zonnsT1xn;nU3h87hdD3>nbI~mH1z(QG72)a4A1_^q1y07Iks&#JO!E?VPzCtNXXXW z|K&_3(|^F*UER|dBSB?k5pKj(!fC;xxLS35N4v#L!*AAQ_Yf13ceuS9n^7_LD)h9I zFy`Mc_6nuowxyA~qNNp$9iYh+RhjKb&E{~nwsY453r!!DsWpXb^8#7d6&;XVKQ*9m zqL3##a)g-~)5ZxKZREcLf4~^bnUUk9JF>D6FOh6jkafVYwHl9d-yu|2()#mifTRkc z*Dxx{USW=6-=-aIX$w7WnFLB{hABz*Oz~Yqj(Vmi@T>GEL9%u{lS-I0!0g0pmIfg=R&qo3LRHUUGc4@T(J0d)&l5KY<3k zVoC+GE5WLnZq3gx`$EMjGlw;Koqx*DQ{Hg|&kyAWTt3S*kj+lg5u8R%g+H*j+*KWL zEg||Y`{8>c|2WVWT1s)+PxbQ^F;Z}o&=48VUFll*dc;wsA5z|`T%Qw2;y3iI9V?tY zzoVBObN!b@1Hc(@BD6Goar)a}%M3K5J;jD4i3)feo}X??*(91xR${@cyxq_D#o2Ve zKbvXDIN7SBNL=iRgE}c??_k@P+~=Jg90gRX#CuI{^Wz1aqsQ${?4={cIaNEBr?TpX z9e3<>6+NnAk)s)q1K)+uXBVM*MxT@@Jwq&L`n4av42_2D0N<2Yw1Cgi%XJ%-4+EF8g2o1Hs%V&l^o+dZ5BlG4qktH zqDUk1(~H?>l_9MJ>kND#)mC%YZe?L|+UUFRDpp60h4mBG*;=~r?1#IqP^^rqPO7xE zXMi^Xf@}LK(q;T z7{HRw_ye6n4bB4z#Zgp?mWzC?9<8aZg`~#hp>%uu3pbRq7hWQ;)9tJ`Oc}y}jhIEo zGX91bH+3R7>YMvDBJY_0q->usgveU5#W>tF2)jMd!Gh3!T8jH#yf|X~-bbu|fRrYG z48vE0%gyYoVPr(aIT2YY-B{JB?ozg`_w%VCVG~ojrFVspfKYuwbvxguPtIcgwv9U- zFG-UZCvuine>;mszQnd$B?>U`1g^S8a7jepVKRDbK66g~0Nc$;{cD;|hi0(T}Gb>NP-*n@ci(U)nSjxn-@-2W&; zxThCL@JYBFa|U+3cKiGF#kOzX45N9B2aOA*WXEZ6D5l@VAsaXEe)t8Ka)@L5z5ntO z&|EG3))aGuQD_B}Ak7e;O~pAWkfAW_R9|dfv0_7RHzdPcLVRjJKEbTNDqJPye$#HQ ztXoWSV#UD3UDwuF+{DUJZZ9F%Mj|ag>ll!I+q)oklJZ=m)SZavO^c+rfWj6b!uX4+${Dgo2DCRs0?_IyY z4RvA3ti=pVAE%!4P`(KT`w%!YLZTDI1+RW*XHZN=VUL!P*Dt1qyHuwUf23QN3zN1u zCAXs;r?VsGiEDVy*9>nwiJUJYXnxPLx63W>#EqH{{(bvo>Y{wy=isF#b#RfCF_X=c zgx`1<>7rpOS&&phSH!~7S?A}KM?Ei48{*8*LYSWYHHIjg-1B11o+E9*QAPLT=^TjG zR1K9c?DF7YSu2hpNyE)FN9nGp@U|3RP4sJ7P(!d_cmGAxhOGqlRsFy(k znY!A-oJMB0ijsYUmLz(wkT(SnsHK%t>2ZkT2nnd8CIE^7+}bnn9^Jiv10wwIeqRn@ zPb-gGkhR!(*vfRu8itXBLZxl#MSN$kG)9C!+IUOZla2*{s{t>g3R1sHiIw);UP z-&hpkH4~}GH0C2QUIxF~k`6h$_J@aZDO^9z9O~ux^{h;%G@Cer=hxjPeG+m*K^bD^QTDCrx(M{?&j#)T2C1jprrL||Wg9*s zT>$V!YSXsq4B=CPiK$LLKh1mO$Sg}_?k5hk>ehJ+t;zinr8WDalo3dNmYhre_>_Zv4ZjxD5icUN+Z4*P#PwRS3wKN@*IS(YwN=V@Os#ZkEB zP8c|yJi5B-`)5ewe2~KDY96mF zl#nYg4wYD(#|l#;FndqE=gp8+^VC~Mmzv4G+6p?Ff*kWVr|$POWq~TA(HiaN;1|~7 zhPs9lRt~Vu=0aH;5y9JCU5D#I@-8WMkwN)9^06{-N^Z!nwWZUF@zi_#;HL< zlu@~NqM(ybeyl85Ye4om#6VwJm&eIM(_G~vBirS8B!Kv4VT28@lfw&jY39#vlP1P zTRUSJD-&C7ZD&bYX$2o=RSDx)olF3u+@!sJz4HD?e~`%_KaB@IK9p#Dx1$zIQ~d2- zb8N=@%=eCD0@{G{^wps0pME0WW%`Numqnht5a0#Y8J0uXW$Apc2D`y)M+nvXh_Q4W z?Kp8e_e{L~DHF+G*W2U&7^)j)-F7cyqXHXWjd~Wh9naG+#b+Q}zyF?4Bq{R{6i}M& zB=6G*UtF!LroF}BxLTgi#L{>BZTNg6W9MSA-t_cVAPVz_Voj5;a%totr&eCt-1nPk zFDE?(e@{L+`R;v#bwij7N?YjN8O*qeJdA* zW!5L&EO)9aW$I|`pddea;=VA`?5oY=<gpX?=ffnTaE> zyY3%&0JDqDhp2_Gck;>k2#oqy;OEV{NRZwkI!44PF@?2l1%);)#9`o3^4BJ&)nX?Ca~ZZUX~aG|E9k#~)s>wTZQrm2P8Jigf(-8&4K zDs`g6z|y_ne-m;ckbs1swlJR;$iu3a(X&njvT($$`*dw&^ooo8QT^{Ux(W9z3UUL; zityCj%GU-N3#^{Ab<#D}dKToGD7FM~kFPOIsTpZRWCwuM<)jk@cOeV|aFM-~_H?|! zZM-=xOXKdFLA97ttiiy*yeH~C)K@nw@G%3sQ+_ZV-Q0D9BhA1UJP^{$;CHs0Gj~-R z(bt7uO;OBJPNh3IOu*0v11*L;!@yz)v*Vg_kEHi_T1+)ucdz()yXOlv)?8lck+~4$ z*timA%*96EQEOh%$|%rSfyy%~3h1=Zipz^{NKyj_U4^~62e%798))$l)Y=B4(LK6u z_X^I9cgp0KQbUb2wvo)u?U7l{wM!K5!^_!pD$cY-l?eJJ_E9N7q5Pro3H>N5m1)UD z-|K5XvXKXx+y)Qxxr$X}(uLg)*%*EkSj*guE8f)Rm2|`FquH5@#=7O=Y{)FFiSbkY z_zt69yQE1E;9`-(w&Bk^&LrYmFHqTr#wUW?E46KmvFMO^Tc9}EDW?z{h1Y>{`HZ+ z89G2%Cbc}b_sv~PZGS_{OO?y7`yJZ4+LOXR+Q*mf!>BMerxiQuF*i{PQio=nr0!Qc1q1WrhoRhD+4FiwNkY0<>o7qN6zk|Xrom!sq@`i*s4%T*uI2qy zE;_39_FC+-vzIc$9+<>d!&C@9d@fqX8WPyKeUJ4&P@^5xRVic6Y?~$SJ4+O_Ulz}E z{8ICJ%>Y?W1(U?d>$DIeHC-{+bETQmQZ=%@@2W2-n)4AexM<_vj&b`5_tQWP*{pA3V$@y{YNtBPo>lWSSSx3&Mi1nNDfyW`%Fb)g zT0Ry+nqQ`d4DSxx?ovceC3ZhOR{c&_+IQ5i3nswe>3-tQdD>r|_wgsTqJS;2g8U!K z`&Skaz$>b`d(N&O0=BEMf#>fZ)?B?-sgL+F+V?N?kMD3?IHKGv&RU7EPU~!-_>LAx zdv`J>K;kJ}Uz$A-*$ctZ80FwqyMXU7rerHWYZ@m0?p?Sch-H--H8JRACwxO?(w?l$ z9!I^SymGa2TL`CfZKbNJ8&ETK=~&BmXJo@Rz&l16<~d=FD&R}Ay{6h)z2kjKC7g8b znzU?iZ?)>3-;QNYbmW?L463_18DN7w^zpepIT^SYr76KSfIi;Y-wnvoAKNusk`O^Y zRcZo_)3MqL_`xQ@7TW&Xx|H}4nkUM@jDr+}7GvL-)bDF{8%ogbFM#D6Y43NO-o%*HL zmRGm+TNzH1Rj6I?Ty^GHo3f{({&<)%|m_u z0~X)xBL5c%eG%f2{d*lI@?FWo14Y`g8io|Xjx6n5MY)lM06o5_!)S#KT~+%Zui29U z9_*2Cc;0WreSN&VWG@8&PpESN3-K>UvW4SY_Efpgv3iIXUTXCCduLw*VeN1nBlYa zin9?@{yPs3L{YAaegYf_EbSkTNF^mD4+?fv6}hIg@a&ZUV#Qf!hxX=gyWY5>xdgr1 z$z5DbS#bJpqA`ekI0GN$;jSDXTXXKH-s^*7;F+pfi!b@?NKSqxNz{hzPAOot!o^1J zhPLHT>x`Jrw&as?E%tv=>~a-?)69H)$WKcd2_lfau~%1C{@OJ8`}<#CJEs*v+F{qZ z&ZM(j2V@TzK)Q|l|G@J;MhFt;elAYGCIn91o=?9bc$2u$hbdqvg|?pZv*h-MbpQCf zxX6}1-W-o~VX34k^0K2kgK?xu`!~l2a$4|uc==pgdwaP`sjr{pO?W#?ZdM2q>!2g; zaLx{6^60|+{L~lpf##VPiU8w;yu^Ttn~t8iEojC~MmTb*|Bjzt1~@f)+|vsnnPz4Y zzE=SqpHvdwd%iwJY36CkBT6#To^VwaytkcRX@(nVRaJlf+G-S3e|1mFqk8i=@Y7Al zN<>-O$iU3Zak~_~-htp=K28t#bt_pB0$mTB64in=2RxFZutQ%rmeR^PRyy}5S*c*8neSK4 z-`hH+iG-=7uUQ_2zhCN#<_+e{nOO=CFq_%B_*zi1u9A7&9kyJ_`gNIQp zcHlT^E3$6Se>15rWtJV^ZUn6r_m6t}SAn<>1S&kf7WO<=i^<6350Ix&wR|fkr{W^XimO4>WTb47UUf@ZrRG zt{n-Vl-VYiZ5M;FIS+T5(y{Lv8|{dP>KrD59}z+1*62r0Pu-b@c#VoTJOrMh1LX9? z^)?Jt>>W+k4f*^$ttG+6zfXP_#~90Mas&I@oecmm`p;m^QZbq*=xNkzzp5yjSM{!V zW|KG57BhN8oh^E%|7`ZACv5mK@^8u6uB=`g1u22vx&TBq^XkqEJKC{`c}cj0ZMOZ(csi^%eTGGdNuEWH6Z-F*hH;aK5H-V+MLMtoiKs7NrW}DtO1R z2S2;KGyUYk=v-W?NgKZP0N`vPAF4S>?0-Ru^1OXOtMZSWvvT(1wQSZF2B|He;PvP2 z0sl_LFXu96w|#5Y%%8%YumY}mb5?uJ7Ee6SNwhZKs7khW3ZV-&{ylL^5B9qw#@J!> z=JMS{5_U!6{LqNOuPts*aMNd2pDScpdjbA| zCbQ7i@mgFkI0nLBBA0?+T1VRNvy&F)ladpY)EhE~3mz|Fw=5vBBeBxLm+> zKV=P7O=S%gtyMRAFm23jH923yB4b;5C$#S(G9Y~V#Db;z55@`~^p|hB+~tC z!OXy2Qpg}rq)Wm;F^{~iEv=SCePAF7O|vye$Mq8r--Iy@-teYkS5 z?PGMlr!%e|-N(oXtfYHfu60JnrIlUP^-PZ(t}LzNQ2@f1zrQAJ~o|j9FPgrr?`;N4mPGvEIk6 zvnN^Zz^}DXbm4p%gEvxAwW)w19MH6=%)TFAa6K^5Qsf;5a^x>6Ggtn+O@1_svvJCx%s6K@srHs;E{4TEiPt(ww$b(2qU&(~i?T z8-t2iAGG^7{I>^~S4qO&p;;5B9F$JB!Ml#XpA(h8J__gL??37+O&?|VZ|hu1t4tpa2qWGrW@VSu3#a*I~8YgM?5 ze4eA)iEkQqyy_c6BO>Wp?hfK&r!VcS23K`>Zz|b!=tZDmRoDQmSfsu8yW@Q_^+9U@ z9Fk==PDl#joj?pNRXY(7YM{q@ z+Q)sr$>--Sbp#2;m0S#QItpXJQa$T%*X|>SVelL)$z&o*Gn5eqM58_)O#Eo|{ z-f#;oL&~pDURa38&stNoF|)xEqL>~4#kBw_#3|?-Mqa{7ey2cM6RXNHX0IqB>vLO1 zY6v=i7MC{pdffkLVH4)8^sndOGm6Qko;y9Q*c}K?xT#(yYnGli24+n(Q{ubYMb6PA zyVTLz*FRPKGJLb!aB{|IF7cLAA=AOrQB1$LXTJNVwenBVQpjFLH50AP@?TO0Z=yfa zyqQa@Ajz0Ojk{)~?A39rOlsaTzTtMWn?9?rYMhpN*68{wx#49Ze`X zcuIOINeHl>lXm|FFT;D&N&2$+aJ`SFDWUJyVE;VQ9~C8bty~e+q4O#Om?}7v7fde4 z`4qBGM8_xq70V9Fi*8B^d3y41jNeYJI_RSwF*;)!{VhvpVQr7;eXz{W(s3LQ0|=+Am4E*`1|Y%zK2Nu3uWFyw&*Vm>@YSw%Ku|G3Lh?_)hl$lTX||ZSsTVs27b^TpcD$K5D- zd}5(22+sAmv5&}GxUGk-iIs)vq?)CZ+QL)gOp$cd#i?FAf2NDBgvBIu(M8P0T{?Si z^Skxd`U2xCbG{5Fc&71MqS8+JK5T{xKQB%yVM?5vCipA+9UmWi9alE{UPc(IsjKH& zu2hDs?a?CS&){b&gx=x5;}?Gw22+rgjfjbvoSY<#=(oU=>Hn=!E-pfXbfJm-|MH36 zz4@=oR!P$z0TYDfGV&aZ_<%n)< zez`pTYK-wuA_Kg8PWvB(ovlqzb=d=iDZDg(tL&dfF)xpGk_E^$ z28^4D6}NhNk`$|D0+}#`MEBRWZ+uB(@2H{iv z*y_1&7LKk+t65w5t5w0r!uhpWS^UQ-vA=8nAWuRavv6lgT`h={hYl?5zbOz=Z=8B( z;p`?`!Mm)dwGJ-OCgJ+kjz9Hf(DC&2baQjlv(wkd=jC;Mr=7~9CM74oy}oX5YcnPq z5Tqjcjl{a7oP&(cZyzgDcmVOqTZTX!Jv_p$I7qfava++XMF0QkEJy6kYw_xuQ-y>` zU@cIP($ql>PfL1HV;*DMj|1~Lk@CvyGE{PuJJq*)^)L%A# zki3q=G~d+h%b`P^Y24&29<;T_IU7l?C8FK&Sy77i}2w1VjKyXe!Ek(DS zis{UjM-?+IlJen5G(7|h(V|?xnOV|Wq?|KB?248DhLMR$1ObNr z|Ea0GjS#4%uiR7+gx>$VMj*akR%fMRQN+JKxxAh*{)W;2YFP|z6P9^6k5p+scqc5M z$B2r(@{APdEMYu-LOug5dK<+G7gl&Ot!4|&`G&h|3zE5#c)wnId<8{C<*z~>QOEQf zF*%<;$65e^g#Yta-@GnIotw9wg6LgVjZbbA2)@|8tf;7{uO*$ynC*hc`y=rKS|?xM zGlv#?HMB08-0R%>dJY$ft5O=`5<`7`{am4eIw+M9f;atrw)OkBz5Cf^dGSA@BmyVw zfNpM0&CSYYpq7?zy~3`qbDD4;lcan-@a{9(!A=_GIJj9x?cK}VW2=n$botIc4qv$Z zK?7N4$a*v(g#rikUi6W{k$AqxFd!leVz%Po*5c<{DfV&0tw$Ke=oN0!#2-QA9o1eD zehj>W-i%u328XmB9o@YNP>DD2dZ!4055}+l9M6Z`{ycM#sA@FzQRu@Aqp5PK%{TxCB_K8F`~H-(B8o3Swz#6{~%nT z3&j(Q3O#0UCgQJ!9Fv*dU8?`p-dDy&xxMY8sHoIddH~&YcY}aPcX#&;-Cc@+v~)-h zLydrRhYaD+-92HhRuop$4x!Ot2tsUDqr8LkHAOGuo_$IH$#vOT3u_-?`-hi^Y> z6sgoD*sqZGEZ8V)@%eK&N*U?HpA4sE?CRVF+TltPQ+jxcal}e0R(m@J)T%&+^tKUv zCFgWRaZ##WTyM^2hR!eOLx&;&192g10f)~PH^PpYB5FTaNA~bRym>5qfHmzDwGe>) zgEH;R2qhk=YK41fSy>7lJv$e3Bxo=}+<47%@CE&fIeil6=~)>PMmKQM!g%#>*X2ckGLnt#x{jB!I$4I&0vRa

    |U%tn#ZyEi>OJ)4`GMXvt$Mvwgn zf3qJ+{sQL)9SY$?w6wH_w+|;KlGYIUYTFwdw1VqAfji~FtNGXov>!zr^wf7f1z#=s zS3s+lh-0XPvz0RO8u#xv?;G@*)GNnV@G=UPGp6B}Rn`<3a=IX|OX}zC>I15>EaTCw z^!#3K##QqfC~~c%v*1u+$&wFQc{`S+^LGN+jZz_)bwm{G@7zSU33^*LaxlJs?&B?O z@WRd2N5*6KrJ&8BA}@ib61f8JBWa=?$Bgu|7&k(9k`45FS~x2$>jYiLPK9?PY}H`fQ`ep#RW*p z!@P*3`PTlqlalBw|w_8(2#JV)Auo;YC{xH^XjzK9kt1#WBj@ zvG)W$j}v3FjrtRXy$NZ|$(Y0280yv@E(_uQ2iQ7@?@StCRrCn97=Te43bip%&KU*A}4lMOb^Qny_KgkzvQf?Qo3mzG9OTe}bH zxhZX|E-FO^3cXA)$Uh_r!Pxvbhb%EnhlImC*6NMS+hv+ymD3rovL+>TGDEAj|5*BA z9!^cu33k+9|Hl4NwvcD52@}@gDx_d#0G>#owns#qK$+s8 zF#$tz(v&f}g+uJqh@{WFk@wuaC#t(2h`Dx7r8=C=(~6ako({yB_jj4eTeuY@7htY7 zL+Q@#2?OBtXzEi z;(C>@>g$3|=Z;?EuKzN@&$pn$e$tKu zYig>L%=RlPPjx9JOIY&`d+2dJt zo`LkTFnuPq1ob{r3~E4zIlSfSeRF^H>DP?7GsJr9&V0J_Y)50;edLRLS!We(BY%26 zRcbNQ-h+s|8R4`pvl$XchiyZxEH>>FJ|^~vKV>?cP*QSnS;@)jdM*CBkhA#Oh_6wr z*GD6ZJ3G8I-!sc`A(k6u;hNQH$bw2;76XKfU?4GQBC?_eH)P_+J&b+q=EG>2ToXTu9AnB>-jM^E%g zkpi;a?8p!It(9;2sng@rU*~!G33c&3 zgALFo)wh%|Q*jA1usCkZNU0iMh^T!`L&~Nf&ZY#8Bv;acoYme9rGLzA%k{Ne& zh@YiXJ{#~}J@NI<{E`tu0ZL~t8XD}hL03}0WqXpl_f<^>@*MIWcTg&A%^+|18(E>| z&!KrybqTdZF&0r_0w@-L564vAg zRKT6wDUyrN#`(@{8&M_O{~smO6)1u7Q|H-?OBsX+dqGW=R^41Cj4d2oAr)kP3Rq~D+UWn)aoeRIOv}lvW{Hw6s0(CH9(-*dKjtXJV|wbR z#^=28=TM%oQ4|@_F+*u$F~<`)I`ZA`V_;`(Mx*n$7E6vJf;*2wb?%v;oov#w3#pdS zl|?aqPILJZM>kVGsS(%c;$n!u)tzop+u_&gH4A(c37$)O%JAxY_!-wZY2gC1{PD@| zT&s=ZITO&(nLiT)M)Tk&lL%T+py7WuBrkLmEPEs3qB2rLYbQx{)s;pa+X{9}!=!x} zDIw;hwk~^X!1r&=WeK>v$&i8qt!gX=4#ETn&7_H}l77M%J%EkfD_tv=WN0b;!?8p3 z%scv68+j(&r2Km`Fh5gqeT8*BG`H0}!Yr+;wWK;vszHlq)S$sHuePFdLqpq2&&EUS z?7X4dilPS~cWs3u5V`JW|E;nFGoT9t?PvM3|1GCy@hyMM7sIC?+S%(LaG{|+efD1! zgwfmhBzR?c*~HQDaBpu96>M5tv+(u3xxFQmT%8LSd2H2$tATbO(c4&#sp0>8~(1{Ww@Cb0tFLrS)RoesjB2@opX$;dji@(F>fI8L4OC(381yQ?~aI)794Q`SCL<)WoS@LM7@P zczhMfUy+tgk~CmbBO9CCoy=QZ3G1FMkf)Mn#DUt7D%Wrq3)n*$;e$+>OHKJClSPet z_KZV=1NK{hmQmto)%<8^e?0upN_KpT?~sz5tn#F_u`%8+LxEQO`{nX-5H)!rwI_K*8qZk@s0w_`~M77w;30KHnIphQGVR(*My-RK>%G|hs!zl}V(lb*SfEUx$- zS8U1IQ9Gu-m#tD-$6uNb`}}8Yaq!8i)8RFUL(t>3a-wkbfEM^&!^3Yz&6lTBhaYLI z*R3oqHd4qLbw?B|B^(|*xTdpCQ3@{xE@!$~Rf1|851Y@5YJDwS>hF#)UURc#DrnI@ zlCT)CC;KB~p(8cg_*mTfKP0{W=DGdVAf^`=rNp#ZQ6D5Ylg@imV)`%!*$h>yH zrEAxA{*F60nY1+ws+!s3Q#!lj_v0I)2zI> zx+Ag`HliRAtQNewuA=j_R!UNYi_MVR0#Q`&(;ijb@`vBfy^i7FpZm5SI8K&UX?1TF zy+Ar10th$O>J91cbqiXlafOV}l{AOe0YZ8j3Utxt`LZKMhAk8j71OGgL+U9u9eXUl zM_6coJo>N3fRpGbNjcKl`ADwAtYX?9`{(HB=-%E}z0&)=z90@VF2?*6A^k6;Kd!IO z4~n%4lls{qyk_uiyw%keJXgl7fF#qPxuU_d zbObc91Dn{c=(5kqyMmaf8iC);E-mO7>o3hGgA}+eyPt8DX&=~q&6dLlB&mUURJiR` z`q*e9Le33hFU`o!#UBt4*p1sl)EWkXEhx>+NT9*ij zl~SuClG0XcYtOq3Ib>CTf>_X&g;3P=|0n5@trlqAPFx_`VI;LIS*c=8Ev_L*;Ze*& z%)JlR6X8(2sm-P;sJ>5>8yh~Kc|2kPrp}F_NxGJY%&93_SBa`P}L zx*dm?s7{I6suc%mQsfd<(l-Vz%je+Lue{P1npIc)5O@J;!)V2{fXDdIW0Br z>k=C~c~axrB%vM8sR*_*yfeYr25yC*Q=chD$f>(7R}AMA9n&le@3CK-BFB0?LM z*I{@c^<1j!>x+5PM9sycfRv#H&aE~a5d{PM=QTU0gi2i8Hn&6i_@OUo2fA;gWJ)MR zz}dvnQsYwGpbhy8_ncn7qVrl02!Lv1Rt(x!o8xP6K{NS(G@UL~dD9-P7JYEpV zVC8JuIejgfHGHw-)5ROSSbQJP!A^Ft8bgXa8?P2&ENeL^;@#!|mVGP#tdYTt2HmFJ7)tGmOf>~orG-N&6FzJ=VmGH~My-DTLPN1YG-d{@_wzJ-aHsb? zF79pGCwBADgoU#Zh`U=^)JD$$ey+9yGh5j{*|q}z2TIub$mHm3O!vo!txRuBQpF16 z`tVl~nUD#4Y{4sTJU}%>JH>ZSKShqJCw1t2l4#1qoj8Qh)7d#!lH*aA?7$gBqCktG zjQTnLD(I!?!qU9(8+t|T-u=|7S?1~{JN+WNB4)oc$|AYyh{%bqt5TS&hGCuRa~h2J z4({XV=+c&uETZ=hNI83ZE4P{hEkQ?Xas$qLaKGKdfIHKhjt62K_4huu_8?1F<1qE2 zYQ~VY9X&^_eMsmdmIw}}J`=r}ozc~iE*{yVt6{s*Jv%!x#{tQ!$Jhr3Rf)TM8Rg`# zl}VHgqt6HBw*!ekOsi5+dk{$wa{Oh6bVm^~o~7gC>#|-=f9?T#wpb#fQnZ`sY!6+tVGH0r2o%3pBaCUZ(L(G+$wGY?(h`#w!&vD$KkA{;*DpfUGKy=z* z4Vo^ICRV80o7mfz&;qHk=P7yO3I3B<&ZoQ}UnlvcV$FgtQg-N=gz;H~40U+vS<>x} z=PNGC8Z#*0G?R@uwVwW5<0Jw|Q5LQ4P|Ca)kx#AI040GG+d>R{XpHoYUK)ac+$eS;EJUZ}fJmY;7onspNI^WWCP=OhR?uUklh!E6}vPX;RBMTdkK3@MhKA5lDU` zIf2}9 z3YmP)WoCQA*AA?uhc;Jj4M>>hfu{0ao}M{q)y?s4;!(LE0a8TLadX|h zSk6((U1_8-Wg=4V(SC=FLQ_la$Mi=@9SZ?KqWp%|#zaGN+7^Q{4Vf+``MymT@{l|c zq%{gEPB#!)f5YCW5Xq4+usw36Xf|?xJs2LIqe7G8u;D;H&Nb3B!Gj4>dkwi-jQz1c zp3V-rl`BA*zIFb^QUqxQmkVrQwa1$O%WsHd4ejPw#-n>g(q$&|G+BB zFFEdbuOr5RW%CJqho1B*X;Kr2S|tB#CuLjyu}QN2;lQ~JeO|_3@cr}bkF=3v;dyL= z)(9PSP=>Y5$s4_KCC4mfw~%9-g~NuWN_<6Idj(wh_Uz(o7C+*|aDhzT=jwT5b&=lX zxLN)3z{0USHKPPtP1SVAp~ zyAPT)JyHUPXt{^Q;QY$`dJb~nF8sX7}k{Z0cJ9U`otOx-=jTqa* z4*1#csvOx{Du?saPCv=c&Em3qGUwqAZs?mg;<#r(a7Db%QaT(KJ=px?gHhN(A}QW{ zi@!goK~mz#dt2oX!p((UAIIQ{oxYpr4%@L|EyC|Sc?hLiH@pwOx0l63`u(OSOUjb~ z5mm;lJfgS}t?caduHVRnmNE`fR0aeyJCCOE*bdEw=aPs3>a&iXi~SRw!qG+4r+H{7 z&91jG!%SsKscBsnySd8ETKRiw(rRjVpC02u!b11x;klzlKW}mRqFrlv&Oku;qFJG* zNoDVW+YU}}wh#6}Zu}os_?8!;!Yv&!(LgA{$g5Y1wv`K656idI5*8S;O52c>=Nio~ zoRCL*kC$2*Arb6yRqupJt-6X>V+eg3t@tJzPnxOZWKYx8Hfe59*`Nn$BSoIdp}^T% zWj7*cGvl0N>!6AxE?|6k@BDbLZi3tQP08Wp-VL{SP1*Ypbl>BFvYy2kFRNd^!{1sL z@GFwCfA{(8hEvBJOqfP9b1h}AB^p4*%#oALyTB)vrr4dMh@8r|B$yn~w%klYu#3q{`zzvEWvq-Aw{8g6bSZDO4n zs&X}~9nN@}swXd$af2RmAv}s@Wf`S>xkh4D_$P*TDGhOf6LVgDiUdD|}gD;$xFSb>Dht}9=+G9!WgS%qxeF+J_CWYLT>4u!K- z9lh7*Bdry0W<={;M^@a7Sb4AB#7+ui`p-OLP~0twIx=e2R4-K89OyPFHg^?VIHag1?&IndKfy zzAYGBt=9XB)08Rd&zCo*cQd1)7-U=mkfeZe(2-ewLsT4RtRA#fH87Tcegj5Vj7?sb z5S!dwgvGc&7A&+=j4mOcg^i;C`+Cs&J^CoWS8;*$0viZCR$4NT$gYELV^$f+QQ9sP z8z=ioXht6WRz7KbuuIcaU84)-=$B&B&25buPm@r9B_Z8Z7HPVQ&`L9f4N6Ux3j7?< zqZ(f8+c)acm{?f#eo?ish+e6df+^p`gWsZ$SyN+%Si@mvu8G~yYR_* z3|trvYfSvZ+wPcCr7*=ne~M(oayN@G+KF_XrpMZZ`PUbRB}#M=#?<&GMMgT_@v+uJ zt#;My6nSoBEUuM;qF^i4in;yuFVx@>G<{=d3%`YGJ7|y48%ZS{-C%y&=_W_{2+GfC zwMNX`zE?DGL-q3%iEfSPsww^VA}dVVsW!nC zzN1Y0p&6#~SV$K1ZaSf{!If^u>ef>?8W>roH7nd=PP2xc?p#mF+vuWE!M8=8PS0_? zWFe)$cKxXSyC}bUc%w43bTd) zPE+vY-i_!pGU3TN;Qfhge}8%z@9M38i`j{!nzyTSN5XQ>fo6C@T!D}9wqC>P(jnx< zGfAol@L~_{ZHywHl0pVCUOg+76{*=B<}5K3b~o{aYd}`ZC$B>sj98_WpdIi?33FT} zcy6zBqXKf%=t{LH?V+oD8zvZa#mIQ+yt_k({?o(LS!yLmwSoX2P}A7*a(k1{Jp$y> zn0?hLBdftc*t1VcLhyxGp6^4;2kpe#z8S#KXDpUBZ4>=5aXdykftc^?^Es*+5#^^o z`x{;-W75h6wXv1&vg(+@JMKFBMTT~FT`zLIg^N^KfJ7Em^{qAz?;dzT_=L(T=WOsF zUy8mK;^p7BFpn`dSm5u=U7)f;6ivQC{;<)g8$7yR`*f>y-d!vLxWJ5_o6-Myak`}C zqBJgugW85PL-9y@T-NS3^i)QX1Q)fxob@2y?0%k&sPzqpTMoW9h$x+%|RdwPz{6p37 z%?YB4iH^Hx+oEURef_Z{&E1%-UewTIdbI4JDPNIu&=!!DvCKe7Rflh^nYEF_jF7*v<~=2T ze`0*lIgsj5TV7mL3G%itF87tmleBz05jlci!6mAqqcXoZ$2S}n`h|tN6}9WF_i1vz zkxHvF%Gw}65``>UPuFlswXCH*X=`gN`66-@KaI~c4BcIDb zzwjwrd<_v^%3^`D+3oM`?*PQkmhWv?8Cz~GN=xcOt=)YKF;du$qXu}6so%xma!)_FSDR`9nvz13yz-mS_CJ-&_KSr2BKv{B6{^TbsG zIz@0B#h!W|8kNXSU36WQkF{mEY`^_*9V+WQJ0(o7)zJ9Z*qUEney16qH zpCXn->=b9!V#mF-kMy!Fh(GkLiS*rk)ceE_Z8Ayn4T|jfwVVaCl{Wg4xwLI(A0+zu zcqtS@e=>4RU-GkYu)-E^z+|cleL*}Joj~$xAKXV90n@aGQ3byY;6+7^+wzNYnp^i( z3X=9&+_6~mGAus7KJx@WlSx*I#dd#X2=Arz8=adHU<&SyOh{DqUYyd1Gd5`W<{4gV z$gsErAXXYlBss!u$!o84hEIgA!JGHkMhBn|uqkyQ znNsh++OPn5pM<|GJ zL|CT5LUQA_Swbz(H!vb2`U+B}LVbPCsh_C%&S+_JR69wi9MmArNgIV(xXbJ^#P3EG z(h^s*y5*`@uNLGZ3g{#79hFk>3EgpHW6#g_GEYilUpDE|k?xWb*dF!mUllh9gEuPc z>JHzT*QRQsvkZ`$u|S%(KqZXy%m-wK8l+d{`d}Qf_{#%>KwbOTc?r_>p8Xm~$Uz;8 zKT-`ri`>Cqxp6wMp^^}ww zC+HFy1Iy1PsxD5=In#4ha#!$<2{rnBVtlR`gqLsRF|T68(MCsLuZ%lj{}~IKK<;sY z^8<_9UL(q5f`||wB`)xzy6lF*gm~w`7SF$m)U5Tn6U!_ee&R&5veG$rKd3*-$VbK4 zsM6_A2nUbNe*DfP93Gc@#RERDDQek0ot3F?+=cJ(+jPb=o}O!@))0YP(1~omA55VJ zNi;v%-}EqAv_M|BQM(sd_xF`<3N;xkE=CMurKz0CTQTa2zF})EpAF+|N z zw@z{NxpIs-^pk8&V~O_H7rxck=lHAW_w>I)sI7h|?sExdyLFJvKN^Gczb`1D7)nxw zW8|-2AJ*?Z{OMezy|=#)Uw8TR{jV3Gq5X29G11v$5R6IBL&zfX9MCSYaKaF`w+7TN zb8%ef-2c9@o%C1Ca=Y)*G77GIcjw=fiF77H6Nyxy6%rKuC4l%dH24?a6Y$`&+hzrr zZpFX5A5pmjHz0)`-gW@I%8X0g zuunPy$`p_0K#qrBxZ)?r){Da@6d~^z zB`3V}vH6}Ptscu+S&2?Q;vXp+d^D;mBU&m%jE5qD315zCMGu@5Z+wJ( zq)6xcTT1db{kHePrJcEl-Fw{jPa%zDWa))_wUFG!Qu$2Z9GF9u(^sR~nVGis%4wkS zVOsJKD9jd&z@)t3{!s(8_wvCM=7>xYl1jOnx0%4cIRBwAKd3Rami*Cj=A`R>vZ7{g zLcgN;eT?B_(Okbk8>b_zw%PqxSqKBfhO|!|8#|qC2H@4!;jaFC%Fkd&4tcP!FQ71? z^g;GF#C%F8%gfd7;H@nypzPr`^!n&z+McY(Fq_2#yL^s(UdMWOvTL8N5odGYT;gK7 znFyuf!6WpQ&`ocTqg3 zCMGasDNUKS7in|W)7q4(8;m+gnF@0iHirV|&yL>pv{S;reRQcSE7q3w4}SduMJoNf zmpuL5d7ri8$%h?mmb5f1hATFmSUJ}_-n@$p{ZvQSB+WaVKzdspXc59;8+whg#xHsV z-{|aIm42X8*~ZTgR}O#ZGuxlg{dMBUQuQ)(>AiN5qP(c^t4{ z;S3&6bO6tz8dUw=GxM(5ps@$<_hL$H#YJHxkz3o-@L%& z*s;Jzzjaj~{(~SoO+se}jed$zT@(-`3|Fka;WTN|W93R+Sb9_owcHG&Gm93ZOJOSY z3#ejbRZ?c7?sJ9VMHZHU49LEo-b$2o+vgkk>|dvsWi}+sI#2PXDDFVPuwcZP>z)Sz z&?i!fp();w{PimXMz;eKp!Ly70t|-W%5cvifU|Z!=}!7g5N~@Y{UZH)4P6gqlsK2} zIuRX4m^34JH+VVa>0Qlir=VT60;8w@!gQ|ckNG8gTDN0xaIkv#2izvDDh-c;R^~V* zXJ;=jCl^|ZD@TVp{P;2O7-qB>Qwns%7DGBCG6p9$W};xO{4GN7YGh?4PR5Sf*dMJw zF#BrtR0ovzEK|<1efSS1#UB>WMGBXkDo@5>FxUyxg=e!PN4=DrTM#1&qV0!2Sku_t zDrQ(FR#~Dj53l-pcsz1##%wY&X5?Ba(WgTg!T0EwhV9$mGlL7-y?C6@%*M{_PVaH< z<@H>%I^JbBiud|o4f!<-T5#amZ|T}c{|fm2@%)#*ZP33(bKjv@Cx1WuYuHA~*}kR! zA2o{7y#0%#^7n1Oi-LN)7(14$x3{;SAJ#vbxXaiW|H6>@DGFvfxVXey>W(Wf~VfpZz9AtKG4#9tbLdF{;%B_!&CmNM!XJ=0Vxz&nKQH-yDKGsf(^Y5wdgDLTI z0m?Yw)Z-9Sw9g0x0tKu=nH3BMqh_^`ckdf}?F&(%NYvrT`0rq(vDnd*pdptz`MV53tU>ltPlCw#;|MQ-`=|2`iTl$xYu-cg|XWkfHXFDVB zO%cW-_BTVydiOiBC&mjR0jo>er0e$=n$p6%mqVhm*9kkhc1*h{OwT{ITb}zxVnWd! zQo*HtH)EpVS9P&~fXn)A=~w`AM-{P;Kuq1Y04{I92IeE}uSJTGCm7g)SH578^b1!h z|85--bR_kaa)j?o`@I4C@DQnG;`a+8$lx53wo#Ne>0gIm>~G!uvv!mlnni{M7&sp%c=h-d(_kJ?4yq2`^N5{0fY zZiDgB;p?20vcNLX{V}Yu&2N7l_x1SQ)ya9b220mR-n)sr>o%X!pHu+?!06k?dD~_~ zX2vJIYp7pme2_{V^`%D}MoA!P@<|N5Gu<3dqVO`@PbptYe3*M{L~c7G)Pr-9z~i|m z_6oA)17+FjPNS1*MwMG!onKt57e^pOKscpb7VENxG1n3K)|Q$h;XBZW2e0kpT;Xkk zHk)xEN@p8&v|kYYnvha(+i`7F)g)EV!(LCeo`1TZKxO#bMLNg-85?^SkbZ%@l7zRN z?BD-cv}>JqbLZNme3*ztX5)l9_F_Ez639gxXEJ?|SakAMBy-_LG^^Unk$#d;Nyv(= zd#bDSuBqn4`c5dtUbQsvsQONui!O5lFZ>2ya+!;!rLErhEZaf*VkaAlhN{m~M5idj z!JRldyHzfBG@j5(mA2BL9b_P1?b!6>AZyUgkGjlQogLrV#qWiXS1O;cU!8-nyZVa7 zxAn8J`VnyI3Rp5cnfJsyl`=fK1}~N(E(DT+GvFPTlZL8Lm=b@uq8LWx- zzS^uxJHIA9x(b??8i$yU17kP5S7GD~!#yrgYQoW+-Q7)xBZ|Tk>T|`bosOaYtN#pO z?Vf1=w%Y|1c`P=7s@&Uk^!xCe7cFkcoA18sNDe=0uRS{j$rUy4FM%-J2ngLOCekw! z*`_SbRZ~shd{!!(X6H(?RVRRy{|StGKV3vDudX~G~Y zBV$v<)>j@Rs9=A~2H}j`>fdcSM(zfjLET$!HyOKOjj!+dSC;&0(B=hdPWmQ;E6@5m zCi*hcf&=a5g?UnWd2zU`*HWxEm4#y0q^c4oh_LO6?0XvvJp)HQbiVnd@%mpzCb#(4 zyzl0~54zx$6t$g)8^x`$WvAHxi2CSkVpV6MsmL%PLhehK3bIH1R7K8U+kPdRzt-$g zU758Uz5K3E9u`KFBDU`v#+VS@ec`E`U9+FBm|526#v30y`FCqW^HcuSz3v`7sNcb$ zcU>&MUb!oo>%rJEJ~Li~UXI<=AnS9c({!KtsU5vOi_z64%Iu6hn(x!tTL1hQVn4pcH7Nq!%z z^*rtL)`Kl2_t9vls2(QW`3AVtAGMxuv37^mh~B1@;|G;i=Q_Ccd9IEstvq_aYe954 z>G*m}(bg6t9HCaFL^9ee@aN>LqTEnHO{aax>CaQyo7VY{rhw=zIeRz5rO1aruX~SL zvdmfZo*;`^tawP9XlqYWP-Dnf%gv{cm(PNm4C$Dyjr4>9#@&m$I1=Pow6-+k`>Yk` z=H$k(ErDNV*=AJu?ImE#8&%HF#9x*NjsX5PSd36!_CU$Tfn`D_g2-y-Hc;qP`i@%Y2j5(TLMV*Y-h zU#+C=_dEkfyG3jT`qu5S9V8={U&+<7y%s$>M9I4#Z+gKhFYi<8%ZYyr?SJ^au8eyc%)m1Sb|MN98 zv7ArNq`X0Y{C3RH(7dRAyKX2y1O=r3XCOmi52De2rx`$NCw=fclL1-~9}4gK>uqR` z|FRPr+TzpSE*lzJ^NaugfnPTIUzrGd+3mg!QxiXLC!!RUs1FTIR#Hi#?48Mn{{!R1 BNSy!x literal 0 HcmV?d00001 diff --git a/package/appserver/static/js/lib/jquery-ui/AUTHORS.txt b/package/appserver/static/js/lib/jquery-ui/AUTHORS.txt new file mode 100644 index 0000000000..a75056b941 --- /dev/null +++ b/package/appserver/static/js/lib/jquery-ui/AUTHORS.txt @@ -0,0 +1,333 @@ +Authors ordered by first contribution +A list of current team members is available at http://jqueryui.com/about + +Paul Bakaus +Richard Worth +Yehuda Katz +Sean Catchpole +John Resig +Tane Piper +Dmitri Gaskin +Klaus Hartl +Stefan Petre +Gilles van den Hoven +Micheil Bryan Smith +Jörn Zaefferer +Marc Grabanski +Keith Wood +Brandon Aaron +Scott González +Eduardo Lundgren +Aaron Eisenberger +Joan Piedra +Bruno Basto +Remy Sharp +Bohdan Ganicky +David Bolter +Chi Cheng +Ca-Phun Ung +Ariel Flesler +Maggie Wachs +Scott Jehl +Todd Parker +Andrew Powell +Brant Burnett +Douglas Neiner +Paul Irish +Ralph Whitbeck +Thibault Duplessis +Dominique Vincent +Jack Hsu +Adam Sontag +Carl Fürstenberg +Kevin Dalman +Alberto Fernández Capel +Jacek Jędrzejewski (http://jacek.jedrzejewski.name) +Ting Kuei +Samuel Cormier-Iijima +Jon Palmer +Ben Hollis +Justin MacCarthy +Eyal Kobrigo +Tiago Freire +Diego Tres +Holger Rüprich +Ziling Zhao +Mike Alsup +Robson Braga Araujo +Pierre-Henri Ausseil +Christopher McCulloh +Andrew Newcomb +Lim Chee Aun +Jorge Barreiro +Daniel Steigerwald +John Firebaugh +John Enters +Andrey Kapitcyn +Dmitry Petrov +Eric Hynds +Chairat Sunthornwiphat +Josh Varner +Stéphane Raimbault +Jay Merrifield +J. Ryan Stinnett +Peter Heiberg +Alex Dovenmuehle +Jamie Gegerson +Raymond Schwartz +Phillip Barnes +Kyle Wilkinson +Khaled AlHourani +Marian Rudzynski +Jean-Francois Remy +Doug Blood +Filippo Cavallarin +Heiko Henning +Aliaksandr Rahalevich +Mario Visic +Xavi Ramirez +Max Schnur +Saji Nediyanchath +Corey Frang +Aaron Peterson +Ivan Peters +Mohamed Cherif Bouchelaghem +Marcos Sousa +Michael DellaNoce +George Marshall +Tobias Brunner +Martin Solli +David Petersen +Dan Heberden +William Kevin Manire +Gilmore Davidson +Michael Wu +Adam Parod +Guillaume Gautreau +Marcel Toele +Dan Streetman +Matt Hoskins +Giovanni Giacobbi +Kyle Florence +Pavol Hluchý +Hans Hillen +Mark Johnson +Trey Hunner +Shane Whittet +Edward A Faulkner +Adam Baratz +Kato Kazuyoshi +Eike Send +Kris Borchers +Eddie Monge +Israel Tsadok +Carson McDonald +Jason Davies +Garrison Locke +David Murdoch +Benjamin Scott Boyle +Jesse Baird +Jonathan Vingiano +Dylan Just +Hiroshi Tomita +Glenn Goodrich +Tarafder Ashek-E-Elahi +Ryan Neufeld +Marc Neuwirth +Philip Graham +Benjamin Sterling +Wesley Walser +Kouhei Sutou +Karl Kirch +Chris Kelly +Jason Oster +Felix Nagel +Alexander Polomoshnov +David Leal +Igor Milla +Dave Methvin +Florian Gutmann +Marwan Al Jubeh +Milan Broum +Sebastian Sauer +Gaëtan Muller +Michel Weimerskirch +William Griffiths +Stojce Slavkovski +David Soms +David De Sloovere +Michael P. Jung +Shannon Pekary +Dan Wellman +Matthew Edward Hutton +James Khoury +Rob Loach +Alberto Monteiro +Alex Rhea +Krzysztof Rosiński +Ryan Olton +Genie <386@mail.com> +Rick Waldron +Ian Simpson +Lev Kitsis +TJ VanToll +Justin Domnitz +Douglas Cerna +Bert ter Heide +Jasvir Nagra +Yuriy Khabarov <13real008@gmail.com> +Harri Kilpiö +Lado Lomidze +Amir E. Aharoni +Simon Sattes +Jo Liss +Guntupalli Karunakar +Shahyar Ghobadpour +Lukasz Lipinski +Timo Tijhof +Jason Moon +Martin Frost +Eneko Illarramendi +EungJun Yi +Courtland Allen +Viktar Varvanovich +Danny Trunk +Pavel Stetina +Michael Stay +Steven Roussey +Michael Hollis +Lee Rowlands +Timmy Willison +Karl Swedberg +Baoju Yuan +Maciej Mroziński +Luis Dalmolin +Mark Aaron Shirley +Martin Hoch +Jiayi Yang +Philipp Benjamin Köppchen +Sindre Sorhus +Bernhard Sirlinger +Jared A. Scheel +Rafael Xavier de Souza +John Chen +Robert Beuligmann +Dale Kocian +Mike Sherov +Andrew Couch +Marc-Andre Lafortune +Nate Eagle +David Souther +Mathias Stenbom +Sergey Kartashov +Avinash R +Ethan Romba +Cory Gackenheimer +Juan Pablo Kaniefsky +Roman Salnikov +Anika Henke +Samuel Bovée +Fabrício Matté +Viktor Kojouharov +Pawel Maruszczyk (http://hrabstwo.net) +Pavel Selitskas +Bjørn Johansen +Matthieu Penant +Dominic Barnes +David Sullivan +Thomas Jaggi +Vahid Sohrabloo +Travis Carden +Bruno M. Custódio +Nathanael Silverman +Christian Wenz +Steve Urmston +Zaven Muradyan +Woody Gilk +Zbigniew Motyka +Suhail Alkowaileet +Toshi MARUYAMA +David Hansen +Brian Grinstead +Christian Klammer +Steven Luscher +Gan Eng Chin +Gabriel Schulhof +Alexander Schmitz +Vilhjálmur Skúlason +Siebrand Mazeland +Mohsen Ekhtiari +Pere Orga +Jasper de Groot +Stephane Deschamps +Jyoti Deka +Andrei Picus +Ondrej Novy +Jacob McCutcheon +Monika Piotrowicz +Imants Horsts +Eric Dahl +Dave Stein +Dylan Barrell +Daniel DeGroff +Michael Wiencek +Thomas Meyer +Ruslan Yakhyaev +Brian J. Dowling +Ben Higgins +Yermo Lamers +Patrick Stapleton +Trisha Crowley +Usman Akeju +Rodrigo Menezes +Jacques Perrault +Frederik Elvhage +Will Holley +Uri Gilad +Richard Gibson +Simen Bekkhus +Chen Eshchar +Bruno Pérel +Mohammed Alshehri +Lisa Seacat DeLuca +Anne-Gaelle Colom +Adam Foster +Luke Page +Daniel Owens +Michael Orchard +Marcus Warren +Nils Heuermann +Marco Ziech +Patricia Juarez +Ben Mosher +Ablay Keldibek +Thomas Applencourt +Jiabao Wu +Eric Lee Carraway +Victor Homyakov +Myeongjin Lee +Liran Sharir +Weston Ruter +Mani Mishra +Hannah Methvin +Leonardo Balter +Benjamin Albert +Michał Gołębiowski +Alyosha Pushak +Fahad Ahmad +Matt Brundage +Francesc Baeta +Piotr Baran +Mukul Hase +Konstantin Dinev +Rand Scullard +Dan Strohl +Maksim Ryzhikov +Amine HADDAD +Amanpreet Singh +Alexey Balchunas +Peter Kehl +Peter Dave Hello +Johannes Schäfer +Ville Skyttä +Ryan Oriecuia diff --git a/package/appserver/static/js/lib/jquery-ui/LICENSE.txt b/package/appserver/static/js/lib/jquery-ui/LICENSE.txt new file mode 100644 index 0000000000..4819e54213 --- /dev/null +++ b/package/appserver/static/js/lib/jquery-ui/LICENSE.txt @@ -0,0 +1,43 @@ +Copyright jQuery Foundation and other contributors, https://jquery.org/ + +This software consists of voluntary contributions made by many +individuals. For exact contribution history, see the revision history +available at https://github.com/jquery/jquery-ui + +The following license applies to all parts of this software except as +documented below: + +==== + +Permission is hereby granted, free of charge, to any person obtaining +a copy of this software and associated documentation files (the +"Software"), to deal in the Software without restriction, including +without limitation the rights to use, copy, modify, merge, publish, +distribute, sublicense, and/or sell copies of the Software, and to +permit persons to whom the Software is furnished to do so, subject to +the following conditions: + +The above copyright notice and this permission notice shall be +included in all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, +EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND +NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE +LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION +OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION +WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + +==== + +Copyright and related rights for sample code are waived via CC0. Sample +code is defined as all source code contained within the demos directory. + +CC0: http://creativecommons.org/publicdomain/zero/1.0/ + +==== + +All files located in the node_modules and external directories are +externally maintained libraries used by this software which have their +own licenses; we recommend you read them, as their terms may differ from +the terms above. diff --git a/package/appserver/static/js/lib/jquery-ui/external/jquery/jquery.js b/package/appserver/static/js/lib/jquery-ui/external/jquery/jquery.js new file mode 100644 index 0000000000..50937333b9 --- /dev/null +++ b/package/appserver/static/js/lib/jquery-ui/external/jquery/jquery.js @@ -0,0 +1,10872 @@ +/*! + * jQuery JavaScript Library v3.5.1 + * https://jquery.com/ + * + * Includes Sizzle.js + * https://sizzlejs.com/ + * + * Copyright JS Foundation and other contributors + * Released under the MIT license + * https://jquery.org/license + * + * Date: 2020-05-04T22:49Z + */ +( function( global, factory ) { + + "use strict"; + + if ( typeof module === "object" && typeof module.exports === "object" ) { + + // For CommonJS and CommonJS-like environments where a proper `window` + // is present, execute the factory and get jQuery. + // For environments that do not have a `window` with a `document` + // (such as Node.js), expose a factory as module.exports. + // This accentuates the need for the creation of a real `window`. + // e.g. var jQuery = require("jquery")(window); + // See ticket #14549 for more info. + module.exports = global.document ? + factory( global, true ) : + function( w ) { + if ( !w.document ) { + throw new Error( "jQuery requires a window with a document" ); + } + return factory( w ); + }; + } else { + factory( global ); + } + +// Pass this if window is not defined yet +} )( typeof window !== "undefined" ? window : this, function( window, noGlobal ) { + +// Edge <= 12 - 13+, Firefox <=18 - 45+, IE 10 - 11, Safari 5.1 - 9+, iOS 6 - 9.1 +// throw exceptions when non-strict code (e.g., ASP.NET 4.5) accesses strict mode +// arguments.callee.caller (trac-13335). But as of jQuery 3.0 (2016), strict mode should be common +// enough that all such attempts are guarded in a try block. +"use strict"; + +var arr = []; + +var getProto = Object.getPrototypeOf; + +var slice = arr.slice; + +var flat = arr.flat ? function( array ) { + return arr.flat.call( array ); +} : function( array ) { + return arr.concat.apply( [], array ); +}; + + +var push = arr.push; + +var indexOf = arr.indexOf; + +var class2type = {}; + +var toString = class2type.toString; + +var hasOwn = class2type.hasOwnProperty; + +var fnToString = hasOwn.toString; + +var ObjectFunctionString = fnToString.call( Object ); + +var support = {}; + +var isFunction = function isFunction( obj ) { + + // Support: Chrome <=57, Firefox <=52 + // In some browsers, typeof returns "function" for HTML elements + // (i.e., `typeof document.createElement( "object" ) === "function"`). + // We don't want to classify *any* DOM node as a function. + return typeof obj === "function" && typeof obj.nodeType !== "number"; + }; + + +var isWindow = function isWindow( obj ) { + return obj != null && obj === obj.window; + }; + + +var document = window.document; + + + + var preservedScriptAttributes = { + type: true, + src: true, + nonce: true, + noModule: true + }; + + function DOMEval( code, node, doc ) { + doc = doc || document; + + var i, val, + script = doc.createElement( "script" ); + + script.text = code; + if ( node ) { + for ( i in preservedScriptAttributes ) { + + // Support: Firefox 64+, Edge 18+ + // Some browsers don't support the "nonce" property on scripts. + // On the other hand, just using `getAttribute` is not enough as + // the `nonce` attribute is reset to an empty string whenever it + // becomes browsing-context connected. + // See https://github.com/whatwg/html/issues/2369 + // See https://html.spec.whatwg.org/#nonce-attributes + // The `node.getAttribute` check was added for the sake of + // `jQuery.globalEval` so that it can fake a nonce-containing node + // via an object. + val = node[ i ] || node.getAttribute && node.getAttribute( i ); + if ( val ) { + script.setAttribute( i, val ); + } + } + } + doc.head.appendChild( script ).parentNode.removeChild( script ); + } + + +function toType( obj ) { + if ( obj == null ) { + return obj + ""; + } + + // Support: Android <=2.3 only (functionish RegExp) + return typeof obj === "object" || typeof obj === "function" ? + class2type[ toString.call( obj ) ] || "object" : + typeof obj; +} +/* global Symbol */ +// Defining this global in .eslintrc.json would create a danger of using the global +// unguarded in another place, it seems safer to define global only for this module + + + +var + version = "3.5.1", + + // Define a local copy of jQuery + jQuery = function( selector, context ) { + + // The jQuery object is actually just the init constructor 'enhanced' + // Need init if jQuery is called (just allow error to be thrown if not included) + return new jQuery.fn.init( selector, context ); + }; + +jQuery.fn = jQuery.prototype = { + + // The current version of jQuery being used + jquery: version, + + constructor: jQuery, + + // The default length of a jQuery object is 0 + length: 0, + + toArray: function() { + return slice.call( this ); + }, + + // Get the Nth element in the matched element set OR + // Get the whole matched element set as a clean array + get: function( num ) { + + // Return all the elements in a clean array + if ( num == null ) { + return slice.call( this ); + } + + // Return just the one element from the set + return num < 0 ? this[ num + this.length ] : this[ num ]; + }, + + // Take an array of elements and push it onto the stack + // (returning the new matched element set) + pushStack: function( elems ) { + + // Build a new jQuery matched element set + var ret = jQuery.merge( this.constructor(), elems ); + + // Add the old object onto the stack (as a reference) + ret.prevObject = this; + + // Return the newly-formed element set + return ret; + }, + + // Execute a callback for every element in the matched set. + each: function( callback ) { + return jQuery.each( this, callback ); + }, + + map: function( callback ) { + return this.pushStack( jQuery.map( this, function( elem, i ) { + return callback.call( elem, i, elem ); + } ) ); + }, + + slice: function() { + return this.pushStack( slice.apply( this, arguments ) ); + }, + + first: function() { + return this.eq( 0 ); + }, + + last: function() { + return this.eq( -1 ); + }, + + even: function() { + return this.pushStack( jQuery.grep( this, function( _elem, i ) { + return ( i + 1 ) % 2; + } ) ); + }, + + odd: function() { + return this.pushStack( jQuery.grep( this, function( _elem, i ) { + return i % 2; + } ) ); + }, + + eq: function( i ) { + var len = this.length, + j = +i + ( i < 0 ? len : 0 ); + return this.pushStack( j >= 0 && j < len ? [ this[ j ] ] : [] ); + }, + + end: function() { + return this.prevObject || this.constructor(); + }, + + // For internal use only. + // Behaves like an Array's method, not like a jQuery method. + push: push, + sort: arr.sort, + splice: arr.splice +}; + +jQuery.extend = jQuery.fn.extend = function() { + var options, name, src, copy, copyIsArray, clone, + target = arguments[ 0 ] || {}, + i = 1, + length = arguments.length, + deep = false; + + // Handle a deep copy situation + if ( typeof target === "boolean" ) { + deep = target; + + // Skip the boolean and the target + target = arguments[ i ] || {}; + i++; + } + + // Handle case when target is a string or something (possible in deep copy) + if ( typeof target !== "object" && !isFunction( target ) ) { + target = {}; + } + + // Extend jQuery itself if only one argument is passed + if ( i === length ) { + target = this; + i--; + } + + for ( ; i < length; i++ ) { + + // Only deal with non-null/undefined values + if ( ( options = arguments[ i ] ) != null ) { + + // Extend the base object + for ( name in options ) { + copy = options[ name ]; + + // Prevent Object.prototype pollution + // Prevent never-ending loop + if ( name === "__proto__" || target === copy ) { + continue; + } + + // Recurse if we're merging plain objects or arrays + if ( deep && copy && ( jQuery.isPlainObject( copy ) || + ( copyIsArray = Array.isArray( copy ) ) ) ) { + src = target[ name ]; + + // Ensure proper type for the source value + if ( copyIsArray && !Array.isArray( src ) ) { + clone = []; + } else if ( !copyIsArray && !jQuery.isPlainObject( src ) ) { + clone = {}; + } else { + clone = src; + } + copyIsArray = false; + + // Never move original objects, clone them + target[ name ] = jQuery.extend( deep, clone, copy ); + + // Don't bring in undefined values + } else if ( copy !== undefined ) { + target[ name ] = copy; + } + } + } + } + + // Return the modified object + return target; +}; + +jQuery.extend( { + + // Unique for each copy of jQuery on the page + expando: "jQuery" + ( version + Math.random() ).replace( /\D/g, "" ), + + // Assume jQuery is ready without the ready module + isReady: true, + + error: function( msg ) { + throw new Error( msg ); + }, + + noop: function() {}, + + isPlainObject: function( obj ) { + var proto, Ctor; + + // Detect obvious negatives + // Use toString instead of jQuery.type to catch host objects + if ( !obj || toString.call( obj ) !== "[object Object]" ) { + return false; + } + + proto = getProto( obj ); + + // Objects with no prototype (e.g., `Object.create( null )`) are plain + if ( !proto ) { + return true; + } + + // Objects with prototype are plain iff they were constructed by a global Object function + Ctor = hasOwn.call( proto, "constructor" ) && proto.constructor; + return typeof Ctor === "function" && fnToString.call( Ctor ) === ObjectFunctionString; + }, + + isEmptyObject: function( obj ) { + var name; + + for ( name in obj ) { + return false; + } + return true; + }, + + // Evaluates a script in a provided context; falls back to the global one + // if not specified. + globalEval: function( code, options, doc ) { + DOMEval( code, { nonce: options && options.nonce }, doc ); + }, + + each: function( obj, callback ) { + var length, i = 0; + + if ( isArrayLike( obj ) ) { + length = obj.length; + for ( ; i < length; i++ ) { + if ( callback.call( obj[ i ], i, obj[ i ] ) === false ) { + break; + } + } + } else { + for ( i in obj ) { + if ( callback.call( obj[ i ], i, obj[ i ] ) === false ) { + break; + } + } + } + + return obj; + }, + + // results is for internal usage only + makeArray: function( arr, results ) { + var ret = results || []; + + if ( arr != null ) { + if ( isArrayLike( Object( arr ) ) ) { + jQuery.merge( ret, + typeof arr === "string" ? + [ arr ] : arr + ); + } else { + push.call( ret, arr ); + } + } + + return ret; + }, + + inArray: function( elem, arr, i ) { + return arr == null ? -1 : indexOf.call( arr, elem, i ); + }, + + // Support: Android <=4.0 only, PhantomJS 1 only + // push.apply(_, arraylike) throws on ancient WebKit + merge: function( first, second ) { + var len = +second.length, + j = 0, + i = first.length; + + for ( ; j < len; j++ ) { + first[ i++ ] = second[ j ]; + } + + first.length = i; + + return first; + }, + + grep: function( elems, callback, invert ) { + var callbackInverse, + matches = [], + i = 0, + length = elems.length, + callbackExpect = !invert; + + // Go through the array, only saving the items + // that pass the validator function + for ( ; i < length; i++ ) { + callbackInverse = !callback( elems[ i ], i ); + if ( callbackInverse !== callbackExpect ) { + matches.push( elems[ i ] ); + } + } + + return matches; + }, + + // arg is for internal usage only + map: function( elems, callback, arg ) { + var length, value, + i = 0, + ret = []; + + // Go through the array, translating each of the items to their new values + if ( isArrayLike( elems ) ) { + length = elems.length; + for ( ; i < length; i++ ) { + value = callback( elems[ i ], i, arg ); + + if ( value != null ) { + ret.push( value ); + } + } + + // Go through every key on the object, + } else { + for ( i in elems ) { + value = callback( elems[ i ], i, arg ); + + if ( value != null ) { + ret.push( value ); + } + } + } + + // Flatten any nested arrays + return flat( ret ); + }, + + // A global GUID counter for objects + guid: 1, + + // jQuery.support is not used in Core but other projects attach their + // properties to it so it needs to exist. + support: support +} ); + +if ( typeof Symbol === "function" ) { + jQuery.fn[ Symbol.iterator ] = arr[ Symbol.iterator ]; +} + +// Populate the class2type map +jQuery.each( "Boolean Number String Function Array Date RegExp Object Error Symbol".split( " " ), +function( _i, name ) { + class2type[ "[object " + name + "]" ] = name.toLowerCase(); +} ); + +function isArrayLike( obj ) { + + // Support: real iOS 8.2 only (not reproducible in simulator) + // `in` check used to prevent JIT error (gh-2145) + // hasOwn isn't used here due to false negatives + // regarding Nodelist length in IE + var length = !!obj && "length" in obj && obj.length, + type = toType( obj ); + + if ( isFunction( obj ) || isWindow( obj ) ) { + return false; + } + + return type === "array" || length === 0 || + typeof length === "number" && length > 0 && ( length - 1 ) in obj; +} +var Sizzle = +/*! + * Sizzle CSS Selector Engine v2.3.5 + * https://sizzlejs.com/ + * + * Copyright JS Foundation and other contributors + * Released under the MIT license + * https://js.foundation/ + * + * Date: 2020-03-14 + */ +( function( window ) { +var i, + support, + Expr, + getText, + isXML, + tokenize, + compile, + select, + outermostContext, + sortInput, + hasDuplicate, + + // Local document vars + setDocument, + document, + docElem, + documentIsHTML, + rbuggyQSA, + rbuggyMatches, + matches, + contains, + + // Instance-specific data + expando = "sizzle" + 1 * new Date(), + preferredDoc = window.document, + dirruns = 0, + done = 0, + classCache = createCache(), + tokenCache = createCache(), + compilerCache = createCache(), + nonnativeSelectorCache = createCache(), + sortOrder = function( a, b ) { + if ( a === b ) { + hasDuplicate = true; + } + return 0; + }, + + // Instance methods + hasOwn = ( {} ).hasOwnProperty, + arr = [], + pop = arr.pop, + pushNative = arr.push, + push = arr.push, + slice = arr.slice, + + // Use a stripped-down indexOf as it's faster than native + // https://jsperf.com/thor-indexof-vs-for/5 + indexOf = function( list, elem ) { + var i = 0, + len = list.length; + for ( ; i < len; i++ ) { + if ( list[ i ] === elem ) { + return i; + } + } + return -1; + }, + + booleans = "checked|selected|async|autofocus|autoplay|controls|defer|disabled|hidden|" + + "ismap|loop|multiple|open|readonly|required|scoped", + + // Regular expressions + + // http://www.w3.org/TR/css3-selectors/#whitespace + whitespace = "[\\x20\\t\\r\\n\\f]", + + // https://www.w3.org/TR/css-syntax-3/#ident-token-diagram + identifier = "(?:\\\\[\\da-fA-F]{1,6}" + whitespace + + "?|\\\\[^\\r\\n\\f]|[\\w-]|[^\0-\\x7f])+", + + // Attribute selectors: http://www.w3.org/TR/selectors/#attribute-selectors + attributes = "\\[" + whitespace + "*(" + identifier + ")(?:" + whitespace + + + // Operator (capture 2) + "*([*^$|!~]?=)" + whitespace + + + // "Attribute values must be CSS identifiers [capture 5] + // or strings [capture 3 or capture 4]" + "*(?:'((?:\\\\.|[^\\\\'])*)'|\"((?:\\\\.|[^\\\\\"])*)\"|(" + identifier + "))|)" + + whitespace + "*\\]", + + pseudos = ":(" + identifier + ")(?:\\((" + + + // To reduce the number of selectors needing tokenize in the preFilter, prefer arguments: + // 1. quoted (capture 3; capture 4 or capture 5) + "('((?:\\\\.|[^\\\\'])*)'|\"((?:\\\\.|[^\\\\\"])*)\")|" + + + // 2. simple (capture 6) + "((?:\\\\.|[^\\\\()[\\]]|" + attributes + ")*)|" + + + // 3. anything else (capture 2) + ".*" + + ")\\)|)", + + // Leading and non-escaped trailing whitespace, capturing some non-whitespace characters preceding the latter + rwhitespace = new RegExp( whitespace + "+", "g" ), + rtrim = new RegExp( "^" + whitespace + "+|((?:^|[^\\\\])(?:\\\\.)*)" + + whitespace + "+$", "g" ), + + rcomma = new RegExp( "^" + whitespace + "*," + whitespace + "*" ), + rcombinators = new RegExp( "^" + whitespace + "*([>+~]|" + whitespace + ")" + whitespace + + "*" ), + rdescend = new RegExp( whitespace + "|>" ), + + rpseudo = new RegExp( pseudos ), + ridentifier = new RegExp( "^" + identifier + "$" ), + + matchExpr = { + "ID": new RegExp( "^#(" + identifier + ")" ), + "CLASS": new RegExp( "^\\.(" + identifier + ")" ), + "TAG": new RegExp( "^(" + identifier + "|[*])" ), + "ATTR": new RegExp( "^" + attributes ), + "PSEUDO": new RegExp( "^" + pseudos ), + "CHILD": new RegExp( "^:(only|first|last|nth|nth-last)-(child|of-type)(?:\\(" + + whitespace + "*(even|odd|(([+-]|)(\\d*)n|)" + whitespace + "*(?:([+-]|)" + + whitespace + "*(\\d+)|))" + whitespace + "*\\)|)", "i" ), + "bool": new RegExp( "^(?:" + booleans + ")$", "i" ), + + // For use in libraries implementing .is() + // We use this for POS matching in `select` + "needsContext": new RegExp( "^" + whitespace + + "*[>+~]|:(even|odd|eq|gt|lt|nth|first|last)(?:\\(" + whitespace + + "*((?:-\\d)?\\d*)" + whitespace + "*\\)|)(?=[^-]|$)", "i" ) + }, + + rhtml = /HTML$/i, + rinputs = /^(?:input|select|textarea|button)$/i, + rheader = /^h\d$/i, + + rnative = /^[^{]+\{\s*\[native \w/, + + // Easily-parseable/retrievable ID or TAG or CLASS selectors + rquickExpr = /^(?:#([\w-]+)|(\w+)|\.([\w-]+))$/, + + rsibling = /[+~]/, + + // CSS escapes + // http://www.w3.org/TR/CSS21/syndata.html#escaped-characters + runescape = new RegExp( "\\\\[\\da-fA-F]{1,6}" + whitespace + "?|\\\\([^\\r\\n\\f])", "g" ), + funescape = function( escape, nonHex ) { + var high = "0x" + escape.slice( 1 ) - 0x10000; + + return nonHex ? + + // Strip the backslash prefix from a non-hex escape sequence + nonHex : + + // Replace a hexadecimal escape sequence with the encoded Unicode code point + // Support: IE <=11+ + // For values outside the Basic Multilingual Plane (BMP), manually construct a + // surrogate pair + high < 0 ? + String.fromCharCode( high + 0x10000 ) : + String.fromCharCode( high >> 10 | 0xD800, high & 0x3FF | 0xDC00 ); + }, + + // CSS string/identifier serialization + // https://drafts.csswg.org/cssom/#common-serializing-idioms + rcssescape = /([\0-\x1f\x7f]|^-?\d)|^-$|[^\0-\x1f\x7f-\uFFFF\w-]/g, + fcssescape = function( ch, asCodePoint ) { + if ( asCodePoint ) { + + // U+0000 NULL becomes U+FFFD REPLACEMENT CHARACTER + if ( ch === "\0" ) { + return "\uFFFD"; + } + + // Control characters and (dependent upon position) numbers get escaped as code points + return ch.slice( 0, -1 ) + "\\" + + ch.charCodeAt( ch.length - 1 ).toString( 16 ) + " "; + } + + // Other potentially-special ASCII characters get backslash-escaped + return "\\" + ch; + }, + + // Used for iframes + // See setDocument() + // Removing the function wrapper causes a "Permission Denied" + // error in IE + unloadHandler = function() { + setDocument(); + }, + + inDisabledFieldset = addCombinator( + function( elem ) { + return elem.disabled === true && elem.nodeName.toLowerCase() === "fieldset"; + }, + { dir: "parentNode", next: "legend" } + ); + +// Optimize for push.apply( _, NodeList ) +try { + push.apply( + ( arr = slice.call( preferredDoc.childNodes ) ), + preferredDoc.childNodes + ); + + // Support: Android<4.0 + // Detect silently failing push.apply + // eslint-disable-next-line no-unused-expressions + arr[ preferredDoc.childNodes.length ].nodeType; +} catch ( e ) { + push = { apply: arr.length ? + + // Leverage slice if possible + function( target, els ) { + pushNative.apply( target, slice.call( els ) ); + } : + + // Support: IE<9 + // Otherwise append directly + function( target, els ) { + var j = target.length, + i = 0; + + // Can't trust NodeList.length + while ( ( target[ j++ ] = els[ i++ ] ) ) {} + target.length = j - 1; + } + }; +} + +function Sizzle( selector, context, results, seed ) { + var m, i, elem, nid, match, groups, newSelector, + newContext = context && context.ownerDocument, + + // nodeType defaults to 9, since context defaults to document + nodeType = context ? context.nodeType : 9; + + results = results || []; + + // Return early from calls with invalid selector or context + if ( typeof selector !== "string" || !selector || + nodeType !== 1 && nodeType !== 9 && nodeType !== 11 ) { + + return results; + } + + // Try to shortcut find operations (as opposed to filters) in HTML documents + if ( !seed ) { + setDocument( context ); + context = context || document; + + if ( documentIsHTML ) { + + // If the selector is sufficiently simple, try using a "get*By*" DOM method + // (excepting DocumentFragment context, where the methods don't exist) + if ( nodeType !== 11 && ( match = rquickExpr.exec( selector ) ) ) { + + // ID selector + if ( ( m = match[ 1 ] ) ) { + + // Document context + if ( nodeType === 9 ) { + if ( ( elem = context.getElementById( m ) ) ) { + + // Support: IE, Opera, Webkit + // TODO: identify versions + // getElementById can match elements by name instead of ID + if ( elem.id === m ) { + results.push( elem ); + return results; + } + } else { + return results; + } + + // Element context + } else { + + // Support: IE, Opera, Webkit + // TODO: identify versions + // getElementById can match elements by name instead of ID + if ( newContext && ( elem = newContext.getElementById( m ) ) && + contains( context, elem ) && + elem.id === m ) { + + results.push( elem ); + return results; + } + } + + // Type selector + } else if ( match[ 2 ] ) { + push.apply( results, context.getElementsByTagName( selector ) ); + return results; + + // Class selector + } else if ( ( m = match[ 3 ] ) && support.getElementsByClassName && + context.getElementsByClassName ) { + + push.apply( results, context.getElementsByClassName( m ) ); + return results; + } + } + + // Take advantage of querySelectorAll + if ( support.qsa && + !nonnativeSelectorCache[ selector + " " ] && + ( !rbuggyQSA || !rbuggyQSA.test( selector ) ) && + + // Support: IE 8 only + // Exclude object elements + ( nodeType !== 1 || context.nodeName.toLowerCase() !== "object" ) ) { + + newSelector = selector; + newContext = context; + + // qSA considers elements outside a scoping root when evaluating child or + // descendant combinators, which is not what we want. + // In such cases, we work around the behavior by prefixing every selector in the + // list with an ID selector referencing the scope context. + // The technique has to be used as well when a leading combinator is used + // as such selectors are not recognized by querySelectorAll. + // Thanks to Andrew Dupont for this technique. + if ( nodeType === 1 && + ( rdescend.test( selector ) || rcombinators.test( selector ) ) ) { + + // Expand context for sibling selectors + newContext = rsibling.test( selector ) && testContext( context.parentNode ) || + context; + + // We can use :scope instead of the ID hack if the browser + // supports it & if we're not changing the context. + if ( newContext !== context || !support.scope ) { + + // Capture the context ID, setting it first if necessary + if ( ( nid = context.getAttribute( "id" ) ) ) { + nid = nid.replace( rcssescape, fcssescape ); + } else { + context.setAttribute( "id", ( nid = expando ) ); + } + } + + // Prefix every selector in the list + groups = tokenize( selector ); + i = groups.length; + while ( i-- ) { + groups[ i ] = ( nid ? "#" + nid : ":scope" ) + " " + + toSelector( groups[ i ] ); + } + newSelector = groups.join( "," ); + } + + try { + push.apply( results, + newContext.querySelectorAll( newSelector ) + ); + return results; + } catch ( qsaError ) { + nonnativeSelectorCache( selector, true ); + } finally { + if ( nid === expando ) { + context.removeAttribute( "id" ); + } + } + } + } + } + + // All others + return select( selector.replace( rtrim, "$1" ), context, results, seed ); +} + +/** + * Create key-value caches of limited size + * @returns {function(string, object)} Returns the Object data after storing it on itself with + * property name the (space-suffixed) string and (if the cache is larger than Expr.cacheLength) + * deleting the oldest entry + */ +function createCache() { + var keys = []; + + function cache( key, value ) { + + // Use (key + " ") to avoid collision with native prototype properties (see Issue #157) + if ( keys.push( key + " " ) > Expr.cacheLength ) { + + // Only keep the most recent entries + delete cache[ keys.shift() ]; + } + return ( cache[ key + " " ] = value ); + } + return cache; +} + +/** + * Mark a function for special use by Sizzle + * @param {Function} fn The function to mark + */ +function markFunction( fn ) { + fn[ expando ] = true; + return fn; +} + +/** + * Support testing using an element + * @param {Function} fn Passed the created element and returns a boolean result + */ +function assert( fn ) { + var el = document.createElement( "fieldset" ); + + try { + return !!fn( el ); + } catch ( e ) { + return false; + } finally { + + // Remove from its parent by default + if ( el.parentNode ) { + el.parentNode.removeChild( el ); + } + + // release memory in IE + el = null; + } +} + +/** + * Adds the same handler for all of the specified attrs + * @param {String} attrs Pipe-separated list of attributes + * @param {Function} handler The method that will be applied + */ +function addHandle( attrs, handler ) { + var arr = attrs.split( "|" ), + i = arr.length; + + while ( i-- ) { + Expr.attrHandle[ arr[ i ] ] = handler; + } +} + +/** + * Checks document order of two siblings + * @param {Element} a + * @param {Element} b + * @returns {Number} Returns less than 0 if a precedes b, greater than 0 if a follows b + */ +function siblingCheck( a, b ) { + var cur = b && a, + diff = cur && a.nodeType === 1 && b.nodeType === 1 && + a.sourceIndex - b.sourceIndex; + + // Use IE sourceIndex if available on both nodes + if ( diff ) { + return diff; + } + + // Check if b follows a + if ( cur ) { + while ( ( cur = cur.nextSibling ) ) { + if ( cur === b ) { + return -1; + } + } + } + + return a ? 1 : -1; +} + +/** + * Returns a function to use in pseudos for input types + * @param {String} type + */ +function createInputPseudo( type ) { + return function( elem ) { + var name = elem.nodeName.toLowerCase(); + return name === "input" && elem.type === type; + }; +} + +/** + * Returns a function to use in pseudos for buttons + * @param {String} type + */ +function createButtonPseudo( type ) { + return function( elem ) { + var name = elem.nodeName.toLowerCase(); + return ( name === "input" || name === "button" ) && elem.type === type; + }; +} + +/** + * Returns a function to use in pseudos for :enabled/:disabled + * @param {Boolean} disabled true for :disabled; false for :enabled + */ +function createDisabledPseudo( disabled ) { + + // Known :disabled false positives: fieldset[disabled] > legend:nth-of-type(n+2) :can-disable + return function( elem ) { + + // Only certain elements can match :enabled or :disabled + // https://html.spec.whatwg.org/multipage/scripting.html#selector-enabled + // https://html.spec.whatwg.org/multipage/scripting.html#selector-disabled + if ( "form" in elem ) { + + // Check for inherited disabledness on relevant non-disabled elements: + // * listed form-associated elements in a disabled fieldset + // https://html.spec.whatwg.org/multipage/forms.html#category-listed + // https://html.spec.whatwg.org/multipage/forms.html#concept-fe-disabled + // * option elements in a disabled optgroup + // https://html.spec.whatwg.org/multipage/forms.html#concept-option-disabled + // All such elements have a "form" property. + if ( elem.parentNode && elem.disabled === false ) { + + // Option elements defer to a parent optgroup if present + if ( "label" in elem ) { + if ( "label" in elem.parentNode ) { + return elem.parentNode.disabled === disabled; + } else { + return elem.disabled === disabled; + } + } + + // Support: IE 6 - 11 + // Use the isDisabled shortcut property to check for disabled fieldset ancestors + return elem.isDisabled === disabled || + + // Where there is no isDisabled, check manually + /* jshint -W018 */ + elem.isDisabled !== !disabled && + inDisabledFieldset( elem ) === disabled; + } + + return elem.disabled === disabled; + + // Try to winnow out elements that can't be disabled before trusting the disabled property. + // Some victims get caught in our net (label, legend, menu, track), but it shouldn't + // even exist on them, let alone have a boolean value. + } else if ( "label" in elem ) { + return elem.disabled === disabled; + } + + // Remaining elements are neither :enabled nor :disabled + return false; + }; +} + +/** + * Returns a function to use in pseudos for positionals + * @param {Function} fn + */ +function createPositionalPseudo( fn ) { + return markFunction( function( argument ) { + argument = +argument; + return markFunction( function( seed, matches ) { + var j, + matchIndexes = fn( [], seed.length, argument ), + i = matchIndexes.length; + + // Match elements found at the specified indexes + while ( i-- ) { + if ( seed[ ( j = matchIndexes[ i ] ) ] ) { + seed[ j ] = !( matches[ j ] = seed[ j ] ); + } + } + } ); + } ); +} + +/** + * Checks a node for validity as a Sizzle context + * @param {Element|Object=} context + * @returns {Element|Object|Boolean} The input node if acceptable, otherwise a falsy value + */ +function testContext( context ) { + return context && typeof context.getElementsByTagName !== "undefined" && context; +} + +// Expose support vars for convenience +support = Sizzle.support = {}; + +/** + * Detects XML nodes + * @param {Element|Object} elem An element or a document + * @returns {Boolean} True iff elem is a non-HTML XML node + */ +isXML = Sizzle.isXML = function( elem ) { + var namespace = elem.namespaceURI, + docElem = ( elem.ownerDocument || elem ).documentElement; + + // Support: IE <=8 + // Assume HTML when documentElement doesn't yet exist, such as inside loading iframes + // https://bugs.jquery.com/ticket/4833 + return !rhtml.test( namespace || docElem && docElem.nodeName || "HTML" ); +}; + +/** + * Sets document-related variables once based on the current document + * @param {Element|Object} [doc] An element or document object to use to set the document + * @returns {Object} Returns the current document + */ +setDocument = Sizzle.setDocument = function( node ) { + var hasCompare, subWindow, + doc = node ? node.ownerDocument || node : preferredDoc; + + // Return early if doc is invalid or already selected + // Support: IE 11+, Edge 17 - 18+ + // IE/Edge sometimes throw a "Permission denied" error when strict-comparing + // two documents; shallow comparisons work. + // eslint-disable-next-line eqeqeq + if ( doc == document || doc.nodeType !== 9 || !doc.documentElement ) { + return document; + } + + // Update global variables + document = doc; + docElem = document.documentElement; + documentIsHTML = !isXML( document ); + + // Support: IE 9 - 11+, Edge 12 - 18+ + // Accessing iframe documents after unload throws "permission denied" errors (jQuery #13936) + // Support: IE 11+, Edge 17 - 18+ + // IE/Edge sometimes throw a "Permission denied" error when strict-comparing + // two documents; shallow comparisons work. + // eslint-disable-next-line eqeqeq + if ( preferredDoc != document && + ( subWindow = document.defaultView ) && subWindow.top !== subWindow ) { + + // Support: IE 11, Edge + if ( subWindow.addEventListener ) { + subWindow.addEventListener( "unload", unloadHandler, false ); + + // Support: IE 9 - 10 only + } else if ( subWindow.attachEvent ) { + subWindow.attachEvent( "onunload", unloadHandler ); + } + } + + // Support: IE 8 - 11+, Edge 12 - 18+, Chrome <=16 - 25 only, Firefox <=3.6 - 31 only, + // Safari 4 - 5 only, Opera <=11.6 - 12.x only + // IE/Edge & older browsers don't support the :scope pseudo-class. + // Support: Safari 6.0 only + // Safari 6.0 supports :scope but it's an alias of :root there. + support.scope = assert( function( el ) { + docElem.appendChild( el ).appendChild( document.createElement( "div" ) ); + return typeof el.querySelectorAll !== "undefined" && + !el.querySelectorAll( ":scope fieldset div" ).length; + } ); + + /* Attributes + ---------------------------------------------------------------------- */ + + // Support: IE<8 + // Verify that getAttribute really returns attributes and not properties + // (excepting IE8 booleans) + support.attributes = assert( function( el ) { + el.className = "i"; + return !el.getAttribute( "className" ); + } ); + + /* getElement(s)By* + ---------------------------------------------------------------------- */ + + // Check if getElementsByTagName("*") returns only elements + support.getElementsByTagName = assert( function( el ) { + el.appendChild( document.createComment( "" ) ); + return !el.getElementsByTagName( "*" ).length; + } ); + + // Support: IE<9 + support.getElementsByClassName = rnative.test( document.getElementsByClassName ); + + // Support: IE<10 + // Check if getElementById returns elements by name + // The broken getElementById methods don't pick up programmatically-set names, + // so use a roundabout getElementsByName test + support.getById = assert( function( el ) { + docElem.appendChild( el ).id = expando; + return !document.getElementsByName || !document.getElementsByName( expando ).length; + } ); + + // ID filter and find + if ( support.getById ) { + Expr.filter[ "ID" ] = function( id ) { + var attrId = id.replace( runescape, funescape ); + return function( elem ) { + return elem.getAttribute( "id" ) === attrId; + }; + }; + Expr.find[ "ID" ] = function( id, context ) { + if ( typeof context.getElementById !== "undefined" && documentIsHTML ) { + var elem = context.getElementById( id ); + return elem ? [ elem ] : []; + } + }; + } else { + Expr.filter[ "ID" ] = function( id ) { + var attrId = id.replace( runescape, funescape ); + return function( elem ) { + var node = typeof elem.getAttributeNode !== "undefined" && + elem.getAttributeNode( "id" ); + return node && node.value === attrId; + }; + }; + + // Support: IE 6 - 7 only + // getElementById is not reliable as a find shortcut + Expr.find[ "ID" ] = function( id, context ) { + if ( typeof context.getElementById !== "undefined" && documentIsHTML ) { + var node, i, elems, + elem = context.getElementById( id ); + + if ( elem ) { + + // Verify the id attribute + node = elem.getAttributeNode( "id" ); + if ( node && node.value === id ) { + return [ elem ]; + } + + // Fall back on getElementsByName + elems = context.getElementsByName( id ); + i = 0; + while ( ( elem = elems[ i++ ] ) ) { + node = elem.getAttributeNode( "id" ); + if ( node && node.value === id ) { + return [ elem ]; + } + } + } + + return []; + } + }; + } + + // Tag + Expr.find[ "TAG" ] = support.getElementsByTagName ? + function( tag, context ) { + if ( typeof context.getElementsByTagName !== "undefined" ) { + return context.getElementsByTagName( tag ); + + // DocumentFragment nodes don't have gEBTN + } else if ( support.qsa ) { + return context.querySelectorAll( tag ); + } + } : + + function( tag, context ) { + var elem, + tmp = [], + i = 0, + + // By happy coincidence, a (broken) gEBTN appears on DocumentFragment nodes too + results = context.getElementsByTagName( tag ); + + // Filter out possible comments + if ( tag === "*" ) { + while ( ( elem = results[ i++ ] ) ) { + if ( elem.nodeType === 1 ) { + tmp.push( elem ); + } + } + + return tmp; + } + return results; + }; + + // Class + Expr.find[ "CLASS" ] = support.getElementsByClassName && function( className, context ) { + if ( typeof context.getElementsByClassName !== "undefined" && documentIsHTML ) { + return context.getElementsByClassName( className ); + } + }; + + /* QSA/matchesSelector + ---------------------------------------------------------------------- */ + + // QSA and matchesSelector support + + // matchesSelector(:active) reports false when true (IE9/Opera 11.5) + rbuggyMatches = []; + + // qSa(:focus) reports false when true (Chrome 21) + // We allow this because of a bug in IE8/9 that throws an error + // whenever `document.activeElement` is accessed on an iframe + // So, we allow :focus to pass through QSA all the time to avoid the IE error + // See https://bugs.jquery.com/ticket/13378 + rbuggyQSA = []; + + if ( ( support.qsa = rnative.test( document.querySelectorAll ) ) ) { + + // Build QSA regex + // Regex strategy adopted from Diego Perini + assert( function( el ) { + + var input; + + // Select is set to empty string on purpose + // This is to test IE's treatment of not explicitly + // setting a boolean content attribute, + // since its presence should be enough + // https://bugs.jquery.com/ticket/12359 + docElem.appendChild( el ).innerHTML = "" + + ""; + + // Support: IE8, Opera 11-12.16 + // Nothing should be selected when empty strings follow ^= or $= or *= + // The test attribute must be unknown in Opera but "safe" for WinRT + // https://msdn.microsoft.com/en-us/library/ie/hh465388.aspx#attribute_section + if ( el.querySelectorAll( "[msallowcapture^='']" ).length ) { + rbuggyQSA.push( "[*^$]=" + whitespace + "*(?:''|\"\")" ); + } + + // Support: IE8 + // Boolean attributes and "value" are not treated correctly + if ( !el.querySelectorAll( "[selected]" ).length ) { + rbuggyQSA.push( "\\[" + whitespace + "*(?:value|" + booleans + ")" ); + } + + // Support: Chrome<29, Android<4.4, Safari<7.0+, iOS<7.0+, PhantomJS<1.9.8+ + if ( !el.querySelectorAll( "[id~=" + expando + "-]" ).length ) { + rbuggyQSA.push( "~=" ); + } + + // Support: IE 11+, Edge 15 - 18+ + // IE 11/Edge don't find elements on a `[name='']` query in some cases. + // Adding a temporary attribute to the document before the selection works + // around the issue. + // Interestingly, IE 10 & older don't seem to have the issue. + input = document.createElement( "input" ); + input.setAttribute( "name", "" ); + el.appendChild( input ); + if ( !el.querySelectorAll( "[name='']" ).length ) { + rbuggyQSA.push( "\\[" + whitespace + "*name" + whitespace + "*=" + + whitespace + "*(?:''|\"\")" ); + } + + // Webkit/Opera - :checked should return selected option elements + // http://www.w3.org/TR/2011/REC-css3-selectors-20110929/#checked + // IE8 throws error here and will not see later tests + if ( !el.querySelectorAll( ":checked" ).length ) { + rbuggyQSA.push( ":checked" ); + } + + // Support: Safari 8+, iOS 8+ + // https://bugs.webkit.org/show_bug.cgi?id=136851 + // In-page `selector#id sibling-combinator selector` fails + if ( !el.querySelectorAll( "a#" + expando + "+*" ).length ) { + rbuggyQSA.push( ".#.+[+~]" ); + } + + // Support: Firefox <=3.6 - 5 only + // Old Firefox doesn't throw on a badly-escaped identifier. + el.querySelectorAll( "\\\f" ); + rbuggyQSA.push( "[\\r\\n\\f]" ); + } ); + + assert( function( el ) { + el.innerHTML = "" + + ""; + + // Support: Windows 8 Native Apps + // The type and name attributes are restricted during .innerHTML assignment + var input = document.createElement( "input" ); + input.setAttribute( "type", "hidden" ); + el.appendChild( input ).setAttribute( "name", "D" ); + + // Support: IE8 + // Enforce case-sensitivity of name attribute + if ( el.querySelectorAll( "[name=d]" ).length ) { + rbuggyQSA.push( "name" + whitespace + "*[*^$|!~]?=" ); + } + + // FF 3.5 - :enabled/:disabled and hidden elements (hidden elements are still enabled) + // IE8 throws error here and will not see later tests + if ( el.querySelectorAll( ":enabled" ).length !== 2 ) { + rbuggyQSA.push( ":enabled", ":disabled" ); + } + + // Support: IE9-11+ + // IE's :disabled selector does not pick up the children of disabled fieldsets + docElem.appendChild( el ).disabled = true; + if ( el.querySelectorAll( ":disabled" ).length !== 2 ) { + rbuggyQSA.push( ":enabled", ":disabled" ); + } + + // Support: Opera 10 - 11 only + // Opera 10-11 does not throw on post-comma invalid pseudos + el.querySelectorAll( "*,:x" ); + rbuggyQSA.push( ",.*:" ); + } ); + } + + if ( ( support.matchesSelector = rnative.test( ( matches = docElem.matches || + docElem.webkitMatchesSelector || + docElem.mozMatchesSelector || + docElem.oMatchesSelector || + docElem.msMatchesSelector ) ) ) ) { + + assert( function( el ) { + + // Check to see if it's possible to do matchesSelector + // on a disconnected node (IE 9) + support.disconnectedMatch = matches.call( el, "*" ); + + // This should fail with an exception + // Gecko does not error, returns false instead + matches.call( el, "[s!='']:x" ); + rbuggyMatches.push( "!=", pseudos ); + } ); + } + + rbuggyQSA = rbuggyQSA.length && new RegExp( rbuggyQSA.join( "|" ) ); + rbuggyMatches = rbuggyMatches.length && new RegExp( rbuggyMatches.join( "|" ) ); + + /* Contains + ---------------------------------------------------------------------- */ + hasCompare = rnative.test( docElem.compareDocumentPosition ); + + // Element contains another + // Purposefully self-exclusive + // As in, an element does not contain itself + contains = hasCompare || rnative.test( docElem.contains ) ? + function( a, b ) { + var adown = a.nodeType === 9 ? a.documentElement : a, + bup = b && b.parentNode; + return a === bup || !!( bup && bup.nodeType === 1 && ( + adown.contains ? + adown.contains( bup ) : + a.compareDocumentPosition && a.compareDocumentPosition( bup ) & 16 + ) ); + } : + function( a, b ) { + if ( b ) { + while ( ( b = b.parentNode ) ) { + if ( b === a ) { + return true; + } + } + } + return false; + }; + + /* Sorting + ---------------------------------------------------------------------- */ + + // Document order sorting + sortOrder = hasCompare ? + function( a, b ) { + + // Flag for duplicate removal + if ( a === b ) { + hasDuplicate = true; + return 0; + } + + // Sort on method existence if only one input has compareDocumentPosition + var compare = !a.compareDocumentPosition - !b.compareDocumentPosition; + if ( compare ) { + return compare; + } + + // Calculate position if both inputs belong to the same document + // Support: IE 11+, Edge 17 - 18+ + // IE/Edge sometimes throw a "Permission denied" error when strict-comparing + // two documents; shallow comparisons work. + // eslint-disable-next-line eqeqeq + compare = ( a.ownerDocument || a ) == ( b.ownerDocument || b ) ? + a.compareDocumentPosition( b ) : + + // Otherwise we know they are disconnected + 1; + + // Disconnected nodes + if ( compare & 1 || + ( !support.sortDetached && b.compareDocumentPosition( a ) === compare ) ) { + + // Choose the first element that is related to our preferred document + // Support: IE 11+, Edge 17 - 18+ + // IE/Edge sometimes throw a "Permission denied" error when strict-comparing + // two documents; shallow comparisons work. + // eslint-disable-next-line eqeqeq + if ( a == document || a.ownerDocument == preferredDoc && + contains( preferredDoc, a ) ) { + return -1; + } + + // Support: IE 11+, Edge 17 - 18+ + // IE/Edge sometimes throw a "Permission denied" error when strict-comparing + // two documents; shallow comparisons work. + // eslint-disable-next-line eqeqeq + if ( b == document || b.ownerDocument == preferredDoc && + contains( preferredDoc, b ) ) { + return 1; + } + + // Maintain original order + return sortInput ? + ( indexOf( sortInput, a ) - indexOf( sortInput, b ) ) : + 0; + } + + return compare & 4 ? -1 : 1; + } : + function( a, b ) { + + // Exit early if the nodes are identical + if ( a === b ) { + hasDuplicate = true; + return 0; + } + + var cur, + i = 0, + aup = a.parentNode, + bup = b.parentNode, + ap = [ a ], + bp = [ b ]; + + // Parentless nodes are either documents or disconnected + if ( !aup || !bup ) { + + // Support: IE 11+, Edge 17 - 18+ + // IE/Edge sometimes throw a "Permission denied" error when strict-comparing + // two documents; shallow comparisons work. + /* eslint-disable eqeqeq */ + return a == document ? -1 : + b == document ? 1 : + /* eslint-enable eqeqeq */ + aup ? -1 : + bup ? 1 : + sortInput ? + ( indexOf( sortInput, a ) - indexOf( sortInput, b ) ) : + 0; + + // If the nodes are siblings, we can do a quick check + } else if ( aup === bup ) { + return siblingCheck( a, b ); + } + + // Otherwise we need full lists of their ancestors for comparison + cur = a; + while ( ( cur = cur.parentNode ) ) { + ap.unshift( cur ); + } + cur = b; + while ( ( cur = cur.parentNode ) ) { + bp.unshift( cur ); + } + + // Walk down the tree looking for a discrepancy + while ( ap[ i ] === bp[ i ] ) { + i++; + } + + return i ? + + // Do a sibling check if the nodes have a common ancestor + siblingCheck( ap[ i ], bp[ i ] ) : + + // Otherwise nodes in our document sort first + // Support: IE 11+, Edge 17 - 18+ + // IE/Edge sometimes throw a "Permission denied" error when strict-comparing + // two documents; shallow comparisons work. + /* eslint-disable eqeqeq */ + ap[ i ] == preferredDoc ? -1 : + bp[ i ] == preferredDoc ? 1 : + /* eslint-enable eqeqeq */ + 0; + }; + + return document; +}; + +Sizzle.matches = function( expr, elements ) { + return Sizzle( expr, null, null, elements ); +}; + +Sizzle.matchesSelector = function( elem, expr ) { + setDocument( elem ); + + if ( support.matchesSelector && documentIsHTML && + !nonnativeSelectorCache[ expr + " " ] && + ( !rbuggyMatches || !rbuggyMatches.test( expr ) ) && + ( !rbuggyQSA || !rbuggyQSA.test( expr ) ) ) { + + try { + var ret = matches.call( elem, expr ); + + // IE 9's matchesSelector returns false on disconnected nodes + if ( ret || support.disconnectedMatch || + + // As well, disconnected nodes are said to be in a document + // fragment in IE 9 + elem.document && elem.document.nodeType !== 11 ) { + return ret; + } + } catch ( e ) { + nonnativeSelectorCache( expr, true ); + } + } + + return Sizzle( expr, document, null, [ elem ] ).length > 0; +}; + +Sizzle.contains = function( context, elem ) { + + // Set document vars if needed + // Support: IE 11+, Edge 17 - 18+ + // IE/Edge sometimes throw a "Permission denied" error when strict-comparing + // two documents; shallow comparisons work. + // eslint-disable-next-line eqeqeq + if ( ( context.ownerDocument || context ) != document ) { + setDocument( context ); + } + return contains( context, elem ); +}; + +Sizzle.attr = function( elem, name ) { + + // Set document vars if needed + // Support: IE 11+, Edge 17 - 18+ + // IE/Edge sometimes throw a "Permission denied" error when strict-comparing + // two documents; shallow comparisons work. + // eslint-disable-next-line eqeqeq + if ( ( elem.ownerDocument || elem ) != document ) { + setDocument( elem ); + } + + var fn = Expr.attrHandle[ name.toLowerCase() ], + + // Don't get fooled by Object.prototype properties (jQuery #13807) + val = fn && hasOwn.call( Expr.attrHandle, name.toLowerCase() ) ? + fn( elem, name, !documentIsHTML ) : + undefined; + + return val !== undefined ? + val : + support.attributes || !documentIsHTML ? + elem.getAttribute( name ) : + ( val = elem.getAttributeNode( name ) ) && val.specified ? + val.value : + null; +}; + +Sizzle.escape = function( sel ) { + return ( sel + "" ).replace( rcssescape, fcssescape ); +}; + +Sizzle.error = function( msg ) { + throw new Error( "Syntax error, unrecognized expression: " + msg ); +}; + +/** + * Document sorting and removing duplicates + * @param {ArrayLike} results + */ +Sizzle.uniqueSort = function( results ) { + var elem, + duplicates = [], + j = 0, + i = 0; + + // Unless we *know* we can detect duplicates, assume their presence + hasDuplicate = !support.detectDuplicates; + sortInput = !support.sortStable && results.slice( 0 ); + results.sort( sortOrder ); + + if ( hasDuplicate ) { + while ( ( elem = results[ i++ ] ) ) { + if ( elem === results[ i ] ) { + j = duplicates.push( i ); + } + } + while ( j-- ) { + results.splice( duplicates[ j ], 1 ); + } + } + + // Clear input after sorting to release objects + // See https://github.com/jquery/sizzle/pull/225 + sortInput = null; + + return results; +}; + +/** + * Utility function for retrieving the text value of an array of DOM nodes + * @param {Array|Element} elem + */ +getText = Sizzle.getText = function( elem ) { + var node, + ret = "", + i = 0, + nodeType = elem.nodeType; + + if ( !nodeType ) { + + // If no nodeType, this is expected to be an array + while ( ( node = elem[ i++ ] ) ) { + + // Do not traverse comment nodes + ret += getText( node ); + } + } else if ( nodeType === 1 || nodeType === 9 || nodeType === 11 ) { + + // Use textContent for elements + // innerText usage removed for consistency of new lines (jQuery #11153) + if ( typeof elem.textContent === "string" ) { + return elem.textContent; + } else { + + // Traverse its children + for ( elem = elem.firstChild; elem; elem = elem.nextSibling ) { + ret += getText( elem ); + } + } + } else if ( nodeType === 3 || nodeType === 4 ) { + return elem.nodeValue; + } + + // Do not include comment or processing instruction nodes + + return ret; +}; + +Expr = Sizzle.selectors = { + + // Can be adjusted by the user + cacheLength: 50, + + createPseudo: markFunction, + + match: matchExpr, + + attrHandle: {}, + + find: {}, + + relative: { + ">": { dir: "parentNode", first: true }, + " ": { dir: "parentNode" }, + "+": { dir: "previousSibling", first: true }, + "~": { dir: "previousSibling" } + }, + + preFilter: { + "ATTR": function( match ) { + match[ 1 ] = match[ 1 ].replace( runescape, funescape ); + + // Move the given value to match[3] whether quoted or unquoted + match[ 3 ] = ( match[ 3 ] || match[ 4 ] || + match[ 5 ] || "" ).replace( runescape, funescape ); + + if ( match[ 2 ] === "~=" ) { + match[ 3 ] = " " + match[ 3 ] + " "; + } + + return match.slice( 0, 4 ); + }, + + "CHILD": function( match ) { + + /* matches from matchExpr["CHILD"] + 1 type (only|nth|...) + 2 what (child|of-type) + 3 argument (even|odd|\d*|\d*n([+-]\d+)?|...) + 4 xn-component of xn+y argument ([+-]?\d*n|) + 5 sign of xn-component + 6 x of xn-component + 7 sign of y-component + 8 y of y-component + */ + match[ 1 ] = match[ 1 ].toLowerCase(); + + if ( match[ 1 ].slice( 0, 3 ) === "nth" ) { + + // nth-* requires argument + if ( !match[ 3 ] ) { + Sizzle.error( match[ 0 ] ); + } + + // numeric x and y parameters for Expr.filter.CHILD + // remember that false/true cast respectively to 0/1 + match[ 4 ] = +( match[ 4 ] ? + match[ 5 ] + ( match[ 6 ] || 1 ) : + 2 * ( match[ 3 ] === "even" || match[ 3 ] === "odd" ) ); + match[ 5 ] = +( ( match[ 7 ] + match[ 8 ] ) || match[ 3 ] === "odd" ); + + // other types prohibit arguments + } else if ( match[ 3 ] ) { + Sizzle.error( match[ 0 ] ); + } + + return match; + }, + + "PSEUDO": function( match ) { + var excess, + unquoted = !match[ 6 ] && match[ 2 ]; + + if ( matchExpr[ "CHILD" ].test( match[ 0 ] ) ) { + return null; + } + + // Accept quoted arguments as-is + if ( match[ 3 ] ) { + match[ 2 ] = match[ 4 ] || match[ 5 ] || ""; + + // Strip excess characters from unquoted arguments + } else if ( unquoted && rpseudo.test( unquoted ) && + + // Get excess from tokenize (recursively) + ( excess = tokenize( unquoted, true ) ) && + + // advance to the next closing parenthesis + ( excess = unquoted.indexOf( ")", unquoted.length - excess ) - unquoted.length ) ) { + + // excess is a negative index + match[ 0 ] = match[ 0 ].slice( 0, excess ); + match[ 2 ] = unquoted.slice( 0, excess ); + } + + // Return only captures needed by the pseudo filter method (type and argument) + return match.slice( 0, 3 ); + } + }, + + filter: { + + "TAG": function( nodeNameSelector ) { + var nodeName = nodeNameSelector.replace( runescape, funescape ).toLowerCase(); + return nodeNameSelector === "*" ? + function() { + return true; + } : + function( elem ) { + return elem.nodeName && elem.nodeName.toLowerCase() === nodeName; + }; + }, + + "CLASS": function( className ) { + var pattern = classCache[ className + " " ]; + + return pattern || + ( pattern = new RegExp( "(^|" + whitespace + + ")" + className + "(" + whitespace + "|$)" ) ) && classCache( + className, function( elem ) { + return pattern.test( + typeof elem.className === "string" && elem.className || + typeof elem.getAttribute !== "undefined" && + elem.getAttribute( "class" ) || + "" + ); + } ); + }, + + "ATTR": function( name, operator, check ) { + return function( elem ) { + var result = Sizzle.attr( elem, name ); + + if ( result == null ) { + return operator === "!="; + } + if ( !operator ) { + return true; + } + + result += ""; + + /* eslint-disable max-len */ + + return operator === "=" ? result === check : + operator === "!=" ? result !== check : + operator === "^=" ? check && result.indexOf( check ) === 0 : + operator === "*=" ? check && result.indexOf( check ) > -1 : + operator === "$=" ? check && result.slice( -check.length ) === check : + operator === "~=" ? ( " " + result.replace( rwhitespace, " " ) + " " ).indexOf( check ) > -1 : + operator === "|=" ? result === check || result.slice( 0, check.length + 1 ) === check + "-" : + false; + /* eslint-enable max-len */ + + }; + }, + + "CHILD": function( type, what, _argument, first, last ) { + var simple = type.slice( 0, 3 ) !== "nth", + forward = type.slice( -4 ) !== "last", + ofType = what === "of-type"; + + return first === 1 && last === 0 ? + + // Shortcut for :nth-*(n) + function( elem ) { + return !!elem.parentNode; + } : + + function( elem, _context, xml ) { + var cache, uniqueCache, outerCache, node, nodeIndex, start, + dir = simple !== forward ? "nextSibling" : "previousSibling", + parent = elem.parentNode, + name = ofType && elem.nodeName.toLowerCase(), + useCache = !xml && !ofType, + diff = false; + + if ( parent ) { + + // :(first|last|only)-(child|of-type) + if ( simple ) { + while ( dir ) { + node = elem; + while ( ( node = node[ dir ] ) ) { + if ( ofType ? + node.nodeName.toLowerCase() === name : + node.nodeType === 1 ) { + + return false; + } + } + + // Reverse direction for :only-* (if we haven't yet done so) + start = dir = type === "only" && !start && "nextSibling"; + } + return true; + } + + start = [ forward ? parent.firstChild : parent.lastChild ]; + + // non-xml :nth-child(...) stores cache data on `parent` + if ( forward && useCache ) { + + // Seek `elem` from a previously-cached index + + // ...in a gzip-friendly way + node = parent; + outerCache = node[ expando ] || ( node[ expando ] = {} ); + + // Support: IE <9 only + // Defend against cloned attroperties (jQuery gh-1709) + uniqueCache = outerCache[ node.uniqueID ] || + ( outerCache[ node.uniqueID ] = {} ); + + cache = uniqueCache[ type ] || []; + nodeIndex = cache[ 0 ] === dirruns && cache[ 1 ]; + diff = nodeIndex && cache[ 2 ]; + node = nodeIndex && parent.childNodes[ nodeIndex ]; + + while ( ( node = ++nodeIndex && node && node[ dir ] || + + // Fallback to seeking `elem` from the start + ( diff = nodeIndex = 0 ) || start.pop() ) ) { + + // When found, cache indexes on `parent` and break + if ( node.nodeType === 1 && ++diff && node === elem ) { + uniqueCache[ type ] = [ dirruns, nodeIndex, diff ]; + break; + } + } + + } else { + + // Use previously-cached element index if available + if ( useCache ) { + + // ...in a gzip-friendly way + node = elem; + outerCache = node[ expando ] || ( node[ expando ] = {} ); + + // Support: IE <9 only + // Defend against cloned attroperties (jQuery gh-1709) + uniqueCache = outerCache[ node.uniqueID ] || + ( outerCache[ node.uniqueID ] = {} ); + + cache = uniqueCache[ type ] || []; + nodeIndex = cache[ 0 ] === dirruns && cache[ 1 ]; + diff = nodeIndex; + } + + // xml :nth-child(...) + // or :nth-last-child(...) or :nth(-last)?-of-type(...) + if ( diff === false ) { + + // Use the same loop as above to seek `elem` from the start + while ( ( node = ++nodeIndex && node && node[ dir ] || + ( diff = nodeIndex = 0 ) || start.pop() ) ) { + + if ( ( ofType ? + node.nodeName.toLowerCase() === name : + node.nodeType === 1 ) && + ++diff ) { + + // Cache the index of each encountered element + if ( useCache ) { + outerCache = node[ expando ] || + ( node[ expando ] = {} ); + + // Support: IE <9 only + // Defend against cloned attroperties (jQuery gh-1709) + uniqueCache = outerCache[ node.uniqueID ] || + ( outerCache[ node.uniqueID ] = {} ); + + uniqueCache[ type ] = [ dirruns, diff ]; + } + + if ( node === elem ) { + break; + } + } + } + } + } + + // Incorporate the offset, then check against cycle size + diff -= last; + return diff === first || ( diff % first === 0 && diff / first >= 0 ); + } + }; + }, + + "PSEUDO": function( pseudo, argument ) { + + // pseudo-class names are case-insensitive + // http://www.w3.org/TR/selectors/#pseudo-classes + // Prioritize by case sensitivity in case custom pseudos are added with uppercase letters + // Remember that setFilters inherits from pseudos + var args, + fn = Expr.pseudos[ pseudo ] || Expr.setFilters[ pseudo.toLowerCase() ] || + Sizzle.error( "unsupported pseudo: " + pseudo ); + + // The user may use createPseudo to indicate that + // arguments are needed to create the filter function + // just as Sizzle does + if ( fn[ expando ] ) { + return fn( argument ); + } + + // But maintain support for old signatures + if ( fn.length > 1 ) { + args = [ pseudo, pseudo, "", argument ]; + return Expr.setFilters.hasOwnProperty( pseudo.toLowerCase() ) ? + markFunction( function( seed, matches ) { + var idx, + matched = fn( seed, argument ), + i = matched.length; + while ( i-- ) { + idx = indexOf( seed, matched[ i ] ); + seed[ idx ] = !( matches[ idx ] = matched[ i ] ); + } + } ) : + function( elem ) { + return fn( elem, 0, args ); + }; + } + + return fn; + } + }, + + pseudos: { + + // Potentially complex pseudos + "not": markFunction( function( selector ) { + + // Trim the selector passed to compile + // to avoid treating leading and trailing + // spaces as combinators + var input = [], + results = [], + matcher = compile( selector.replace( rtrim, "$1" ) ); + + return matcher[ expando ] ? + markFunction( function( seed, matches, _context, xml ) { + var elem, + unmatched = matcher( seed, null, xml, [] ), + i = seed.length; + + // Match elements unmatched by `matcher` + while ( i-- ) { + if ( ( elem = unmatched[ i ] ) ) { + seed[ i ] = !( matches[ i ] = elem ); + } + } + } ) : + function( elem, _context, xml ) { + input[ 0 ] = elem; + matcher( input, null, xml, results ); + + // Don't keep the element (issue #299) + input[ 0 ] = null; + return !results.pop(); + }; + } ), + + "has": markFunction( function( selector ) { + return function( elem ) { + return Sizzle( selector, elem ).length > 0; + }; + } ), + + "contains": markFunction( function( text ) { + text = text.replace( runescape, funescape ); + return function( elem ) { + return ( elem.textContent || getText( elem ) ).indexOf( text ) > -1; + }; + } ), + + // "Whether an element is represented by a :lang() selector + // is based solely on the element's language value + // being equal to the identifier C, + // or beginning with the identifier C immediately followed by "-". + // The matching of C against the element's language value is performed case-insensitively. + // The identifier C does not have to be a valid language name." + // http://www.w3.org/TR/selectors/#lang-pseudo + "lang": markFunction( function( lang ) { + + // lang value must be a valid identifier + if ( !ridentifier.test( lang || "" ) ) { + Sizzle.error( "unsupported lang: " + lang ); + } + lang = lang.replace( runescape, funescape ).toLowerCase(); + return function( elem ) { + var elemLang; + do { + if ( ( elemLang = documentIsHTML ? + elem.lang : + elem.getAttribute( "xml:lang" ) || elem.getAttribute( "lang" ) ) ) { + + elemLang = elemLang.toLowerCase(); + return elemLang === lang || elemLang.indexOf( lang + "-" ) === 0; + } + } while ( ( elem = elem.parentNode ) && elem.nodeType === 1 ); + return false; + }; + } ), + + // Miscellaneous + "target": function( elem ) { + var hash = window.location && window.location.hash; + return hash && hash.slice( 1 ) === elem.id; + }, + + "root": function( elem ) { + return elem === docElem; + }, + + "focus": function( elem ) { + return elem === document.activeElement && + ( !document.hasFocus || document.hasFocus() ) && + !!( elem.type || elem.href || ~elem.tabIndex ); + }, + + // Boolean properties + "enabled": createDisabledPseudo( false ), + "disabled": createDisabledPseudo( true ), + + "checked": function( elem ) { + + // In CSS3, :checked should return both checked and selected elements + // http://www.w3.org/TR/2011/REC-css3-selectors-20110929/#checked + var nodeName = elem.nodeName.toLowerCase(); + return ( nodeName === "input" && !!elem.checked ) || + ( nodeName === "option" && !!elem.selected ); + }, + + "selected": function( elem ) { + + // Accessing this property makes selected-by-default + // options in Safari work properly + if ( elem.parentNode ) { + // eslint-disable-next-line no-unused-expressions + elem.parentNode.selectedIndex; + } + + return elem.selected === true; + }, + + // Contents + "empty": function( elem ) { + + // http://www.w3.org/TR/selectors/#empty-pseudo + // :empty is negated by element (1) or content nodes (text: 3; cdata: 4; entity ref: 5), + // but not by others (comment: 8; processing instruction: 7; etc.) + // nodeType < 6 works because attributes (2) do not appear as children + for ( elem = elem.firstChild; elem; elem = elem.nextSibling ) { + if ( elem.nodeType < 6 ) { + return false; + } + } + return true; + }, + + "parent": function( elem ) { + return !Expr.pseudos[ "empty" ]( elem ); + }, + + // Element/input types + "header": function( elem ) { + return rheader.test( elem.nodeName ); + }, + + "input": function( elem ) { + return rinputs.test( elem.nodeName ); + }, + + "button": function( elem ) { + var name = elem.nodeName.toLowerCase(); + return name === "input" && elem.type === "button" || name === "button"; + }, + + "text": function( elem ) { + var attr; + return elem.nodeName.toLowerCase() === "input" && + elem.type === "text" && + + // Support: IE<8 + // New HTML5 attribute values (e.g., "search") appear with elem.type === "text" + ( ( attr = elem.getAttribute( "type" ) ) == null || + attr.toLowerCase() === "text" ); + }, + + // Position-in-collection + "first": createPositionalPseudo( function() { + return [ 0 ]; + } ), + + "last": createPositionalPseudo( function( _matchIndexes, length ) { + return [ length - 1 ]; + } ), + + "eq": createPositionalPseudo( function( _matchIndexes, length, argument ) { + return [ argument < 0 ? argument + length : argument ]; + } ), + + "even": createPositionalPseudo( function( matchIndexes, length ) { + var i = 0; + for ( ; i < length; i += 2 ) { + matchIndexes.push( i ); + } + return matchIndexes; + } ), + + "odd": createPositionalPseudo( function( matchIndexes, length ) { + var i = 1; + for ( ; i < length; i += 2 ) { + matchIndexes.push( i ); + } + return matchIndexes; + } ), + + "lt": createPositionalPseudo( function( matchIndexes, length, argument ) { + var i = argument < 0 ? + argument + length : + argument > length ? + length : + argument; + for ( ; --i >= 0; ) { + matchIndexes.push( i ); + } + return matchIndexes; + } ), + + "gt": createPositionalPseudo( function( matchIndexes, length, argument ) { + var i = argument < 0 ? argument + length : argument; + for ( ; ++i < length; ) { + matchIndexes.push( i ); + } + return matchIndexes; + } ) + } +}; + +Expr.pseudos[ "nth" ] = Expr.pseudos[ "eq" ]; + +// Add button/input type pseudos +for ( i in { radio: true, checkbox: true, file: true, password: true, image: true } ) { + Expr.pseudos[ i ] = createInputPseudo( i ); +} +for ( i in { submit: true, reset: true } ) { + Expr.pseudos[ i ] = createButtonPseudo( i ); +} + +// Easy API for creating new setFilters +function setFilters() {} +setFilters.prototype = Expr.filters = Expr.pseudos; +Expr.setFilters = new setFilters(); + +tokenize = Sizzle.tokenize = function( selector, parseOnly ) { + var matched, match, tokens, type, + soFar, groups, preFilters, + cached = tokenCache[ selector + " " ]; + + if ( cached ) { + return parseOnly ? 0 : cached.slice( 0 ); + } + + soFar = selector; + groups = []; + preFilters = Expr.preFilter; + + while ( soFar ) { + + // Comma and first run + if ( !matched || ( match = rcomma.exec( soFar ) ) ) { + if ( match ) { + + // Don't consume trailing commas as valid + soFar = soFar.slice( match[ 0 ].length ) || soFar; + } + groups.push( ( tokens = [] ) ); + } + + matched = false; + + // Combinators + if ( ( match = rcombinators.exec( soFar ) ) ) { + matched = match.shift(); + tokens.push( { + value: matched, + + // Cast descendant combinators to space + type: match[ 0 ].replace( rtrim, " " ) + } ); + soFar = soFar.slice( matched.length ); + } + + // Filters + for ( type in Expr.filter ) { + if ( ( match = matchExpr[ type ].exec( soFar ) ) && ( !preFilters[ type ] || + ( match = preFilters[ type ]( match ) ) ) ) { + matched = match.shift(); + tokens.push( { + value: matched, + type: type, + matches: match + } ); + soFar = soFar.slice( matched.length ); + } + } + + if ( !matched ) { + break; + } + } + + // Return the length of the invalid excess + // if we're just parsing + // Otherwise, throw an error or return tokens + return parseOnly ? + soFar.length : + soFar ? + Sizzle.error( selector ) : + + // Cache the tokens + tokenCache( selector, groups ).slice( 0 ); +}; + +function toSelector( tokens ) { + var i = 0, + len = tokens.length, + selector = ""; + for ( ; i < len; i++ ) { + selector += tokens[ i ].value; + } + return selector; +} + +function addCombinator( matcher, combinator, base ) { + var dir = combinator.dir, + skip = combinator.next, + key = skip || dir, + checkNonElements = base && key === "parentNode", + doneName = done++; + + return combinator.first ? + + // Check against closest ancestor/preceding element + function( elem, context, xml ) { + while ( ( elem = elem[ dir ] ) ) { + if ( elem.nodeType === 1 || checkNonElements ) { + return matcher( elem, context, xml ); + } + } + return false; + } : + + // Check against all ancestor/preceding elements + function( elem, context, xml ) { + var oldCache, uniqueCache, outerCache, + newCache = [ dirruns, doneName ]; + + // We can't set arbitrary data on XML nodes, so they don't benefit from combinator caching + if ( xml ) { + while ( ( elem = elem[ dir ] ) ) { + if ( elem.nodeType === 1 || checkNonElements ) { + if ( matcher( elem, context, xml ) ) { + return true; + } + } + } + } else { + while ( ( elem = elem[ dir ] ) ) { + if ( elem.nodeType === 1 || checkNonElements ) { + outerCache = elem[ expando ] || ( elem[ expando ] = {} ); + + // Support: IE <9 only + // Defend against cloned attroperties (jQuery gh-1709) + uniqueCache = outerCache[ elem.uniqueID ] || + ( outerCache[ elem.uniqueID ] = {} ); + + if ( skip && skip === elem.nodeName.toLowerCase() ) { + elem = elem[ dir ] || elem; + } else if ( ( oldCache = uniqueCache[ key ] ) && + oldCache[ 0 ] === dirruns && oldCache[ 1 ] === doneName ) { + + // Assign to newCache so results back-propagate to previous elements + return ( newCache[ 2 ] = oldCache[ 2 ] ); + } else { + + // Reuse newcache so results back-propagate to previous elements + uniqueCache[ key ] = newCache; + + // A match means we're done; a fail means we have to keep checking + if ( ( newCache[ 2 ] = matcher( elem, context, xml ) ) ) { + return true; + } + } + } + } + } + return false; + }; +} + +function elementMatcher( matchers ) { + return matchers.length > 1 ? + function( elem, context, xml ) { + var i = matchers.length; + while ( i-- ) { + if ( !matchers[ i ]( elem, context, xml ) ) { + return false; + } + } + return true; + } : + matchers[ 0 ]; +} + +function multipleContexts( selector, contexts, results ) { + var i = 0, + len = contexts.length; + for ( ; i < len; i++ ) { + Sizzle( selector, contexts[ i ], results ); + } + return results; +} + +function condense( unmatched, map, filter, context, xml ) { + var elem, + newUnmatched = [], + i = 0, + len = unmatched.length, + mapped = map != null; + + for ( ; i < len; i++ ) { + if ( ( elem = unmatched[ i ] ) ) { + if ( !filter || filter( elem, context, xml ) ) { + newUnmatched.push( elem ); + if ( mapped ) { + map.push( i ); + } + } + } + } + + return newUnmatched; +} + +function setMatcher( preFilter, selector, matcher, postFilter, postFinder, postSelector ) { + if ( postFilter && !postFilter[ expando ] ) { + postFilter = setMatcher( postFilter ); + } + if ( postFinder && !postFinder[ expando ] ) { + postFinder = setMatcher( postFinder, postSelector ); + } + return markFunction( function( seed, results, context, xml ) { + var temp, i, elem, + preMap = [], + postMap = [], + preexisting = results.length, + + // Get initial elements from seed or context + elems = seed || multipleContexts( + selector || "*", + context.nodeType ? [ context ] : context, + [] + ), + + // Prefilter to get matcher input, preserving a map for seed-results synchronization + matcherIn = preFilter && ( seed || !selector ) ? + condense( elems, preMap, preFilter, context, xml ) : + elems, + + matcherOut = matcher ? + + // If we have a postFinder, or filtered seed, or non-seed postFilter or preexisting results, + postFinder || ( seed ? preFilter : preexisting || postFilter ) ? + + // ...intermediate processing is necessary + [] : + + // ...otherwise use results directly + results : + matcherIn; + + // Find primary matches + if ( matcher ) { + matcher( matcherIn, matcherOut, context, xml ); + } + + // Apply postFilter + if ( postFilter ) { + temp = condense( matcherOut, postMap ); + postFilter( temp, [], context, xml ); + + // Un-match failing elements by moving them back to matcherIn + i = temp.length; + while ( i-- ) { + if ( ( elem = temp[ i ] ) ) { + matcherOut[ postMap[ i ] ] = !( matcherIn[ postMap[ i ] ] = elem ); + } + } + } + + if ( seed ) { + if ( postFinder || preFilter ) { + if ( postFinder ) { + + // Get the final matcherOut by condensing this intermediate into postFinder contexts + temp = []; + i = matcherOut.length; + while ( i-- ) { + if ( ( elem = matcherOut[ i ] ) ) { + + // Restore matcherIn since elem is not yet a final match + temp.push( ( matcherIn[ i ] = elem ) ); + } + } + postFinder( null, ( matcherOut = [] ), temp, xml ); + } + + // Move matched elements from seed to results to keep them synchronized + i = matcherOut.length; + while ( i-- ) { + if ( ( elem = matcherOut[ i ] ) && + ( temp = postFinder ? indexOf( seed, elem ) : preMap[ i ] ) > -1 ) { + + seed[ temp ] = !( results[ temp ] = elem ); + } + } + } + + // Add elements to results, through postFinder if defined + } else { + matcherOut = condense( + matcherOut === results ? + matcherOut.splice( preexisting, matcherOut.length ) : + matcherOut + ); + if ( postFinder ) { + postFinder( null, results, matcherOut, xml ); + } else { + push.apply( results, matcherOut ); + } + } + } ); +} + +function matcherFromTokens( tokens ) { + var checkContext, matcher, j, + len = tokens.length, + leadingRelative = Expr.relative[ tokens[ 0 ].type ], + implicitRelative = leadingRelative || Expr.relative[ " " ], + i = leadingRelative ? 1 : 0, + + // The foundational matcher ensures that elements are reachable from top-level context(s) + matchContext = addCombinator( function( elem ) { + return elem === checkContext; + }, implicitRelative, true ), + matchAnyContext = addCombinator( function( elem ) { + return indexOf( checkContext, elem ) > -1; + }, implicitRelative, true ), + matchers = [ function( elem, context, xml ) { + var ret = ( !leadingRelative && ( xml || context !== outermostContext ) ) || ( + ( checkContext = context ).nodeType ? + matchContext( elem, context, xml ) : + matchAnyContext( elem, context, xml ) ); + + // Avoid hanging onto element (issue #299) + checkContext = null; + return ret; + } ]; + + for ( ; i < len; i++ ) { + if ( ( matcher = Expr.relative[ tokens[ i ].type ] ) ) { + matchers = [ addCombinator( elementMatcher( matchers ), matcher ) ]; + } else { + matcher = Expr.filter[ tokens[ i ].type ].apply( null, tokens[ i ].matches ); + + // Return special upon seeing a positional matcher + if ( matcher[ expando ] ) { + + // Find the next relative operator (if any) for proper handling + j = ++i; + for ( ; j < len; j++ ) { + if ( Expr.relative[ tokens[ j ].type ] ) { + break; + } + } + return setMatcher( + i > 1 && elementMatcher( matchers ), + i > 1 && toSelector( + + // If the preceding token was a descendant combinator, insert an implicit any-element `*` + tokens + .slice( 0, i - 1 ) + .concat( { value: tokens[ i - 2 ].type === " " ? "*" : "" } ) + ).replace( rtrim, "$1" ), + matcher, + i < j && matcherFromTokens( tokens.slice( i, j ) ), + j < len && matcherFromTokens( ( tokens = tokens.slice( j ) ) ), + j < len && toSelector( tokens ) + ); + } + matchers.push( matcher ); + } + } + + return elementMatcher( matchers ); +} + +function matcherFromGroupMatchers( elementMatchers, setMatchers ) { + var bySet = setMatchers.length > 0, + byElement = elementMatchers.length > 0, + superMatcher = function( seed, context, xml, results, outermost ) { + var elem, j, matcher, + matchedCount = 0, + i = "0", + unmatched = seed && [], + setMatched = [], + contextBackup = outermostContext, + + // We must always have either seed elements or outermost context + elems = seed || byElement && Expr.find[ "TAG" ]( "*", outermost ), + + // Use integer dirruns iff this is the outermost matcher + dirrunsUnique = ( dirruns += contextBackup == null ? 1 : Math.random() || 0.1 ), + len = elems.length; + + if ( outermost ) { + + // Support: IE 11+, Edge 17 - 18+ + // IE/Edge sometimes throw a "Permission denied" error when strict-comparing + // two documents; shallow comparisons work. + // eslint-disable-next-line eqeqeq + outermostContext = context == document || context || outermost; + } + + // Add elements passing elementMatchers directly to results + // Support: IE<9, Safari + // Tolerate NodeList properties (IE: "length"; Safari: ) matching elements by id + for ( ; i !== len && ( elem = elems[ i ] ) != null; i++ ) { + if ( byElement && elem ) { + j = 0; + + // Support: IE 11+, Edge 17 - 18+ + // IE/Edge sometimes throw a "Permission denied" error when strict-comparing + // two documents; shallow comparisons work. + // eslint-disable-next-line eqeqeq + if ( !context && elem.ownerDocument != document ) { + setDocument( elem ); + xml = !documentIsHTML; + } + while ( ( matcher = elementMatchers[ j++ ] ) ) { + if ( matcher( elem, context || document, xml ) ) { + results.push( elem ); + break; + } + } + if ( outermost ) { + dirruns = dirrunsUnique; + } + } + + // Track unmatched elements for set filters + if ( bySet ) { + + // They will have gone through all possible matchers + if ( ( elem = !matcher && elem ) ) { + matchedCount--; + } + + // Lengthen the array for every element, matched or not + if ( seed ) { + unmatched.push( elem ); + } + } + } + + // `i` is now the count of elements visited above, and adding it to `matchedCount` + // makes the latter nonnegative. + matchedCount += i; + + // Apply set filters to unmatched elements + // NOTE: This can be skipped if there are no unmatched elements (i.e., `matchedCount` + // equals `i`), unless we didn't visit _any_ elements in the above loop because we have + // no element matchers and no seed. + // Incrementing an initially-string "0" `i` allows `i` to remain a string only in that + // case, which will result in a "00" `matchedCount` that differs from `i` but is also + // numerically zero. + if ( bySet && i !== matchedCount ) { + j = 0; + while ( ( matcher = setMatchers[ j++ ] ) ) { + matcher( unmatched, setMatched, context, xml ); + } + + if ( seed ) { + + // Reintegrate element matches to eliminate the need for sorting + if ( matchedCount > 0 ) { + while ( i-- ) { + if ( !( unmatched[ i ] || setMatched[ i ] ) ) { + setMatched[ i ] = pop.call( results ); + } + } + } + + // Discard index placeholder values to get only actual matches + setMatched = condense( setMatched ); + } + + // Add matches to results + push.apply( results, setMatched ); + + // Seedless set matches succeeding multiple successful matchers stipulate sorting + if ( outermost && !seed && setMatched.length > 0 && + ( matchedCount + setMatchers.length ) > 1 ) { + + Sizzle.uniqueSort( results ); + } + } + + // Override manipulation of globals by nested matchers + if ( outermost ) { + dirruns = dirrunsUnique; + outermostContext = contextBackup; + } + + return unmatched; + }; + + return bySet ? + markFunction( superMatcher ) : + superMatcher; +} + +compile = Sizzle.compile = function( selector, match /* Internal Use Only */ ) { + var i, + setMatchers = [], + elementMatchers = [], + cached = compilerCache[ selector + " " ]; + + if ( !cached ) { + + // Generate a function of recursive functions that can be used to check each element + if ( !match ) { + match = tokenize( selector ); + } + i = match.length; + while ( i-- ) { + cached = matcherFromTokens( match[ i ] ); + if ( cached[ expando ] ) { + setMatchers.push( cached ); + } else { + elementMatchers.push( cached ); + } + } + + // Cache the compiled function + cached = compilerCache( + selector, + matcherFromGroupMatchers( elementMatchers, setMatchers ) + ); + + // Save selector and tokenization + cached.selector = selector; + } + return cached; +}; + +/** + * A low-level selection function that works with Sizzle's compiled + * selector functions + * @param {String|Function} selector A selector or a pre-compiled + * selector function built with Sizzle.compile + * @param {Element} context + * @param {Array} [results] + * @param {Array} [seed] A set of elements to match against + */ +select = Sizzle.select = function( selector, context, results, seed ) { + var i, tokens, token, type, find, + compiled = typeof selector === "function" && selector, + match = !seed && tokenize( ( selector = compiled.selector || selector ) ); + + results = results || []; + + // Try to minimize operations if there is only one selector in the list and no seed + // (the latter of which guarantees us context) + if ( match.length === 1 ) { + + // Reduce context if the leading compound selector is an ID + tokens = match[ 0 ] = match[ 0 ].slice( 0 ); + if ( tokens.length > 2 && ( token = tokens[ 0 ] ).type === "ID" && + context.nodeType === 9 && documentIsHTML && Expr.relative[ tokens[ 1 ].type ] ) { + + context = ( Expr.find[ "ID" ]( token.matches[ 0 ] + .replace( runescape, funescape ), context ) || [] )[ 0 ]; + if ( !context ) { + return results; + + // Precompiled matchers will still verify ancestry, so step up a level + } else if ( compiled ) { + context = context.parentNode; + } + + selector = selector.slice( tokens.shift().value.length ); + } + + // Fetch a seed set for right-to-left matching + i = matchExpr[ "needsContext" ].test( selector ) ? 0 : tokens.length; + while ( i-- ) { + token = tokens[ i ]; + + // Abort if we hit a combinator + if ( Expr.relative[ ( type = token.type ) ] ) { + break; + } + if ( ( find = Expr.find[ type ] ) ) { + + // Search, expanding context for leading sibling combinators + if ( ( seed = find( + token.matches[ 0 ].replace( runescape, funescape ), + rsibling.test( tokens[ 0 ].type ) && testContext( context.parentNode ) || + context + ) ) ) { + + // If seed is empty or no tokens remain, we can return early + tokens.splice( i, 1 ); + selector = seed.length && toSelector( tokens ); + if ( !selector ) { + push.apply( results, seed ); + return results; + } + + break; + } + } + } + } + + // Compile and execute a filtering function if one is not provided + // Provide `match` to avoid retokenization if we modified the selector above + ( compiled || compile( selector, match ) )( + seed, + context, + !documentIsHTML, + results, + !context || rsibling.test( selector ) && testContext( context.parentNode ) || context + ); + return results; +}; + +// One-time assignments + +// Sort stability +support.sortStable = expando.split( "" ).sort( sortOrder ).join( "" ) === expando; + +// Support: Chrome 14-35+ +// Always assume duplicates if they aren't passed to the comparison function +support.detectDuplicates = !!hasDuplicate; + +// Initialize against the default document +setDocument(); + +// Support: Webkit<537.32 - Safari 6.0.3/Chrome 25 (fixed in Chrome 27) +// Detached nodes confoundingly follow *each other* +support.sortDetached = assert( function( el ) { + + // Should return 1, but returns 4 (following) + return el.compareDocumentPosition( document.createElement( "fieldset" ) ) & 1; +} ); + +// Support: IE<8 +// Prevent attribute/property "interpolation" +// https://msdn.microsoft.com/en-us/library/ms536429%28VS.85%29.aspx +if ( !assert( function( el ) { + el.innerHTML = ""; + return el.firstChild.getAttribute( "href" ) === "#"; +} ) ) { + addHandle( "type|href|height|width", function( elem, name, isXML ) { + if ( !isXML ) { + return elem.getAttribute( name, name.toLowerCase() === "type" ? 1 : 2 ); + } + } ); +} + +// Support: IE<9 +// Use defaultValue in place of getAttribute("value") +if ( !support.attributes || !assert( function( el ) { + el.innerHTML = ""; + el.firstChild.setAttribute( "value", "" ); + return el.firstChild.getAttribute( "value" ) === ""; +} ) ) { + addHandle( "value", function( elem, _name, isXML ) { + if ( !isXML && elem.nodeName.toLowerCase() === "input" ) { + return elem.defaultValue; + } + } ); +} + +// Support: IE<9 +// Use getAttributeNode to fetch booleans when getAttribute lies +if ( !assert( function( el ) { + return el.getAttribute( "disabled" ) == null; +} ) ) { + addHandle( booleans, function( elem, name, isXML ) { + var val; + if ( !isXML ) { + return elem[ name ] === true ? name.toLowerCase() : + ( val = elem.getAttributeNode( name ) ) && val.specified ? + val.value : + null; + } + } ); +} + +return Sizzle; + +} )( window ); + + + +jQuery.find = Sizzle; +jQuery.expr = Sizzle.selectors; + +// Deprecated +jQuery.expr[ ":" ] = jQuery.expr.pseudos; +jQuery.uniqueSort = jQuery.unique = Sizzle.uniqueSort; +jQuery.text = Sizzle.getText; +jQuery.isXMLDoc = Sizzle.isXML; +jQuery.contains = Sizzle.contains; +jQuery.escapeSelector = Sizzle.escape; + + + + +var dir = function( elem, dir, until ) { + var matched = [], + truncate = until !== undefined; + + while ( ( elem = elem[ dir ] ) && elem.nodeType !== 9 ) { + if ( elem.nodeType === 1 ) { + if ( truncate && jQuery( elem ).is( until ) ) { + break; + } + matched.push( elem ); + } + } + return matched; +}; + + +var siblings = function( n, elem ) { + var matched = []; + + for ( ; n; n = n.nextSibling ) { + if ( n.nodeType === 1 && n !== elem ) { + matched.push( n ); + } + } + + return matched; +}; + + +var rneedsContext = jQuery.expr.match.needsContext; + + + +function nodeName( elem, name ) { + + return elem.nodeName && elem.nodeName.toLowerCase() === name.toLowerCase(); + +}; +var rsingleTag = ( /^<([a-z][^\/\0>:\x20\t\r\n\f]*)[\x20\t\r\n\f]*\/?>(?:<\/\1>|)$/i ); + + + +// Implement the identical functionality for filter and not +function winnow( elements, qualifier, not ) { + if ( isFunction( qualifier ) ) { + return jQuery.grep( elements, function( elem, i ) { + return !!qualifier.call( elem, i, elem ) !== not; + } ); + } + + // Single element + if ( qualifier.nodeType ) { + return jQuery.grep( elements, function( elem ) { + return ( elem === qualifier ) !== not; + } ); + } + + // Arraylike of elements (jQuery, arguments, Array) + if ( typeof qualifier !== "string" ) { + return jQuery.grep( elements, function( elem ) { + return ( indexOf.call( qualifier, elem ) > -1 ) !== not; + } ); + } + + // Filtered directly for both simple and complex selectors + return jQuery.filter( qualifier, elements, not ); +} + +jQuery.filter = function( expr, elems, not ) { + var elem = elems[ 0 ]; + + if ( not ) { + expr = ":not(" + expr + ")"; + } + + if ( elems.length === 1 && elem.nodeType === 1 ) { + return jQuery.find.matchesSelector( elem, expr ) ? [ elem ] : []; + } + + return jQuery.find.matches( expr, jQuery.grep( elems, function( elem ) { + return elem.nodeType === 1; + } ) ); +}; + +jQuery.fn.extend( { + find: function( selector ) { + var i, ret, + len = this.length, + self = this; + + if ( typeof selector !== "string" ) { + return this.pushStack( jQuery( selector ).filter( function() { + for ( i = 0; i < len; i++ ) { + if ( jQuery.contains( self[ i ], this ) ) { + return true; + } + } + } ) ); + } + + ret = this.pushStack( [] ); + + for ( i = 0; i < len; i++ ) { + jQuery.find( selector, self[ i ], ret ); + } + + return len > 1 ? jQuery.uniqueSort( ret ) : ret; + }, + filter: function( selector ) { + return this.pushStack( winnow( this, selector || [], false ) ); + }, + not: function( selector ) { + return this.pushStack( winnow( this, selector || [], true ) ); + }, + is: function( selector ) { + return !!winnow( + this, + + // If this is a positional/relative selector, check membership in the returned set + // so $("p:first").is("p:last") won't return true for a doc with two "p". + typeof selector === "string" && rneedsContext.test( selector ) ? + jQuery( selector ) : + selector || [], + false + ).length; + } +} ); + + +// Initialize a jQuery object + + +// A central reference to the root jQuery(document) +var rootjQuery, + + // A simple way to check for HTML strings + // Prioritize #id over to avoid XSS via location.hash (#9521) + // Strict HTML recognition (#11290: must start with <) + // Shortcut simple #id case for speed + rquickExpr = /^(?:\s*(<[\w\W]+>)[^>]*|#([\w-]+))$/, + + init = jQuery.fn.init = function( selector, context, root ) { + var match, elem; + + // HANDLE: $(""), $(null), $(undefined), $(false) + if ( !selector ) { + return this; + } + + // Method init() accepts an alternate rootjQuery + // so migrate can support jQuery.sub (gh-2101) + root = root || rootjQuery; + + // Handle HTML strings + if ( typeof selector === "string" ) { + if ( selector[ 0 ] === "<" && + selector[ selector.length - 1 ] === ">" && + selector.length >= 3 ) { + + // Assume that strings that start and end with <> are HTML and skip the regex check + match = [ null, selector, null ]; + + } else { + match = rquickExpr.exec( selector ); + } + + // Match html or make sure no context is specified for #id + if ( match && ( match[ 1 ] || !context ) ) { + + // HANDLE: $(html) -> $(array) + if ( match[ 1 ] ) { + context = context instanceof jQuery ? context[ 0 ] : context; + + // Option to run scripts is true for back-compat + // Intentionally let the error be thrown if parseHTML is not present + jQuery.merge( this, jQuery.parseHTML( + match[ 1 ], + context && context.nodeType ? context.ownerDocument || context : document, + true + ) ); + + // HANDLE: $(html, props) + if ( rsingleTag.test( match[ 1 ] ) && jQuery.isPlainObject( context ) ) { + for ( match in context ) { + + // Properties of context are called as methods if possible + if ( isFunction( this[ match ] ) ) { + this[ match ]( context[ match ] ); + + // ...and otherwise set as attributes + } else { + this.attr( match, context[ match ] ); + } + } + } + + return this; + + // HANDLE: $(#id) + } else { + elem = document.getElementById( match[ 2 ] ); + + if ( elem ) { + + // Inject the element directly into the jQuery object + this[ 0 ] = elem; + this.length = 1; + } + return this; + } + + // HANDLE: $(expr, $(...)) + } else if ( !context || context.jquery ) { + return ( context || root ).find( selector ); + + // HANDLE: $(expr, context) + // (which is just equivalent to: $(context).find(expr) + } else { + return this.constructor( context ).find( selector ); + } + + // HANDLE: $(DOMElement) + } else if ( selector.nodeType ) { + this[ 0 ] = selector; + this.length = 1; + return this; + + // HANDLE: $(function) + // Shortcut for document ready + } else if ( isFunction( selector ) ) { + return root.ready !== undefined ? + root.ready( selector ) : + + // Execute immediately if ready is not present + selector( jQuery ); + } + + return jQuery.makeArray( selector, this ); + }; + +// Give the init function the jQuery prototype for later instantiation +init.prototype = jQuery.fn; + +// Initialize central reference +rootjQuery = jQuery( document ); + + +var rparentsprev = /^(?:parents|prev(?:Until|All))/, + + // Methods guaranteed to produce a unique set when starting from a unique set + guaranteedUnique = { + children: true, + contents: true, + next: true, + prev: true + }; + +jQuery.fn.extend( { + has: function( target ) { + var targets = jQuery( target, this ), + l = targets.length; + + return this.filter( function() { + var i = 0; + for ( ; i < l; i++ ) { + if ( jQuery.contains( this, targets[ i ] ) ) { + return true; + } + } + } ); + }, + + closest: function( selectors, context ) { + var cur, + i = 0, + l = this.length, + matched = [], + targets = typeof selectors !== "string" && jQuery( selectors ); + + // Positional selectors never match, since there's no _selection_ context + if ( !rneedsContext.test( selectors ) ) { + for ( ; i < l; i++ ) { + for ( cur = this[ i ]; cur && cur !== context; cur = cur.parentNode ) { + + // Always skip document fragments + if ( cur.nodeType < 11 && ( targets ? + targets.index( cur ) > -1 : + + // Don't pass non-elements to Sizzle + cur.nodeType === 1 && + jQuery.find.matchesSelector( cur, selectors ) ) ) { + + matched.push( cur ); + break; + } + } + } + } + + return this.pushStack( matched.length > 1 ? jQuery.uniqueSort( matched ) : matched ); + }, + + // Determine the position of an element within the set + index: function( elem ) { + + // No argument, return index in parent + if ( !elem ) { + return ( this[ 0 ] && this[ 0 ].parentNode ) ? this.first().prevAll().length : -1; + } + + // Index in selector + if ( typeof elem === "string" ) { + return indexOf.call( jQuery( elem ), this[ 0 ] ); + } + + // Locate the position of the desired element + return indexOf.call( this, + + // If it receives a jQuery object, the first element is used + elem.jquery ? elem[ 0 ] : elem + ); + }, + + add: function( selector, context ) { + return this.pushStack( + jQuery.uniqueSort( + jQuery.merge( this.get(), jQuery( selector, context ) ) + ) + ); + }, + + addBack: function( selector ) { + return this.add( selector == null ? + this.prevObject : this.prevObject.filter( selector ) + ); + } +} ); + +function sibling( cur, dir ) { + while ( ( cur = cur[ dir ] ) && cur.nodeType !== 1 ) {} + return cur; +} + +jQuery.each( { + parent: function( elem ) { + var parent = elem.parentNode; + return parent && parent.nodeType !== 11 ? parent : null; + }, + parents: function( elem ) { + return dir( elem, "parentNode" ); + }, + parentsUntil: function( elem, _i, until ) { + return dir( elem, "parentNode", until ); + }, + next: function( elem ) { + return sibling( elem, "nextSibling" ); + }, + prev: function( elem ) { + return sibling( elem, "previousSibling" ); + }, + nextAll: function( elem ) { + return dir( elem, "nextSibling" ); + }, + prevAll: function( elem ) { + return dir( elem, "previousSibling" ); + }, + nextUntil: function( elem, _i, until ) { + return dir( elem, "nextSibling", until ); + }, + prevUntil: function( elem, _i, until ) { + return dir( elem, "previousSibling", until ); + }, + siblings: function( elem ) { + return siblings( ( elem.parentNode || {} ).firstChild, elem ); + }, + children: function( elem ) { + return siblings( elem.firstChild ); + }, + contents: function( elem ) { + if ( elem.contentDocument != null && + + // Support: IE 11+ + // elements with no `data` attribute has an object + // `contentDocument` with a `null` prototype. + getProto( elem.contentDocument ) ) { + + return elem.contentDocument; + } + + // Support: IE 9 - 11 only, iOS 7 only, Android Browser <=4.3 only + // Treat the template element as a regular one in browsers that + // don't support it. + if ( nodeName( elem, "template" ) ) { + elem = elem.content || elem; + } + + return jQuery.merge( [], elem.childNodes ); + } +}, function( name, fn ) { + jQuery.fn[ name ] = function( until, selector ) { + var matched = jQuery.map( this, fn, until ); + + if ( name.slice( -5 ) !== "Until" ) { + selector = until; + } + + if ( selector && typeof selector === "string" ) { + matched = jQuery.filter( selector, matched ); + } + + if ( this.length > 1 ) { + + // Remove duplicates + if ( !guaranteedUnique[ name ] ) { + jQuery.uniqueSort( matched ); + } + + // Reverse order for parents* and prev-derivatives + if ( rparentsprev.test( name ) ) { + matched.reverse(); + } + } + + return this.pushStack( matched ); + }; +} ); +var rnothtmlwhite = ( /[^\x20\t\r\n\f]+/g ); + + + +// Convert String-formatted options into Object-formatted ones +function createOptions( options ) { + var object = {}; + jQuery.each( options.match( rnothtmlwhite ) || [], function( _, flag ) { + object[ flag ] = true; + } ); + return object; +} + +/* + * Create a callback list using the following parameters: + * + * options: an optional list of space-separated options that will change how + * the callback list behaves or a more traditional option object + * + * By default a callback list will act like an event callback list and can be + * "fired" multiple times. + * + * Possible options: + * + * once: will ensure the callback list can only be fired once (like a Deferred) + * + * memory: will keep track of previous values and will call any callback added + * after the list has been fired right away with the latest "memorized" + * values (like a Deferred) + * + * unique: will ensure a callback can only be added once (no duplicate in the list) + * + * stopOnFalse: interrupt callings when a callback returns false + * + */ +jQuery.Callbacks = function( options ) { + + // Convert options from String-formatted to Object-formatted if needed + // (we check in cache first) + options = typeof options === "string" ? + createOptions( options ) : + jQuery.extend( {}, options ); + + var // Flag to know if list is currently firing + firing, + + // Last fire value for non-forgettable lists + memory, + + // Flag to know if list was already fired + fired, + + // Flag to prevent firing + locked, + + // Actual callback list + list = [], + + // Queue of execution data for repeatable lists + queue = [], + + // Index of currently firing callback (modified by add/remove as needed) + firingIndex = -1, + + // Fire callbacks + fire = function() { + + // Enforce single-firing + locked = locked || options.once; + + // Execute callbacks for all pending executions, + // respecting firingIndex overrides and runtime changes + fired = firing = true; + for ( ; queue.length; firingIndex = -1 ) { + memory = queue.shift(); + while ( ++firingIndex < list.length ) { + + // Run callback and check for early termination + if ( list[ firingIndex ].apply( memory[ 0 ], memory[ 1 ] ) === false && + options.stopOnFalse ) { + + // Jump to end and forget the data so .add doesn't re-fire + firingIndex = list.length; + memory = false; + } + } + } + + // Forget the data if we're done with it + if ( !options.memory ) { + memory = false; + } + + firing = false; + + // Clean up if we're done firing for good + if ( locked ) { + + // Keep an empty list if we have data for future add calls + if ( memory ) { + list = []; + + // Otherwise, this object is spent + } else { + list = ""; + } + } + }, + + // Actual Callbacks object + self = { + + // Add a callback or a collection of callbacks to the list + add: function() { + if ( list ) { + + // If we have memory from a past run, we should fire after adding + if ( memory && !firing ) { + firingIndex = list.length - 1; + queue.push( memory ); + } + + ( function add( args ) { + jQuery.each( args, function( _, arg ) { + if ( isFunction( arg ) ) { + if ( !options.unique || !self.has( arg ) ) { + list.push( arg ); + } + } else if ( arg && arg.length && toType( arg ) !== "string" ) { + + // Inspect recursively + add( arg ); + } + } ); + } )( arguments ); + + if ( memory && !firing ) { + fire(); + } + } + return this; + }, + + // Remove a callback from the list + remove: function() { + jQuery.each( arguments, function( _, arg ) { + var index; + while ( ( index = jQuery.inArray( arg, list, index ) ) > -1 ) { + list.splice( index, 1 ); + + // Handle firing indexes + if ( index <= firingIndex ) { + firingIndex--; + } + } + } ); + return this; + }, + + // Check if a given callback is in the list. + // If no argument is given, return whether or not list has callbacks attached. + has: function( fn ) { + return fn ? + jQuery.inArray( fn, list ) > -1 : + list.length > 0; + }, + + // Remove all callbacks from the list + empty: function() { + if ( list ) { + list = []; + } + return this; + }, + + // Disable .fire and .add + // Abort any current/pending executions + // Clear all callbacks and values + disable: function() { + locked = queue = []; + list = memory = ""; + return this; + }, + disabled: function() { + return !list; + }, + + // Disable .fire + // Also disable .add unless we have memory (since it would have no effect) + // Abort any pending executions + lock: function() { + locked = queue = []; + if ( !memory && !firing ) { + list = memory = ""; + } + return this; + }, + locked: function() { + return !!locked; + }, + + // Call all callbacks with the given context and arguments + fireWith: function( context, args ) { + if ( !locked ) { + args = args || []; + args = [ context, args.slice ? args.slice() : args ]; + queue.push( args ); + if ( !firing ) { + fire(); + } + } + return this; + }, + + // Call all the callbacks with the given arguments + fire: function() { + self.fireWith( this, arguments ); + return this; + }, + + // To know if the callbacks have already been called at least once + fired: function() { + return !!fired; + } + }; + + return self; +}; + + +function Identity( v ) { + return v; +} +function Thrower( ex ) { + throw ex; +} + +function adoptValue( value, resolve, reject, noValue ) { + var method; + + try { + + // Check for promise aspect first to privilege synchronous behavior + if ( value && isFunction( ( method = value.promise ) ) ) { + method.call( value ).done( resolve ).fail( reject ); + + // Other thenables + } else if ( value && isFunction( ( method = value.then ) ) ) { + method.call( value, resolve, reject ); + + // Other non-thenables + } else { + + // Control `resolve` arguments by letting Array#slice cast boolean `noValue` to integer: + // * false: [ value ].slice( 0 ) => resolve( value ) + // * true: [ value ].slice( 1 ) => resolve() + resolve.apply( undefined, [ value ].slice( noValue ) ); + } + + // For Promises/A+, convert exceptions into rejections + // Since jQuery.when doesn't unwrap thenables, we can skip the extra checks appearing in + // Deferred#then to conditionally suppress rejection. + } catch ( value ) { + + // Support: Android 4.0 only + // Strict mode functions invoked without .call/.apply get global-object context + reject.apply( undefined, [ value ] ); + } +} + +jQuery.extend( { + + Deferred: function( func ) { + var tuples = [ + + // action, add listener, callbacks, + // ... .then handlers, argument index, [final state] + [ "notify", "progress", jQuery.Callbacks( "memory" ), + jQuery.Callbacks( "memory" ), 2 ], + [ "resolve", "done", jQuery.Callbacks( "once memory" ), + jQuery.Callbacks( "once memory" ), 0, "resolved" ], + [ "reject", "fail", jQuery.Callbacks( "once memory" ), + jQuery.Callbacks( "once memory" ), 1, "rejected" ] + ], + state = "pending", + promise = { + state: function() { + return state; + }, + always: function() { + deferred.done( arguments ).fail( arguments ); + return this; + }, + "catch": function( fn ) { + return promise.then( null, fn ); + }, + + // Keep pipe for back-compat + pipe: function( /* fnDone, fnFail, fnProgress */ ) { + var fns = arguments; + + return jQuery.Deferred( function( newDefer ) { + jQuery.each( tuples, function( _i, tuple ) { + + // Map tuples (progress, done, fail) to arguments (done, fail, progress) + var fn = isFunction( fns[ tuple[ 4 ] ] ) && fns[ tuple[ 4 ] ]; + + // deferred.progress(function() { bind to newDefer or newDefer.notify }) + // deferred.done(function() { bind to newDefer or newDefer.resolve }) + // deferred.fail(function() { bind to newDefer or newDefer.reject }) + deferred[ tuple[ 1 ] ]( function() { + var returned = fn && fn.apply( this, arguments ); + if ( returned && isFunction( returned.promise ) ) { + returned.promise() + .progress( newDefer.notify ) + .done( newDefer.resolve ) + .fail( newDefer.reject ); + } else { + newDefer[ tuple[ 0 ] + "With" ]( + this, + fn ? [ returned ] : arguments + ); + } + } ); + } ); + fns = null; + } ).promise(); + }, + then: function( onFulfilled, onRejected, onProgress ) { + var maxDepth = 0; + function resolve( depth, deferred, handler, special ) { + return function() { + var that = this, + args = arguments, + mightThrow = function() { + var returned, then; + + // Support: Promises/A+ section 2.3.3.3.3 + // https://promisesaplus.com/#point-59 + // Ignore double-resolution attempts + if ( depth < maxDepth ) { + return; + } + + returned = handler.apply( that, args ); + + // Support: Promises/A+ section 2.3.1 + // https://promisesaplus.com/#point-48 + if ( returned === deferred.promise() ) { + throw new TypeError( "Thenable self-resolution" ); + } + + // Support: Promises/A+ sections 2.3.3.1, 3.5 + // https://promisesaplus.com/#point-54 + // https://promisesaplus.com/#point-75 + // Retrieve `then` only once + then = returned && + + // Support: Promises/A+ section 2.3.4 + // https://promisesaplus.com/#point-64 + // Only check objects and functions for thenability + ( typeof returned === "object" || + typeof returned === "function" ) && + returned.then; + + // Handle a returned thenable + if ( isFunction( then ) ) { + + // Special processors (notify) just wait for resolution + if ( special ) { + then.call( + returned, + resolve( maxDepth, deferred, Identity, special ), + resolve( maxDepth, deferred, Thrower, special ) + ); + + // Normal processors (resolve) also hook into progress + } else { + + // ...and disregard older resolution values + maxDepth++; + + then.call( + returned, + resolve( maxDepth, deferred, Identity, special ), + resolve( maxDepth, deferred, Thrower, special ), + resolve( maxDepth, deferred, Identity, + deferred.notifyWith ) + ); + } + + // Handle all other returned values + } else { + + // Only substitute handlers pass on context + // and multiple values (non-spec behavior) + if ( handler !== Identity ) { + that = undefined; + args = [ returned ]; + } + + // Process the value(s) + // Default process is resolve + ( special || deferred.resolveWith )( that, args ); + } + }, + + // Only normal processors (resolve) catch and reject exceptions + process = special ? + mightThrow : + function() { + try { + mightThrow(); + } catch ( e ) { + + if ( jQuery.Deferred.exceptionHook ) { + jQuery.Deferred.exceptionHook( e, + process.stackTrace ); + } + + // Support: Promises/A+ section 2.3.3.3.4.1 + // https://promisesaplus.com/#point-61 + // Ignore post-resolution exceptions + if ( depth + 1 >= maxDepth ) { + + // Only substitute handlers pass on context + // and multiple values (non-spec behavior) + if ( handler !== Thrower ) { + that = undefined; + args = [ e ]; + } + + deferred.rejectWith( that, args ); + } + } + }; + + // Support: Promises/A+ section 2.3.3.3.1 + // https://promisesaplus.com/#point-57 + // Re-resolve promises immediately to dodge false rejection from + // subsequent errors + if ( depth ) { + process(); + } else { + + // Call an optional hook to record the stack, in case of exception + // since it's otherwise lost when execution goes async + if ( jQuery.Deferred.getStackHook ) { + process.stackTrace = jQuery.Deferred.getStackHook(); + } + window.setTimeout( process ); + } + }; + } + + return jQuery.Deferred( function( newDefer ) { + + // progress_handlers.add( ... ) + tuples[ 0 ][ 3 ].add( + resolve( + 0, + newDefer, + isFunction( onProgress ) ? + onProgress : + Identity, + newDefer.notifyWith + ) + ); + + // fulfilled_handlers.add( ... ) + tuples[ 1 ][ 3 ].add( + resolve( + 0, + newDefer, + isFunction( onFulfilled ) ? + onFulfilled : + Identity + ) + ); + + // rejected_handlers.add( ... ) + tuples[ 2 ][ 3 ].add( + resolve( + 0, + newDefer, + isFunction( onRejected ) ? + onRejected : + Thrower + ) + ); + } ).promise(); + }, + + // Get a promise for this deferred + // If obj is provided, the promise aspect is added to the object + promise: function( obj ) { + return obj != null ? jQuery.extend( obj, promise ) : promise; + } + }, + deferred = {}; + + // Add list-specific methods + jQuery.each( tuples, function( i, tuple ) { + var list = tuple[ 2 ], + stateString = tuple[ 5 ]; + + // promise.progress = list.add + // promise.done = list.add + // promise.fail = list.add + promise[ tuple[ 1 ] ] = list.add; + + // Handle state + if ( stateString ) { + list.add( + function() { + + // state = "resolved" (i.e., fulfilled) + // state = "rejected" + state = stateString; + }, + + // rejected_callbacks.disable + // fulfilled_callbacks.disable + tuples[ 3 - i ][ 2 ].disable, + + // rejected_handlers.disable + // fulfilled_handlers.disable + tuples[ 3 - i ][ 3 ].disable, + + // progress_callbacks.lock + tuples[ 0 ][ 2 ].lock, + + // progress_handlers.lock + tuples[ 0 ][ 3 ].lock + ); + } + + // progress_handlers.fire + // fulfilled_handlers.fire + // rejected_handlers.fire + list.add( tuple[ 3 ].fire ); + + // deferred.notify = function() { deferred.notifyWith(...) } + // deferred.resolve = function() { deferred.resolveWith(...) } + // deferred.reject = function() { deferred.rejectWith(...) } + deferred[ tuple[ 0 ] ] = function() { + deferred[ tuple[ 0 ] + "With" ]( this === deferred ? undefined : this, arguments ); + return this; + }; + + // deferred.notifyWith = list.fireWith + // deferred.resolveWith = list.fireWith + // deferred.rejectWith = list.fireWith + deferred[ tuple[ 0 ] + "With" ] = list.fireWith; + } ); + + // Make the deferred a promise + promise.promise( deferred ); + + // Call given func if any + if ( func ) { + func.call( deferred, deferred ); + } + + // All done! + return deferred; + }, + + // Deferred helper + when: function( singleValue ) { + var + + // count of uncompleted subordinates + remaining = arguments.length, + + // count of unprocessed arguments + i = remaining, + + // subordinate fulfillment data + resolveContexts = Array( i ), + resolveValues = slice.call( arguments ), + + // the master Deferred + master = jQuery.Deferred(), + + // subordinate callback factory + updateFunc = function( i ) { + return function( value ) { + resolveContexts[ i ] = this; + resolveValues[ i ] = arguments.length > 1 ? slice.call( arguments ) : value; + if ( !( --remaining ) ) { + master.resolveWith( resolveContexts, resolveValues ); + } + }; + }; + + // Single- and empty arguments are adopted like Promise.resolve + if ( remaining <= 1 ) { + adoptValue( singleValue, master.done( updateFunc( i ) ).resolve, master.reject, + !remaining ); + + // Use .then() to unwrap secondary thenables (cf. gh-3000) + if ( master.state() === "pending" || + isFunction( resolveValues[ i ] && resolveValues[ i ].then ) ) { + + return master.then(); + } + } + + // Multiple arguments are aggregated like Promise.all array elements + while ( i-- ) { + adoptValue( resolveValues[ i ], updateFunc( i ), master.reject ); + } + + return master.promise(); + } +} ); + + +// These usually indicate a programmer mistake during development, +// warn about them ASAP rather than swallowing them by default. +var rerrorNames = /^(Eval|Internal|Range|Reference|Syntax|Type|URI)Error$/; + +jQuery.Deferred.exceptionHook = function( error, stack ) { + + // Support: IE 8 - 9 only + // Console exists when dev tools are open, which can happen at any time + if ( window.console && window.console.warn && error && rerrorNames.test( error.name ) ) { + window.console.warn( "jQuery.Deferred exception: " + error.message, error.stack, stack ); + } +}; + + + + +jQuery.readyException = function( error ) { + window.setTimeout( function() { + throw error; + } ); +}; + + + + +// The deferred used on DOM ready +var readyList = jQuery.Deferred(); + +jQuery.fn.ready = function( fn ) { + + readyList + .then( fn ) + + // Wrap jQuery.readyException in a function so that the lookup + // happens at the time of error handling instead of callback + // registration. + .catch( function( error ) { + jQuery.readyException( error ); + } ); + + return this; +}; + +jQuery.extend( { + + // Is the DOM ready to be used? Set to true once it occurs. + isReady: false, + + // A counter to track how many items to wait for before + // the ready event fires. See #6781 + readyWait: 1, + + // Handle when the DOM is ready + ready: function( wait ) { + + // Abort if there are pending holds or we're already ready + if ( wait === true ? --jQuery.readyWait : jQuery.isReady ) { + return; + } + + // Remember that the DOM is ready + jQuery.isReady = true; + + // If a normal DOM Ready event fired, decrement, and wait if need be + if ( wait !== true && --jQuery.readyWait > 0 ) { + return; + } + + // If there are functions bound, to execute + readyList.resolveWith( document, [ jQuery ] ); + } +} ); + +jQuery.ready.then = readyList.then; + +// The ready event handler and self cleanup method +function completed() { + document.removeEventListener( "DOMContentLoaded", completed ); + window.removeEventListener( "load", completed ); + jQuery.ready(); +} + +// Catch cases where $(document).ready() is called +// after the browser event has already occurred. +// Support: IE <=9 - 10 only +// Older IE sometimes signals "interactive" too soon +if ( document.readyState === "complete" || + ( document.readyState !== "loading" && !document.documentElement.doScroll ) ) { + + // Handle it asynchronously to allow scripts the opportunity to delay ready + window.setTimeout( jQuery.ready ); + +} else { + + // Use the handy event callback + document.addEventListener( "DOMContentLoaded", completed ); + + // A fallback to window.onload, that will always work + window.addEventListener( "load", completed ); +} + + + + +// Multifunctional method to get and set values of a collection +// The value/s can optionally be executed if it's a function +var access = function( elems, fn, key, value, chainable, emptyGet, raw ) { + var i = 0, + len = elems.length, + bulk = key == null; + + // Sets many values + if ( toType( key ) === "object" ) { + chainable = true; + for ( i in key ) { + access( elems, fn, i, key[ i ], true, emptyGet, raw ); + } + + // Sets one value + } else if ( value !== undefined ) { + chainable = true; + + if ( !isFunction( value ) ) { + raw = true; + } + + if ( bulk ) { + + // Bulk operations run against the entire set + if ( raw ) { + fn.call( elems, value ); + fn = null; + + // ...except when executing function values + } else { + bulk = fn; + fn = function( elem, _key, value ) { + return bulk.call( jQuery( elem ), value ); + }; + } + } + + if ( fn ) { + for ( ; i < len; i++ ) { + fn( + elems[ i ], key, raw ? + value : + value.call( elems[ i ], i, fn( elems[ i ], key ) ) + ); + } + } + } + + if ( chainable ) { + return elems; + } + + // Gets + if ( bulk ) { + return fn.call( elems ); + } + + return len ? fn( elems[ 0 ], key ) : emptyGet; +}; + + +// Matches dashed string for camelizing +var rmsPrefix = /^-ms-/, + rdashAlpha = /-([a-z])/g; + +// Used by camelCase as callback to replace() +function fcamelCase( _all, letter ) { + return letter.toUpperCase(); +} + +// Convert dashed to camelCase; used by the css and data modules +// Support: IE <=9 - 11, Edge 12 - 15 +// Microsoft forgot to hump their vendor prefix (#9572) +function camelCase( string ) { + return string.replace( rmsPrefix, "ms-" ).replace( rdashAlpha, fcamelCase ); +} +var acceptData = function( owner ) { + + // Accepts only: + // - Node + // - Node.ELEMENT_NODE + // - Node.DOCUMENT_NODE + // - Object + // - Any + return owner.nodeType === 1 || owner.nodeType === 9 || !( +owner.nodeType ); +}; + + + + +function Data() { + this.expando = jQuery.expando + Data.uid++; +} + +Data.uid = 1; + +Data.prototype = { + + cache: function( owner ) { + + // Check if the owner object already has a cache + var value = owner[ this.expando ]; + + // If not, create one + if ( !value ) { + value = {}; + + // We can accept data for non-element nodes in modern browsers, + // but we should not, see #8335. + // Always return an empty object. + if ( acceptData( owner ) ) { + + // If it is a node unlikely to be stringify-ed or looped over + // use plain assignment + if ( owner.nodeType ) { + owner[ this.expando ] = value; + + // Otherwise secure it in a non-enumerable property + // configurable must be true to allow the property to be + // deleted when data is removed + } else { + Object.defineProperty( owner, this.expando, { + value: value, + configurable: true + } ); + } + } + } + + return value; + }, + set: function( owner, data, value ) { + var prop, + cache = this.cache( owner ); + + // Handle: [ owner, key, value ] args + // Always use camelCase key (gh-2257) + if ( typeof data === "string" ) { + cache[ camelCase( data ) ] = value; + + // Handle: [ owner, { properties } ] args + } else { + + // Copy the properties one-by-one to the cache object + for ( prop in data ) { + cache[ camelCase( prop ) ] = data[ prop ]; + } + } + return cache; + }, + get: function( owner, key ) { + return key === undefined ? + this.cache( owner ) : + + // Always use camelCase key (gh-2257) + owner[ this.expando ] && owner[ this.expando ][ camelCase( key ) ]; + }, + access: function( owner, key, value ) { + + // In cases where either: + // + // 1. No key was specified + // 2. A string key was specified, but no value provided + // + // Take the "read" path and allow the get method to determine + // which value to return, respectively either: + // + // 1. The entire cache object + // 2. The data stored at the key + // + if ( key === undefined || + ( ( key && typeof key === "string" ) && value === undefined ) ) { + + return this.get( owner, key ); + } + + // When the key is not a string, or both a key and value + // are specified, set or extend (existing objects) with either: + // + // 1. An object of properties + // 2. A key and value + // + this.set( owner, key, value ); + + // Since the "set" path can have two possible entry points + // return the expected data based on which path was taken[*] + return value !== undefined ? value : key; + }, + remove: function( owner, key ) { + var i, + cache = owner[ this.expando ]; + + if ( cache === undefined ) { + return; + } + + if ( key !== undefined ) { + + // Support array or space separated string of keys + if ( Array.isArray( key ) ) { + + // If key is an array of keys... + // We always set camelCase keys, so remove that. + key = key.map( camelCase ); + } else { + key = camelCase( key ); + + // If a key with the spaces exists, use it. + // Otherwise, create an array by matching non-whitespace + key = key in cache ? + [ key ] : + ( key.match( rnothtmlwhite ) || [] ); + } + + i = key.length; + + while ( i-- ) { + delete cache[ key[ i ] ]; + } + } + + // Remove the expando if there's no more data + if ( key === undefined || jQuery.isEmptyObject( cache ) ) { + + // Support: Chrome <=35 - 45 + // Webkit & Blink performance suffers when deleting properties + // from DOM nodes, so set to undefined instead + // https://bugs.chromium.org/p/chromium/issues/detail?id=378607 (bug restricted) + if ( owner.nodeType ) { + owner[ this.expando ] = undefined; + } else { + delete owner[ this.expando ]; + } + } + }, + hasData: function( owner ) { + var cache = owner[ this.expando ]; + return cache !== undefined && !jQuery.isEmptyObject( cache ); + } +}; +var dataPriv = new Data(); + +var dataUser = new Data(); + + + +// Implementation Summary +// +// 1. Enforce API surface and semantic compatibility with 1.9.x branch +// 2. Improve the module's maintainability by reducing the storage +// paths to a single mechanism. +// 3. Use the same single mechanism to support "private" and "user" data. +// 4. _Never_ expose "private" data to user code (TODO: Drop _data, _removeData) +// 5. Avoid exposing implementation details on user objects (eg. expando properties) +// 6. Provide a clear path for implementation upgrade to WeakMap in 2014 + +var rbrace = /^(?:\{[\w\W]*\}|\[[\w\W]*\])$/, + rmultiDash = /[A-Z]/g; + +function getData( data ) { + if ( data === "true" ) { + return true; + } + + if ( data === "false" ) { + return false; + } + + if ( data === "null" ) { + return null; + } + + // Only convert to a number if it doesn't change the string + if ( data === +data + "" ) { + return +data; + } + + if ( rbrace.test( data ) ) { + return JSON.parse( data ); + } + + return data; +} + +function dataAttr( elem, key, data ) { + var name; + + // If nothing was found internally, try to fetch any + // data from the HTML5 data-* attribute + if ( data === undefined && elem.nodeType === 1 ) { + name = "data-" + key.replace( rmultiDash, "-$&" ).toLowerCase(); + data = elem.getAttribute( name ); + + if ( typeof data === "string" ) { + try { + data = getData( data ); + } catch ( e ) {} + + // Make sure we set the data so it isn't changed later + dataUser.set( elem, key, data ); + } else { + data = undefined; + } + } + return data; +} + +jQuery.extend( { + hasData: function( elem ) { + return dataUser.hasData( elem ) || dataPriv.hasData( elem ); + }, + + data: function( elem, name, data ) { + return dataUser.access( elem, name, data ); + }, + + removeData: function( elem, name ) { + dataUser.remove( elem, name ); + }, + + // TODO: Now that all calls to _data and _removeData have been replaced + // with direct calls to dataPriv methods, these can be deprecated. + _data: function( elem, name, data ) { + return dataPriv.access( elem, name, data ); + }, + + _removeData: function( elem, name ) { + dataPriv.remove( elem, name ); + } +} ); + +jQuery.fn.extend( { + data: function( key, value ) { + var i, name, data, + elem = this[ 0 ], + attrs = elem && elem.attributes; + + // Gets all values + if ( key === undefined ) { + if ( this.length ) { + data = dataUser.get( elem ); + + if ( elem.nodeType === 1 && !dataPriv.get( elem, "hasDataAttrs" ) ) { + i = attrs.length; + while ( i-- ) { + + // Support: IE 11 only + // The attrs elements can be null (#14894) + if ( attrs[ i ] ) { + name = attrs[ i ].name; + if ( name.indexOf( "data-" ) === 0 ) { + name = camelCase( name.slice( 5 ) ); + dataAttr( elem, name, data[ name ] ); + } + } + } + dataPriv.set( elem, "hasDataAttrs", true ); + } + } + + return data; + } + + // Sets multiple values + if ( typeof key === "object" ) { + return this.each( function() { + dataUser.set( this, key ); + } ); + } + + return access( this, function( value ) { + var data; + + // The calling jQuery object (element matches) is not empty + // (and therefore has an element appears at this[ 0 ]) and the + // `value` parameter was not undefined. An empty jQuery object + // will result in `undefined` for elem = this[ 0 ] which will + // throw an exception if an attempt to read a data cache is made. + if ( elem && value === undefined ) { + + // Attempt to get data from the cache + // The key will always be camelCased in Data + data = dataUser.get( elem, key ); + if ( data !== undefined ) { + return data; + } + + // Attempt to "discover" the data in + // HTML5 custom data-* attrs + data = dataAttr( elem, key ); + if ( data !== undefined ) { + return data; + } + + // We tried really hard, but the data doesn't exist. + return; + } + + // Set the data... + this.each( function() { + + // We always store the camelCased key + dataUser.set( this, key, value ); + } ); + }, null, value, arguments.length > 1, null, true ); + }, + + removeData: function( key ) { + return this.each( function() { + dataUser.remove( this, key ); + } ); + } +} ); + + +jQuery.extend( { + queue: function( elem, type, data ) { + var queue; + + if ( elem ) { + type = ( type || "fx" ) + "queue"; + queue = dataPriv.get( elem, type ); + + // Speed up dequeue by getting out quickly if this is just a lookup + if ( data ) { + if ( !queue || Array.isArray( data ) ) { + queue = dataPriv.access( elem, type, jQuery.makeArray( data ) ); + } else { + queue.push( data ); + } + } + return queue || []; + } + }, + + dequeue: function( elem, type ) { + type = type || "fx"; + + var queue = jQuery.queue( elem, type ), + startLength = queue.length, + fn = queue.shift(), + hooks = jQuery._queueHooks( elem, type ), + next = function() { + jQuery.dequeue( elem, type ); + }; + + // If the fx queue is dequeued, always remove the progress sentinel + if ( fn === "inprogress" ) { + fn = queue.shift(); + startLength--; + } + + if ( fn ) { + + // Add a progress sentinel to prevent the fx queue from being + // automatically dequeued + if ( type === "fx" ) { + queue.unshift( "inprogress" ); + } + + // Clear up the last queue stop function + delete hooks.stop; + fn.call( elem, next, hooks ); + } + + if ( !startLength && hooks ) { + hooks.empty.fire(); + } + }, + + // Not public - generate a queueHooks object, or return the current one + _queueHooks: function( elem, type ) { + var key = type + "queueHooks"; + return dataPriv.get( elem, key ) || dataPriv.access( elem, key, { + empty: jQuery.Callbacks( "once memory" ).add( function() { + dataPriv.remove( elem, [ type + "queue", key ] ); + } ) + } ); + } +} ); + +jQuery.fn.extend( { + queue: function( type, data ) { + var setter = 2; + + if ( typeof type !== "string" ) { + data = type; + type = "fx"; + setter--; + } + + if ( arguments.length < setter ) { + return jQuery.queue( this[ 0 ], type ); + } + + return data === undefined ? + this : + this.each( function() { + var queue = jQuery.queue( this, type, data ); + + // Ensure a hooks for this queue + jQuery._queueHooks( this, type ); + + if ( type === "fx" && queue[ 0 ] !== "inprogress" ) { + jQuery.dequeue( this, type ); + } + } ); + }, + dequeue: function( type ) { + return this.each( function() { + jQuery.dequeue( this, type ); + } ); + }, + clearQueue: function( type ) { + return this.queue( type || "fx", [] ); + }, + + // Get a promise resolved when queues of a certain type + // are emptied (fx is the type by default) + promise: function( type, obj ) { + var tmp, + count = 1, + defer = jQuery.Deferred(), + elements = this, + i = this.length, + resolve = function() { + if ( !( --count ) ) { + defer.resolveWith( elements, [ elements ] ); + } + }; + + if ( typeof type !== "string" ) { + obj = type; + type = undefined; + } + type = type || "fx"; + + while ( i-- ) { + tmp = dataPriv.get( elements[ i ], type + "queueHooks" ); + if ( tmp && tmp.empty ) { + count++; + tmp.empty.add( resolve ); + } + } + resolve(); + return defer.promise( obj ); + } +} ); +var pnum = ( /[+-]?(?:\d*\.|)\d+(?:[eE][+-]?\d+|)/ ).source; + +var rcssNum = new RegExp( "^(?:([+-])=|)(" + pnum + ")([a-z%]*)$", "i" ); + + +var cssExpand = [ "Top", "Right", "Bottom", "Left" ]; + +var documentElement = document.documentElement; + + + + var isAttached = function( elem ) { + return jQuery.contains( elem.ownerDocument, elem ); + }, + composed = { composed: true }; + + // Support: IE 9 - 11+, Edge 12 - 18+, iOS 10.0 - 10.2 only + // Check attachment across shadow DOM boundaries when possible (gh-3504) + // Support: iOS 10.0-10.2 only + // Early iOS 10 versions support `attachShadow` but not `getRootNode`, + // leading to errors. We need to check for `getRootNode`. + if ( documentElement.getRootNode ) { + isAttached = function( elem ) { + return jQuery.contains( elem.ownerDocument, elem ) || + elem.getRootNode( composed ) === elem.ownerDocument; + }; + } +var isHiddenWithinTree = function( elem, el ) { + + // isHiddenWithinTree might be called from jQuery#filter function; + // in that case, element will be second argument + elem = el || elem; + + // Inline style trumps all + return elem.style.display === "none" || + elem.style.display === "" && + + // Otherwise, check computed style + // Support: Firefox <=43 - 45 + // Disconnected elements can have computed display: none, so first confirm that elem is + // in the document. + isAttached( elem ) && + + jQuery.css( elem, "display" ) === "none"; + }; + + + +function adjustCSS( elem, prop, valueParts, tween ) { + var adjusted, scale, + maxIterations = 20, + currentValue = tween ? + function() { + return tween.cur(); + } : + function() { + return jQuery.css( elem, prop, "" ); + }, + initial = currentValue(), + unit = valueParts && valueParts[ 3 ] || ( jQuery.cssNumber[ prop ] ? "" : "px" ), + + // Starting value computation is required for potential unit mismatches + initialInUnit = elem.nodeType && + ( jQuery.cssNumber[ prop ] || unit !== "px" && +initial ) && + rcssNum.exec( jQuery.css( elem, prop ) ); + + if ( initialInUnit && initialInUnit[ 3 ] !== unit ) { + + // Support: Firefox <=54 + // Halve the iteration target value to prevent interference from CSS upper bounds (gh-2144) + initial = initial / 2; + + // Trust units reported by jQuery.css + unit = unit || initialInUnit[ 3 ]; + + // Iteratively approximate from a nonzero starting point + initialInUnit = +initial || 1; + + while ( maxIterations-- ) { + + // Evaluate and update our best guess (doubling guesses that zero out). + // Finish if the scale equals or crosses 1 (making the old*new product non-positive). + jQuery.style( elem, prop, initialInUnit + unit ); + if ( ( 1 - scale ) * ( 1 - ( scale = currentValue() / initial || 0.5 ) ) <= 0 ) { + maxIterations = 0; + } + initialInUnit = initialInUnit / scale; + + } + + initialInUnit = initialInUnit * 2; + jQuery.style( elem, prop, initialInUnit + unit ); + + // Make sure we update the tween properties later on + valueParts = valueParts || []; + } + + if ( valueParts ) { + initialInUnit = +initialInUnit || +initial || 0; + + // Apply relative offset (+=/-=) if specified + adjusted = valueParts[ 1 ] ? + initialInUnit + ( valueParts[ 1 ] + 1 ) * valueParts[ 2 ] : + +valueParts[ 2 ]; + if ( tween ) { + tween.unit = unit; + tween.start = initialInUnit; + tween.end = adjusted; + } + } + return adjusted; +} + + +var defaultDisplayMap = {}; + +function getDefaultDisplay( elem ) { + var temp, + doc = elem.ownerDocument, + nodeName = elem.nodeName, + display = defaultDisplayMap[ nodeName ]; + + if ( display ) { + return display; + } + + temp = doc.body.appendChild( doc.createElement( nodeName ) ); + display = jQuery.css( temp, "display" ); + + temp.parentNode.removeChild( temp ); + + if ( display === "none" ) { + display = "block"; + } + defaultDisplayMap[ nodeName ] = display; + + return display; +} + +function showHide( elements, show ) { + var display, elem, + values = [], + index = 0, + length = elements.length; + + // Determine new display value for elements that need to change + for ( ; index < length; index++ ) { + elem = elements[ index ]; + if ( !elem.style ) { + continue; + } + + display = elem.style.display; + if ( show ) { + + // Since we force visibility upon cascade-hidden elements, an immediate (and slow) + // check is required in this first loop unless we have a nonempty display value (either + // inline or about-to-be-restored) + if ( display === "none" ) { + values[ index ] = dataPriv.get( elem, "display" ) || null; + if ( !values[ index ] ) { + elem.style.display = ""; + } + } + if ( elem.style.display === "" && isHiddenWithinTree( elem ) ) { + values[ index ] = getDefaultDisplay( elem ); + } + } else { + if ( display !== "none" ) { + values[ index ] = "none"; + + // Remember what we're overwriting + dataPriv.set( elem, "display", display ); + } + } + } + + // Set the display of the elements in a second loop to avoid constant reflow + for ( index = 0; index < length; index++ ) { + if ( values[ index ] != null ) { + elements[ index ].style.display = values[ index ]; + } + } + + return elements; +} + +jQuery.fn.extend( { + show: function() { + return showHide( this, true ); + }, + hide: function() { + return showHide( this ); + }, + toggle: function( state ) { + if ( typeof state === "boolean" ) { + return state ? this.show() : this.hide(); + } + + return this.each( function() { + if ( isHiddenWithinTree( this ) ) { + jQuery( this ).show(); + } else { + jQuery( this ).hide(); + } + } ); + } +} ); +var rcheckableType = ( /^(?:checkbox|radio)$/i ); + +var rtagName = ( /<([a-z][^\/\0>\x20\t\r\n\f]*)/i ); + +var rscriptType = ( /^$|^module$|\/(?:java|ecma)script/i ); + + + +( function() { + var fragment = document.createDocumentFragment(), + div = fragment.appendChild( document.createElement( "div" ) ), + input = document.createElement( "input" ); + + // Support: Android 4.0 - 4.3 only + // Check state lost if the name is set (#11217) + // Support: Windows Web Apps (WWA) + // `name` and `type` must use .setAttribute for WWA (#14901) + input.setAttribute( "type", "radio" ); + input.setAttribute( "checked", "checked" ); + input.setAttribute( "name", "t" ); + + div.appendChild( input ); + + // Support: Android <=4.1 only + // Older WebKit doesn't clone checked state correctly in fragments + support.checkClone = div.cloneNode( true ).cloneNode( true ).lastChild.checked; + + // Support: IE <=11 only + // Make sure textarea (and checkbox) defaultValue is properly cloned + div.innerHTML = ""; + support.noCloneChecked = !!div.cloneNode( true ).lastChild.defaultValue; + + // Support: IE <=9 only + // IE <=9 replaces "; + support.option = !!div.lastChild; +} )(); + + +// We have to close these tags to support XHTML (#13200) +var wrapMap = { + + // XHTML parsers do not magically insert elements in the + // same way that tag soup parsers do. So we cannot shorten + // this by omitting or other required elements. + thead: [ 1, "", "
    " ], + col: [ 2, "", "
    " ], + tr: [ 2, "", "
    " ], + td: [ 3, "", "
    " ], + + _default: [ 0, "", "" ] +}; + +wrapMap.tbody = wrapMap.tfoot = wrapMap.colgroup = wrapMap.caption = wrapMap.thead; +wrapMap.th = wrapMap.td; + +// Support: IE <=9 only +if ( !support.option ) { + wrapMap.optgroup = wrapMap.option = [ 1, "" ]; +} + + +function getAll( context, tag ) { + + // Support: IE <=9 - 11 only + // Use typeof to avoid zero-argument method invocation on host objects (#15151) + var ret; + + if ( typeof context.getElementsByTagName !== "undefined" ) { + ret = context.getElementsByTagName( tag || "*" ); + + } else if ( typeof context.querySelectorAll !== "undefined" ) { + ret = context.querySelectorAll( tag || "*" ); + + } else { + ret = []; + } + + if ( tag === undefined || tag && nodeName( context, tag ) ) { + return jQuery.merge( [ context ], ret ); + } + + return ret; +} + + +// Mark scripts as having already been evaluated +function setGlobalEval( elems, refElements ) { + var i = 0, + l = elems.length; + + for ( ; i < l; i++ ) { + dataPriv.set( + elems[ i ], + "globalEval", + !refElements || dataPriv.get( refElements[ i ], "globalEval" ) + ); + } +} + + +var rhtml = /<|&#?\w+;/; + +function buildFragment( elems, context, scripts, selection, ignored ) { + var elem, tmp, tag, wrap, attached, j, + fragment = context.createDocumentFragment(), + nodes = [], + i = 0, + l = elems.length; + + for ( ; i < l; i++ ) { + elem = elems[ i ]; + + if ( elem || elem === 0 ) { + + // Add nodes directly + if ( toType( elem ) === "object" ) { + + // Support: Android <=4.0 only, PhantomJS 1 only + // push.apply(_, arraylike) throws on ancient WebKit + jQuery.merge( nodes, elem.nodeType ? [ elem ] : elem ); + + // Convert non-html into a text node + } else if ( !rhtml.test( elem ) ) { + nodes.push( context.createTextNode( elem ) ); + + // Convert html into DOM nodes + } else { + tmp = tmp || fragment.appendChild( context.createElement( "div" ) ); + + // Deserialize a standard representation + tag = ( rtagName.exec( elem ) || [ "", "" ] )[ 1 ].toLowerCase(); + wrap = wrapMap[ tag ] || wrapMap._default; + tmp.innerHTML = wrap[ 1 ] + jQuery.htmlPrefilter( elem ) + wrap[ 2 ]; + + // Descend through wrappers to the right content + j = wrap[ 0 ]; + while ( j-- ) { + tmp = tmp.lastChild; + } + + // Support: Android <=4.0 only, PhantomJS 1 only + // push.apply(_, arraylike) throws on ancient WebKit + jQuery.merge( nodes, tmp.childNodes ); + + // Remember the top-level container + tmp = fragment.firstChild; + + // Ensure the created nodes are orphaned (#12392) + tmp.textContent = ""; + } + } + } + + // Remove wrapper from fragment + fragment.textContent = ""; + + i = 0; + while ( ( elem = nodes[ i++ ] ) ) { + + // Skip elements already in the context collection (trac-4087) + if ( selection && jQuery.inArray( elem, selection ) > -1 ) { + if ( ignored ) { + ignored.push( elem ); + } + continue; + } + + attached = isAttached( elem ); + + // Append to fragment + tmp = getAll( fragment.appendChild( elem ), "script" ); + + // Preserve script evaluation history + if ( attached ) { + setGlobalEval( tmp ); + } + + // Capture executables + if ( scripts ) { + j = 0; + while ( ( elem = tmp[ j++ ] ) ) { + if ( rscriptType.test( elem.type || "" ) ) { + scripts.push( elem ); + } + } + } + } + + return fragment; +} + + +var + rkeyEvent = /^key/, + rmouseEvent = /^(?:mouse|pointer|contextmenu|drag|drop)|click/, + rtypenamespace = /^([^.]*)(?:\.(.+)|)/; + +function returnTrue() { + return true; +} + +function returnFalse() { + return false; +} + +// Support: IE <=9 - 11+ +// focus() and blur() are asynchronous, except when they are no-op. +// So expect focus to be synchronous when the element is already active, +// and blur to be synchronous when the element is not already active. +// (focus and blur are always synchronous in other supported browsers, +// this just defines when we can count on it). +function expectSync( elem, type ) { + return ( elem === safeActiveElement() ) === ( type === "focus" ); +} + +// Support: IE <=9 only +// Accessing document.activeElement can throw unexpectedly +// https://bugs.jquery.com/ticket/13393 +function safeActiveElement() { + try { + return document.activeElement; + } catch ( err ) { } +} + +function on( elem, types, selector, data, fn, one ) { + var origFn, type; + + // Types can be a map of types/handlers + if ( typeof types === "object" ) { + + // ( types-Object, selector, data ) + if ( typeof selector !== "string" ) { + + // ( types-Object, data ) + data = data || selector; + selector = undefined; + } + for ( type in types ) { + on( elem, type, selector, data, types[ type ], one ); + } + return elem; + } + + if ( data == null && fn == null ) { + + // ( types, fn ) + fn = selector; + data = selector = undefined; + } else if ( fn == null ) { + if ( typeof selector === "string" ) { + + // ( types, selector, fn ) + fn = data; + data = undefined; + } else { + + // ( types, data, fn ) + fn = data; + data = selector; + selector = undefined; + } + } + if ( fn === false ) { + fn = returnFalse; + } else if ( !fn ) { + return elem; + } + + if ( one === 1 ) { + origFn = fn; + fn = function( event ) { + + // Can use an empty set, since event contains the info + jQuery().off( event ); + return origFn.apply( this, arguments ); + }; + + // Use same guid so caller can remove using origFn + fn.guid = origFn.guid || ( origFn.guid = jQuery.guid++ ); + } + return elem.each( function() { + jQuery.event.add( this, types, fn, data, selector ); + } ); +} + +/* + * Helper functions for managing events -- not part of the public interface. + * Props to Dean Edwards' addEvent library for many of the ideas. + */ +jQuery.event = { + + global: {}, + + add: function( elem, types, handler, data, selector ) { + + var handleObjIn, eventHandle, tmp, + events, t, handleObj, + special, handlers, type, namespaces, origType, + elemData = dataPriv.get( elem ); + + // Only attach events to objects that accept data + if ( !acceptData( elem ) ) { + return; + } + + // Caller can pass in an object of custom data in lieu of the handler + if ( handler.handler ) { + handleObjIn = handler; + handler = handleObjIn.handler; + selector = handleObjIn.selector; + } + + // Ensure that invalid selectors throw exceptions at attach time + // Evaluate against documentElement in case elem is a non-element node (e.g., document) + if ( selector ) { + jQuery.find.matchesSelector( documentElement, selector ); + } + + // Make sure that the handler has a unique ID, used to find/remove it later + if ( !handler.guid ) { + handler.guid = jQuery.guid++; + } + + // Init the element's event structure and main handler, if this is the first + if ( !( events = elemData.events ) ) { + events = elemData.events = Object.create( null ); + } + if ( !( eventHandle = elemData.handle ) ) { + eventHandle = elemData.handle = function( e ) { + + // Discard the second event of a jQuery.event.trigger() and + // when an event is called after a page has unloaded + return typeof jQuery !== "undefined" && jQuery.event.triggered !== e.type ? + jQuery.event.dispatch.apply( elem, arguments ) : undefined; + }; + } + + // Handle multiple events separated by a space + types = ( types || "" ).match( rnothtmlwhite ) || [ "" ]; + t = types.length; + while ( t-- ) { + tmp = rtypenamespace.exec( types[ t ] ) || []; + type = origType = tmp[ 1 ]; + namespaces = ( tmp[ 2 ] || "" ).split( "." ).sort(); + + // There *must* be a type, no attaching namespace-only handlers + if ( !type ) { + continue; + } + + // If event changes its type, use the special event handlers for the changed type + special = jQuery.event.special[ type ] || {}; + + // If selector defined, determine special event api type, otherwise given type + type = ( selector ? special.delegateType : special.bindType ) || type; + + // Update special based on newly reset type + special = jQuery.event.special[ type ] || {}; + + // handleObj is passed to all event handlers + handleObj = jQuery.extend( { + type: type, + origType: origType, + data: data, + handler: handler, + guid: handler.guid, + selector: selector, + needsContext: selector && jQuery.expr.match.needsContext.test( selector ), + namespace: namespaces.join( "." ) + }, handleObjIn ); + + // Init the event handler queue if we're the first + if ( !( handlers = events[ type ] ) ) { + handlers = events[ type ] = []; + handlers.delegateCount = 0; + + // Only use addEventListener if the special events handler returns false + if ( !special.setup || + special.setup.call( elem, data, namespaces, eventHandle ) === false ) { + + if ( elem.addEventListener ) { + elem.addEventListener( type, eventHandle ); + } + } + } + + if ( special.add ) { + special.add.call( elem, handleObj ); + + if ( !handleObj.handler.guid ) { + handleObj.handler.guid = handler.guid; + } + } + + // Add to the element's handler list, delegates in front + if ( selector ) { + handlers.splice( handlers.delegateCount++, 0, handleObj ); + } else { + handlers.push( handleObj ); + } + + // Keep track of which events have ever been used, for event optimization + jQuery.event.global[ type ] = true; + } + + }, + + // Detach an event or set of events from an element + remove: function( elem, types, handler, selector, mappedTypes ) { + + var j, origCount, tmp, + events, t, handleObj, + special, handlers, type, namespaces, origType, + elemData = dataPriv.hasData( elem ) && dataPriv.get( elem ); + + if ( !elemData || !( events = elemData.events ) ) { + return; + } + + // Once for each type.namespace in types; type may be omitted + types = ( types || "" ).match( rnothtmlwhite ) || [ "" ]; + t = types.length; + while ( t-- ) { + tmp = rtypenamespace.exec( types[ t ] ) || []; + type = origType = tmp[ 1 ]; + namespaces = ( tmp[ 2 ] || "" ).split( "." ).sort(); + + // Unbind all events (on this namespace, if provided) for the element + if ( !type ) { + for ( type in events ) { + jQuery.event.remove( elem, type + types[ t ], handler, selector, true ); + } + continue; + } + + special = jQuery.event.special[ type ] || {}; + type = ( selector ? special.delegateType : special.bindType ) || type; + handlers = events[ type ] || []; + tmp = tmp[ 2 ] && + new RegExp( "(^|\\.)" + namespaces.join( "\\.(?:.*\\.|)" ) + "(\\.|$)" ); + + // Remove matching events + origCount = j = handlers.length; + while ( j-- ) { + handleObj = handlers[ j ]; + + if ( ( mappedTypes || origType === handleObj.origType ) && + ( !handler || handler.guid === handleObj.guid ) && + ( !tmp || tmp.test( handleObj.namespace ) ) && + ( !selector || selector === handleObj.selector || + selector === "**" && handleObj.selector ) ) { + handlers.splice( j, 1 ); + + if ( handleObj.selector ) { + handlers.delegateCount--; + } + if ( special.remove ) { + special.remove.call( elem, handleObj ); + } + } + } + + // Remove generic event handler if we removed something and no more handlers exist + // (avoids potential for endless recursion during removal of special event handlers) + if ( origCount && !handlers.length ) { + if ( !special.teardown || + special.teardown.call( elem, namespaces, elemData.handle ) === false ) { + + jQuery.removeEvent( elem, type, elemData.handle ); + } + + delete events[ type ]; + } + } + + // Remove data and the expando if it's no longer used + if ( jQuery.isEmptyObject( events ) ) { + dataPriv.remove( elem, "handle events" ); + } + }, + + dispatch: function( nativeEvent ) { + + var i, j, ret, matched, handleObj, handlerQueue, + args = new Array( arguments.length ), + + // Make a writable jQuery.Event from the native event object + event = jQuery.event.fix( nativeEvent ), + + handlers = ( + dataPriv.get( this, "events" ) || Object.create( null ) + )[ event.type ] || [], + special = jQuery.event.special[ event.type ] || {}; + + // Use the fix-ed jQuery.Event rather than the (read-only) native event + args[ 0 ] = event; + + for ( i = 1; i < arguments.length; i++ ) { + args[ i ] = arguments[ i ]; + } + + event.delegateTarget = this; + + // Call the preDispatch hook for the mapped type, and let it bail if desired + if ( special.preDispatch && special.preDispatch.call( this, event ) === false ) { + return; + } + + // Determine handlers + handlerQueue = jQuery.event.handlers.call( this, event, handlers ); + + // Run delegates first; they may want to stop propagation beneath us + i = 0; + while ( ( matched = handlerQueue[ i++ ] ) && !event.isPropagationStopped() ) { + event.currentTarget = matched.elem; + + j = 0; + while ( ( handleObj = matched.handlers[ j++ ] ) && + !event.isImmediatePropagationStopped() ) { + + // If the event is namespaced, then each handler is only invoked if it is + // specially universal or its namespaces are a superset of the event's. + if ( !event.rnamespace || handleObj.namespace === false || + event.rnamespace.test( handleObj.namespace ) ) { + + event.handleObj = handleObj; + event.data = handleObj.data; + + ret = ( ( jQuery.event.special[ handleObj.origType ] || {} ).handle || + handleObj.handler ).apply( matched.elem, args ); + + if ( ret !== undefined ) { + if ( ( event.result = ret ) === false ) { + event.preventDefault(); + event.stopPropagation(); + } + } + } + } + } + + // Call the postDispatch hook for the mapped type + if ( special.postDispatch ) { + special.postDispatch.call( this, event ); + } + + return event.result; + }, + + handlers: function( event, handlers ) { + var i, handleObj, sel, matchedHandlers, matchedSelectors, + handlerQueue = [], + delegateCount = handlers.delegateCount, + cur = event.target; + + // Find delegate handlers + if ( delegateCount && + + // Support: IE <=9 + // Black-hole SVG instance trees (trac-13180) + cur.nodeType && + + // Support: Firefox <=42 + // Suppress spec-violating clicks indicating a non-primary pointer button (trac-3861) + // https://www.w3.org/TR/DOM-Level-3-Events/#event-type-click + // Support: IE 11 only + // ...but not arrow key "clicks" of radio inputs, which can have `button` -1 (gh-2343) + !( event.type === "click" && event.button >= 1 ) ) { + + for ( ; cur !== this; cur = cur.parentNode || this ) { + + // Don't check non-elements (#13208) + // Don't process clicks on disabled elements (#6911, #8165, #11382, #11764) + if ( cur.nodeType === 1 && !( event.type === "click" && cur.disabled === true ) ) { + matchedHandlers = []; + matchedSelectors = {}; + for ( i = 0; i < delegateCount; i++ ) { + handleObj = handlers[ i ]; + + // Don't conflict with Object.prototype properties (#13203) + sel = handleObj.selector + " "; + + if ( matchedSelectors[ sel ] === undefined ) { + matchedSelectors[ sel ] = handleObj.needsContext ? + jQuery( sel, this ).index( cur ) > -1 : + jQuery.find( sel, this, null, [ cur ] ).length; + } + if ( matchedSelectors[ sel ] ) { + matchedHandlers.push( handleObj ); + } + } + if ( matchedHandlers.length ) { + handlerQueue.push( { elem: cur, handlers: matchedHandlers } ); + } + } + } + } + + // Add the remaining (directly-bound) handlers + cur = this; + if ( delegateCount < handlers.length ) { + handlerQueue.push( { elem: cur, handlers: handlers.slice( delegateCount ) } ); + } + + return handlerQueue; + }, + + addProp: function( name, hook ) { + Object.defineProperty( jQuery.Event.prototype, name, { + enumerable: true, + configurable: true, + + get: isFunction( hook ) ? + function() { + if ( this.originalEvent ) { + return hook( this.originalEvent ); + } + } : + function() { + if ( this.originalEvent ) { + return this.originalEvent[ name ]; + } + }, + + set: function( value ) { + Object.defineProperty( this, name, { + enumerable: true, + configurable: true, + writable: true, + value: value + } ); + } + } ); + }, + + fix: function( originalEvent ) { + return originalEvent[ jQuery.expando ] ? + originalEvent : + new jQuery.Event( originalEvent ); + }, + + special: { + load: { + + // Prevent triggered image.load events from bubbling to window.load + noBubble: true + }, + click: { + + // Utilize native event to ensure correct state for checkable inputs + setup: function( data ) { + + // For mutual compressibility with _default, replace `this` access with a local var. + // `|| data` is dead code meant only to preserve the variable through minification. + var el = this || data; + + // Claim the first handler + if ( rcheckableType.test( el.type ) && + el.click && nodeName( el, "input" ) ) { + + // dataPriv.set( el, "click", ... ) + leverageNative( el, "click", returnTrue ); + } + + // Return false to allow normal processing in the caller + return false; + }, + trigger: function( data ) { + + // For mutual compressibility with _default, replace `this` access with a local var. + // `|| data` is dead code meant only to preserve the variable through minification. + var el = this || data; + + // Force setup before triggering a click + if ( rcheckableType.test( el.type ) && + el.click && nodeName( el, "input" ) ) { + + leverageNative( el, "click" ); + } + + // Return non-false to allow normal event-path propagation + return true; + }, + + // For cross-browser consistency, suppress native .click() on links + // Also prevent it if we're currently inside a leveraged native-event stack + _default: function( event ) { + var target = event.target; + return rcheckableType.test( target.type ) && + target.click && nodeName( target, "input" ) && + dataPriv.get( target, "click" ) || + nodeName( target, "a" ); + } + }, + + beforeunload: { + postDispatch: function( event ) { + + // Support: Firefox 20+ + // Firefox doesn't alert if the returnValue field is not set. + if ( event.result !== undefined && event.originalEvent ) { + event.originalEvent.returnValue = event.result; + } + } + } + } +}; + +// Ensure the presence of an event listener that handles manually-triggered +// synthetic events by interrupting progress until reinvoked in response to +// *native* events that it fires directly, ensuring that state changes have +// already occurred before other listeners are invoked. +function leverageNative( el, type, expectSync ) { + + // Missing expectSync indicates a trigger call, which must force setup through jQuery.event.add + if ( !expectSync ) { + if ( dataPriv.get( el, type ) === undefined ) { + jQuery.event.add( el, type, returnTrue ); + } + return; + } + + // Register the controller as a special universal handler for all event namespaces + dataPriv.set( el, type, false ); + jQuery.event.add( el, type, { + namespace: false, + handler: function( event ) { + var notAsync, result, + saved = dataPriv.get( this, type ); + + if ( ( event.isTrigger & 1 ) && this[ type ] ) { + + // Interrupt processing of the outer synthetic .trigger()ed event + // Saved data should be false in such cases, but might be a leftover capture object + // from an async native handler (gh-4350) + if ( !saved.length ) { + + // Store arguments for use when handling the inner native event + // There will always be at least one argument (an event object), so this array + // will not be confused with a leftover capture object. + saved = slice.call( arguments ); + dataPriv.set( this, type, saved ); + + // Trigger the native event and capture its result + // Support: IE <=9 - 11+ + // focus() and blur() are asynchronous + notAsync = expectSync( this, type ); + this[ type ](); + result = dataPriv.get( this, type ); + if ( saved !== result || notAsync ) { + dataPriv.set( this, type, false ); + } else { + result = {}; + } + if ( saved !== result ) { + + // Cancel the outer synthetic event + event.stopImmediatePropagation(); + event.preventDefault(); + return result.value; + } + + // If this is an inner synthetic event for an event with a bubbling surrogate + // (focus or blur), assume that the surrogate already propagated from triggering the + // native event and prevent that from happening again here. + // This technically gets the ordering wrong w.r.t. to `.trigger()` (in which the + // bubbling surrogate propagates *after* the non-bubbling base), but that seems + // less bad than duplication. + } else if ( ( jQuery.event.special[ type ] || {} ).delegateType ) { + event.stopPropagation(); + } + + // If this is a native event triggered above, everything is now in order + // Fire an inner synthetic event with the original arguments + } else if ( saved.length ) { + + // ...and capture the result + dataPriv.set( this, type, { + value: jQuery.event.trigger( + + // Support: IE <=9 - 11+ + // Extend with the prototype to reset the above stopImmediatePropagation() + jQuery.extend( saved[ 0 ], jQuery.Event.prototype ), + saved.slice( 1 ), + this + ) + } ); + + // Abort handling of the native event + event.stopImmediatePropagation(); + } + } + } ); +} + +jQuery.removeEvent = function( elem, type, handle ) { + + // This "if" is needed for plain objects + if ( elem.removeEventListener ) { + elem.removeEventListener( type, handle ); + } +}; + +jQuery.Event = function( src, props ) { + + // Allow instantiation without the 'new' keyword + if ( !( this instanceof jQuery.Event ) ) { + return new jQuery.Event( src, props ); + } + + // Event object + if ( src && src.type ) { + this.originalEvent = src; + this.type = src.type; + + // Events bubbling up the document may have been marked as prevented + // by a handler lower down the tree; reflect the correct value. + this.isDefaultPrevented = src.defaultPrevented || + src.defaultPrevented === undefined && + + // Support: Android <=2.3 only + src.returnValue === false ? + returnTrue : + returnFalse; + + // Create target properties + // Support: Safari <=6 - 7 only + // Target should not be a text node (#504, #13143) + this.target = ( src.target && src.target.nodeType === 3 ) ? + src.target.parentNode : + src.target; + + this.currentTarget = src.currentTarget; + this.relatedTarget = src.relatedTarget; + + // Event type + } else { + this.type = src; + } + + // Put explicitly provided properties onto the event object + if ( props ) { + jQuery.extend( this, props ); + } + + // Create a timestamp if incoming event doesn't have one + this.timeStamp = src && src.timeStamp || Date.now(); + + // Mark it as fixed + this[ jQuery.expando ] = true; +}; + +// jQuery.Event is based on DOM3 Events as specified by the ECMAScript Language Binding +// https://www.w3.org/TR/2003/WD-DOM-Level-3-Events-20030331/ecma-script-binding.html +jQuery.Event.prototype = { + constructor: jQuery.Event, + isDefaultPrevented: returnFalse, + isPropagationStopped: returnFalse, + isImmediatePropagationStopped: returnFalse, + isSimulated: false, + + preventDefault: function() { + var e = this.originalEvent; + + this.isDefaultPrevented = returnTrue; + + if ( e && !this.isSimulated ) { + e.preventDefault(); + } + }, + stopPropagation: function() { + var e = this.originalEvent; + + this.isPropagationStopped = returnTrue; + + if ( e && !this.isSimulated ) { + e.stopPropagation(); + } + }, + stopImmediatePropagation: function() { + var e = this.originalEvent; + + this.isImmediatePropagationStopped = returnTrue; + + if ( e && !this.isSimulated ) { + e.stopImmediatePropagation(); + } + + this.stopPropagation(); + } +}; + +// Includes all common event props including KeyEvent and MouseEvent specific props +jQuery.each( { + altKey: true, + bubbles: true, + cancelable: true, + changedTouches: true, + ctrlKey: true, + detail: true, + eventPhase: true, + metaKey: true, + pageX: true, + pageY: true, + shiftKey: true, + view: true, + "char": true, + code: true, + charCode: true, + key: true, + keyCode: true, + button: true, + buttons: true, + clientX: true, + clientY: true, + offsetX: true, + offsetY: true, + pointerId: true, + pointerType: true, + screenX: true, + screenY: true, + targetTouches: true, + toElement: true, + touches: true, + + which: function( event ) { + var button = event.button; + + // Add which for key events + if ( event.which == null && rkeyEvent.test( event.type ) ) { + return event.charCode != null ? event.charCode : event.keyCode; + } + + // Add which for click: 1 === left; 2 === middle; 3 === right + if ( !event.which && button !== undefined && rmouseEvent.test( event.type ) ) { + if ( button & 1 ) { + return 1; + } + + if ( button & 2 ) { + return 3; + } + + if ( button & 4 ) { + return 2; + } + + return 0; + } + + return event.which; + } +}, jQuery.event.addProp ); + +jQuery.each( { focus: "focusin", blur: "focusout" }, function( type, delegateType ) { + jQuery.event.special[ type ] = { + + // Utilize native event if possible so blur/focus sequence is correct + setup: function() { + + // Claim the first handler + // dataPriv.set( this, "focus", ... ) + // dataPriv.set( this, "blur", ... ) + leverageNative( this, type, expectSync ); + + // Return false to allow normal processing in the caller + return false; + }, + trigger: function() { + + // Force setup before trigger + leverageNative( this, type ); + + // Return non-false to allow normal event-path propagation + return true; + }, + + delegateType: delegateType + }; +} ); + +// Create mouseenter/leave events using mouseover/out and event-time checks +// so that event delegation works in jQuery. +// Do the same for pointerenter/pointerleave and pointerover/pointerout +// +// Support: Safari 7 only +// Safari sends mouseenter too often; see: +// https://bugs.chromium.org/p/chromium/issues/detail?id=470258 +// for the description of the bug (it existed in older Chrome versions as well). +jQuery.each( { + mouseenter: "mouseover", + mouseleave: "mouseout", + pointerenter: "pointerover", + pointerleave: "pointerout" +}, function( orig, fix ) { + jQuery.event.special[ orig ] = { + delegateType: fix, + bindType: fix, + + handle: function( event ) { + var ret, + target = this, + related = event.relatedTarget, + handleObj = event.handleObj; + + // For mouseenter/leave call the handler if related is outside the target. + // NB: No relatedTarget if the mouse left/entered the browser window + if ( !related || ( related !== target && !jQuery.contains( target, related ) ) ) { + event.type = handleObj.origType; + ret = handleObj.handler.apply( this, arguments ); + event.type = fix; + } + return ret; + } + }; +} ); + +jQuery.fn.extend( { + + on: function( types, selector, data, fn ) { + return on( this, types, selector, data, fn ); + }, + one: function( types, selector, data, fn ) { + return on( this, types, selector, data, fn, 1 ); + }, + off: function( types, selector, fn ) { + var handleObj, type; + if ( types && types.preventDefault && types.handleObj ) { + + // ( event ) dispatched jQuery.Event + handleObj = types.handleObj; + jQuery( types.delegateTarget ).off( + handleObj.namespace ? + handleObj.origType + "." + handleObj.namespace : + handleObj.origType, + handleObj.selector, + handleObj.handler + ); + return this; + } + if ( typeof types === "object" ) { + + // ( types-object [, selector] ) + for ( type in types ) { + this.off( type, selector, types[ type ] ); + } + return this; + } + if ( selector === false || typeof selector === "function" ) { + + // ( types [, fn] ) + fn = selector; + selector = undefined; + } + if ( fn === false ) { + fn = returnFalse; + } + return this.each( function() { + jQuery.event.remove( this, types, fn, selector ); + } ); + } +} ); + + +var + + // Support: IE <=10 - 11, Edge 12 - 13 only + // In IE/Edge using regex groups here causes severe slowdowns. + // See https://connect.microsoft.com/IE/feedback/details/1736512/ + rnoInnerhtml = /\s*$/g; + +// Prefer a tbody over its parent table for containing new rows +function manipulationTarget( elem, content ) { + if ( nodeName( elem, "table" ) && + nodeName( content.nodeType !== 11 ? content : content.firstChild, "tr" ) ) { + + return jQuery( elem ).children( "tbody" )[ 0 ] || elem; + } + + return elem; +} + +// Replace/restore the type attribute of script elements for safe DOM manipulation +function disableScript( elem ) { + elem.type = ( elem.getAttribute( "type" ) !== null ) + "/" + elem.type; + return elem; +} +function restoreScript( elem ) { + if ( ( elem.type || "" ).slice( 0, 5 ) === "true/" ) { + elem.type = elem.type.slice( 5 ); + } else { + elem.removeAttribute( "type" ); + } + + return elem; +} + +function cloneCopyEvent( src, dest ) { + var i, l, type, pdataOld, udataOld, udataCur, events; + + if ( dest.nodeType !== 1 ) { + return; + } + + // 1. Copy private data: events, handlers, etc. + if ( dataPriv.hasData( src ) ) { + pdataOld = dataPriv.get( src ); + events = pdataOld.events; + + if ( events ) { + dataPriv.remove( dest, "handle events" ); + + for ( type in events ) { + for ( i = 0, l = events[ type ].length; i < l; i++ ) { + jQuery.event.add( dest, type, events[ type ][ i ] ); + } + } + } + } + + // 2. Copy user data + if ( dataUser.hasData( src ) ) { + udataOld = dataUser.access( src ); + udataCur = jQuery.extend( {}, udataOld ); + + dataUser.set( dest, udataCur ); + } +} + +// Fix IE bugs, see support tests +function fixInput( src, dest ) { + var nodeName = dest.nodeName.toLowerCase(); + + // Fails to persist the checked state of a cloned checkbox or radio button. + if ( nodeName === "input" && rcheckableType.test( src.type ) ) { + dest.checked = src.checked; + + // Fails to return the selected option to the default selected state when cloning options + } else if ( nodeName === "input" || nodeName === "textarea" ) { + dest.defaultValue = src.defaultValue; + } +} + +function domManip( collection, args, callback, ignored ) { + + // Flatten any nested arrays + args = flat( args ); + + var fragment, first, scripts, hasScripts, node, doc, + i = 0, + l = collection.length, + iNoClone = l - 1, + value = args[ 0 ], + valueIsFunction = isFunction( value ); + + // We can't cloneNode fragments that contain checked, in WebKit + if ( valueIsFunction || + ( l > 1 && typeof value === "string" && + !support.checkClone && rchecked.test( value ) ) ) { + return collection.each( function( index ) { + var self = collection.eq( index ); + if ( valueIsFunction ) { + args[ 0 ] = value.call( this, index, self.html() ); + } + domManip( self, args, callback, ignored ); + } ); + } + + if ( l ) { + fragment = buildFragment( args, collection[ 0 ].ownerDocument, false, collection, ignored ); + first = fragment.firstChild; + + if ( fragment.childNodes.length === 1 ) { + fragment = first; + } + + // Require either new content or an interest in ignored elements to invoke the callback + if ( first || ignored ) { + scripts = jQuery.map( getAll( fragment, "script" ), disableScript ); + hasScripts = scripts.length; + + // Use the original fragment for the last item + // instead of the first because it can end up + // being emptied incorrectly in certain situations (#8070). + for ( ; i < l; i++ ) { + node = fragment; + + if ( i !== iNoClone ) { + node = jQuery.clone( node, true, true ); + + // Keep references to cloned scripts for later restoration + if ( hasScripts ) { + + // Support: Android <=4.0 only, PhantomJS 1 only + // push.apply(_, arraylike) throws on ancient WebKit + jQuery.merge( scripts, getAll( node, "script" ) ); + } + } + + callback.call( collection[ i ], node, i ); + } + + if ( hasScripts ) { + doc = scripts[ scripts.length - 1 ].ownerDocument; + + // Reenable scripts + jQuery.map( scripts, restoreScript ); + + // Evaluate executable scripts on first document insertion + for ( i = 0; i < hasScripts; i++ ) { + node = scripts[ i ]; + if ( rscriptType.test( node.type || "" ) && + !dataPriv.access( node, "globalEval" ) && + jQuery.contains( doc, node ) ) { + + if ( node.src && ( node.type || "" ).toLowerCase() !== "module" ) { + + // Optional AJAX dependency, but won't run scripts if not present + if ( jQuery._evalUrl && !node.noModule ) { + jQuery._evalUrl( node.src, { + nonce: node.nonce || node.getAttribute( "nonce" ) + }, doc ); + } + } else { + DOMEval( node.textContent.replace( rcleanScript, "" ), node, doc ); + } + } + } + } + } + } + + return collection; +} + +function remove( elem, selector, keepData ) { + var node, + nodes = selector ? jQuery.filter( selector, elem ) : elem, + i = 0; + + for ( ; ( node = nodes[ i ] ) != null; i++ ) { + if ( !keepData && node.nodeType === 1 ) { + jQuery.cleanData( getAll( node ) ); + } + + if ( node.parentNode ) { + if ( keepData && isAttached( node ) ) { + setGlobalEval( getAll( node, "script" ) ); + } + node.parentNode.removeChild( node ); + } + } + + return elem; +} + +jQuery.extend( { + htmlPrefilter: function( html ) { + return html; + }, + + clone: function( elem, dataAndEvents, deepDataAndEvents ) { + var i, l, srcElements, destElements, + clone = elem.cloneNode( true ), + inPage = isAttached( elem ); + + // Fix IE cloning issues + if ( !support.noCloneChecked && ( elem.nodeType === 1 || elem.nodeType === 11 ) && + !jQuery.isXMLDoc( elem ) ) { + + // We eschew Sizzle here for performance reasons: https://jsperf.com/getall-vs-sizzle/2 + destElements = getAll( clone ); + srcElements = getAll( elem ); + + for ( i = 0, l = srcElements.length; i < l; i++ ) { + fixInput( srcElements[ i ], destElements[ i ] ); + } + } + + // Copy the events from the original to the clone + if ( dataAndEvents ) { + if ( deepDataAndEvents ) { + srcElements = srcElements || getAll( elem ); + destElements = destElements || getAll( clone ); + + for ( i = 0, l = srcElements.length; i < l; i++ ) { + cloneCopyEvent( srcElements[ i ], destElements[ i ] ); + } + } else { + cloneCopyEvent( elem, clone ); + } + } + + // Preserve script evaluation history + destElements = getAll( clone, "script" ); + if ( destElements.length > 0 ) { + setGlobalEval( destElements, !inPage && getAll( elem, "script" ) ); + } + + // Return the cloned set + return clone; + }, + + cleanData: function( elems ) { + var data, elem, type, + special = jQuery.event.special, + i = 0; + + for ( ; ( elem = elems[ i ] ) !== undefined; i++ ) { + if ( acceptData( elem ) ) { + if ( ( data = elem[ dataPriv.expando ] ) ) { + if ( data.events ) { + for ( type in data.events ) { + if ( special[ type ] ) { + jQuery.event.remove( elem, type ); + + // This is a shortcut to avoid jQuery.event.remove's overhead + } else { + jQuery.removeEvent( elem, type, data.handle ); + } + } + } + + // Support: Chrome <=35 - 45+ + // Assign undefined instead of using delete, see Data#remove + elem[ dataPriv.expando ] = undefined; + } + if ( elem[ dataUser.expando ] ) { + + // Support: Chrome <=35 - 45+ + // Assign undefined instead of using delete, see Data#remove + elem[ dataUser.expando ] = undefined; + } + } + } + } +} ); + +jQuery.fn.extend( { + detach: function( selector ) { + return remove( this, selector, true ); + }, + + remove: function( selector ) { + return remove( this, selector ); + }, + + text: function( value ) { + return access( this, function( value ) { + return value === undefined ? + jQuery.text( this ) : + this.empty().each( function() { + if ( this.nodeType === 1 || this.nodeType === 11 || this.nodeType === 9 ) { + this.textContent = value; + } + } ); + }, null, value, arguments.length ); + }, + + append: function() { + return domManip( this, arguments, function( elem ) { + if ( this.nodeType === 1 || this.nodeType === 11 || this.nodeType === 9 ) { + var target = manipulationTarget( this, elem ); + target.appendChild( elem ); + } + } ); + }, + + prepend: function() { + return domManip( this, arguments, function( elem ) { + if ( this.nodeType === 1 || this.nodeType === 11 || this.nodeType === 9 ) { + var target = manipulationTarget( this, elem ); + target.insertBefore( elem, target.firstChild ); + } + } ); + }, + + before: function() { + return domManip( this, arguments, function( elem ) { + if ( this.parentNode ) { + this.parentNode.insertBefore( elem, this ); + } + } ); + }, + + after: function() { + return domManip( this, arguments, function( elem ) { + if ( this.parentNode ) { + this.parentNode.insertBefore( elem, this.nextSibling ); + } + } ); + }, + + empty: function() { + var elem, + i = 0; + + for ( ; ( elem = this[ i ] ) != null; i++ ) { + if ( elem.nodeType === 1 ) { + + // Prevent memory leaks + jQuery.cleanData( getAll( elem, false ) ); + + // Remove any remaining nodes + elem.textContent = ""; + } + } + + return this; + }, + + clone: function( dataAndEvents, deepDataAndEvents ) { + dataAndEvents = dataAndEvents == null ? false : dataAndEvents; + deepDataAndEvents = deepDataAndEvents == null ? dataAndEvents : deepDataAndEvents; + + return this.map( function() { + return jQuery.clone( this, dataAndEvents, deepDataAndEvents ); + } ); + }, + + html: function( value ) { + return access( this, function( value ) { + var elem = this[ 0 ] || {}, + i = 0, + l = this.length; + + if ( value === undefined && elem.nodeType === 1 ) { + return elem.innerHTML; + } + + // See if we can take a shortcut and just use innerHTML + if ( typeof value === "string" && !rnoInnerhtml.test( value ) && + !wrapMap[ ( rtagName.exec( value ) || [ "", "" ] )[ 1 ].toLowerCase() ] ) { + + value = jQuery.htmlPrefilter( value ); + + try { + for ( ; i < l; i++ ) { + elem = this[ i ] || {}; + + // Remove element nodes and prevent memory leaks + if ( elem.nodeType === 1 ) { + jQuery.cleanData( getAll( elem, false ) ); + elem.innerHTML = value; + } + } + + elem = 0; + + // If using innerHTML throws an exception, use the fallback method + } catch ( e ) {} + } + + if ( elem ) { + this.empty().append( value ); + } + }, null, value, arguments.length ); + }, + + replaceWith: function() { + var ignored = []; + + // Make the changes, replacing each non-ignored context element with the new content + return domManip( this, arguments, function( elem ) { + var parent = this.parentNode; + + if ( jQuery.inArray( this, ignored ) < 0 ) { + jQuery.cleanData( getAll( this ) ); + if ( parent ) { + parent.replaceChild( elem, this ); + } + } + + // Force callback invocation + }, ignored ); + } +} ); + +jQuery.each( { + appendTo: "append", + prependTo: "prepend", + insertBefore: "before", + insertAfter: "after", + replaceAll: "replaceWith" +}, function( name, original ) { + jQuery.fn[ name ] = function( selector ) { + var elems, + ret = [], + insert = jQuery( selector ), + last = insert.length - 1, + i = 0; + + for ( ; i <= last; i++ ) { + elems = i === last ? this : this.clone( true ); + jQuery( insert[ i ] )[ original ]( elems ); + + // Support: Android <=4.0 only, PhantomJS 1 only + // .get() because push.apply(_, arraylike) throws on ancient WebKit + push.apply( ret, elems.get() ); + } + + return this.pushStack( ret ); + }; +} ); +var rnumnonpx = new RegExp( "^(" + pnum + ")(?!px)[a-z%]+$", "i" ); + +var getStyles = function( elem ) { + + // Support: IE <=11 only, Firefox <=30 (#15098, #14150) + // IE throws on elements created in popups + // FF meanwhile throws on frame elements through "defaultView.getComputedStyle" + var view = elem.ownerDocument.defaultView; + + if ( !view || !view.opener ) { + view = window; + } + + return view.getComputedStyle( elem ); + }; + +var swap = function( elem, options, callback ) { + var ret, name, + old = {}; + + // Remember the old values, and insert the new ones + for ( name in options ) { + old[ name ] = elem.style[ name ]; + elem.style[ name ] = options[ name ]; + } + + ret = callback.call( elem ); + + // Revert the old values + for ( name in options ) { + elem.style[ name ] = old[ name ]; + } + + return ret; +}; + + +var rboxStyle = new RegExp( cssExpand.join( "|" ), "i" ); + + + +( function() { + + // Executing both pixelPosition & boxSizingReliable tests require only one layout + // so they're executed at the same time to save the second computation. + function computeStyleTests() { + + // This is a singleton, we need to execute it only once + if ( !div ) { + return; + } + + container.style.cssText = "position:absolute;left:-11111px;width:60px;" + + "margin-top:1px;padding:0;border:0"; + div.style.cssText = + "position:relative;display:block;box-sizing:border-box;overflow:scroll;" + + "margin:auto;border:1px;padding:1px;" + + "width:60%;top:1%"; + documentElement.appendChild( container ).appendChild( div ); + + var divStyle = window.getComputedStyle( div ); + pixelPositionVal = divStyle.top !== "1%"; + + // Support: Android 4.0 - 4.3 only, Firefox <=3 - 44 + reliableMarginLeftVal = roundPixelMeasures( divStyle.marginLeft ) === 12; + + // Support: Android 4.0 - 4.3 only, Safari <=9.1 - 10.1, iOS <=7.0 - 9.3 + // Some styles come back with percentage values, even though they shouldn't + div.style.right = "60%"; + pixelBoxStylesVal = roundPixelMeasures( divStyle.right ) === 36; + + // Support: IE 9 - 11 only + // Detect misreporting of content dimensions for box-sizing:border-box elements + boxSizingReliableVal = roundPixelMeasures( divStyle.width ) === 36; + + // Support: IE 9 only + // Detect overflow:scroll screwiness (gh-3699) + // Support: Chrome <=64 + // Don't get tricked when zoom affects offsetWidth (gh-4029) + div.style.position = "absolute"; + scrollboxSizeVal = roundPixelMeasures( div.offsetWidth / 3 ) === 12; + + documentElement.removeChild( container ); + + // Nullify the div so it wouldn't be stored in the memory and + // it will also be a sign that checks already performed + div = null; + } + + function roundPixelMeasures( measure ) { + return Math.round( parseFloat( measure ) ); + } + + var pixelPositionVal, boxSizingReliableVal, scrollboxSizeVal, pixelBoxStylesVal, + reliableTrDimensionsVal, reliableMarginLeftVal, + container = document.createElement( "div" ), + div = document.createElement( "div" ); + + // Finish early in limited (non-browser) environments + if ( !div.style ) { + return; + } + + // Support: IE <=9 - 11 only + // Style of cloned element affects source element cloned (#8908) + div.style.backgroundClip = "content-box"; + div.cloneNode( true ).style.backgroundClip = ""; + support.clearCloneStyle = div.style.backgroundClip === "content-box"; + + jQuery.extend( support, { + boxSizingReliable: function() { + computeStyleTests(); + return boxSizingReliableVal; + }, + pixelBoxStyles: function() { + computeStyleTests(); + return pixelBoxStylesVal; + }, + pixelPosition: function() { + computeStyleTests(); + return pixelPositionVal; + }, + reliableMarginLeft: function() { + computeStyleTests(); + return reliableMarginLeftVal; + }, + scrollboxSize: function() { + computeStyleTests(); + return scrollboxSizeVal; + }, + + // Support: IE 9 - 11+, Edge 15 - 18+ + // IE/Edge misreport `getComputedStyle` of table rows with width/height + // set in CSS while `offset*` properties report correct values. + // Behavior in IE 9 is more subtle than in newer versions & it passes + // some versions of this test; make sure not to make it pass there! + reliableTrDimensions: function() { + var table, tr, trChild, trStyle; + if ( reliableTrDimensionsVal == null ) { + table = document.createElement( "table" ); + tr = document.createElement( "tr" ); + trChild = document.createElement( "div" ); + + table.style.cssText = "position:absolute;left:-11111px"; + tr.style.height = "1px"; + trChild.style.height = "9px"; + + documentElement + .appendChild( table ) + .appendChild( tr ) + .appendChild( trChild ); + + trStyle = window.getComputedStyle( tr ); + reliableTrDimensionsVal = parseInt( trStyle.height ) > 3; + + documentElement.removeChild( table ); + } + return reliableTrDimensionsVal; + } + } ); +} )(); + + +function curCSS( elem, name, computed ) { + var width, minWidth, maxWidth, ret, + + // Support: Firefox 51+ + // Retrieving style before computed somehow + // fixes an issue with getting wrong values + // on detached elements + style = elem.style; + + computed = computed || getStyles( elem ); + + // getPropertyValue is needed for: + // .css('filter') (IE 9 only, #12537) + // .css('--customProperty) (#3144) + if ( computed ) { + ret = computed.getPropertyValue( name ) || computed[ name ]; + + if ( ret === "" && !isAttached( elem ) ) { + ret = jQuery.style( elem, name ); + } + + // A tribute to the "awesome hack by Dean Edwards" + // Android Browser returns percentage for some values, + // but width seems to be reliably pixels. + // This is against the CSSOM draft spec: + // https://drafts.csswg.org/cssom/#resolved-values + if ( !support.pixelBoxStyles() && rnumnonpx.test( ret ) && rboxStyle.test( name ) ) { + + // Remember the original values + width = style.width; + minWidth = style.minWidth; + maxWidth = style.maxWidth; + + // Put in the new values to get a computed value out + style.minWidth = style.maxWidth = style.width = ret; + ret = computed.width; + + // Revert the changed values + style.width = width; + style.minWidth = minWidth; + style.maxWidth = maxWidth; + } + } + + return ret !== undefined ? + + // Support: IE <=9 - 11 only + // IE returns zIndex value as an integer. + ret + "" : + ret; +} + + +function addGetHookIf( conditionFn, hookFn ) { + + // Define the hook, we'll check on the first run if it's really needed. + return { + get: function() { + if ( conditionFn() ) { + + // Hook not needed (or it's not possible to use it due + // to missing dependency), remove it. + delete this.get; + return; + } + + // Hook needed; redefine it so that the support test is not executed again. + return ( this.get = hookFn ).apply( this, arguments ); + } + }; +} + + +var cssPrefixes = [ "Webkit", "Moz", "ms" ], + emptyStyle = document.createElement( "div" ).style, + vendorProps = {}; + +// Return a vendor-prefixed property or undefined +function vendorPropName( name ) { + + // Check for vendor prefixed names + var capName = name[ 0 ].toUpperCase() + name.slice( 1 ), + i = cssPrefixes.length; + + while ( i-- ) { + name = cssPrefixes[ i ] + capName; + if ( name in emptyStyle ) { + return name; + } + } +} + +// Return a potentially-mapped jQuery.cssProps or vendor prefixed property +function finalPropName( name ) { + var final = jQuery.cssProps[ name ] || vendorProps[ name ]; + + if ( final ) { + return final; + } + if ( name in emptyStyle ) { + return name; + } + return vendorProps[ name ] = vendorPropName( name ) || name; +} + + +var + + // Swappable if display is none or starts with table + // except "table", "table-cell", or "table-caption" + // See here for display values: https://developer.mozilla.org/en-US/docs/CSS/display + rdisplayswap = /^(none|table(?!-c[ea]).+)/, + rcustomProp = /^--/, + cssShow = { position: "absolute", visibility: "hidden", display: "block" }, + cssNormalTransform = { + letterSpacing: "0", + fontWeight: "400" + }; + +function setPositiveNumber( _elem, value, subtract ) { + + // Any relative (+/-) values have already been + // normalized at this point + var matches = rcssNum.exec( value ); + return matches ? + + // Guard against undefined "subtract", e.g., when used as in cssHooks + Math.max( 0, matches[ 2 ] - ( subtract || 0 ) ) + ( matches[ 3 ] || "px" ) : + value; +} + +function boxModelAdjustment( elem, dimension, box, isBorderBox, styles, computedVal ) { + var i = dimension === "width" ? 1 : 0, + extra = 0, + delta = 0; + + // Adjustment may not be necessary + if ( box === ( isBorderBox ? "border" : "content" ) ) { + return 0; + } + + for ( ; i < 4; i += 2 ) { + + // Both box models exclude margin + if ( box === "margin" ) { + delta += jQuery.css( elem, box + cssExpand[ i ], true, styles ); + } + + // If we get here with a content-box, we're seeking "padding" or "border" or "margin" + if ( !isBorderBox ) { + + // Add padding + delta += jQuery.css( elem, "padding" + cssExpand[ i ], true, styles ); + + // For "border" or "margin", add border + if ( box !== "padding" ) { + delta += jQuery.css( elem, "border" + cssExpand[ i ] + "Width", true, styles ); + + // But still keep track of it otherwise + } else { + extra += jQuery.css( elem, "border" + cssExpand[ i ] + "Width", true, styles ); + } + + // If we get here with a border-box (content + padding + border), we're seeking "content" or + // "padding" or "margin" + } else { + + // For "content", subtract padding + if ( box === "content" ) { + delta -= jQuery.css( elem, "padding" + cssExpand[ i ], true, styles ); + } + + // For "content" or "padding", subtract border + if ( box !== "margin" ) { + delta -= jQuery.css( elem, "border" + cssExpand[ i ] + "Width", true, styles ); + } + } + } + + // Account for positive content-box scroll gutter when requested by providing computedVal + if ( !isBorderBox && computedVal >= 0 ) { + + // offsetWidth/offsetHeight is a rounded sum of content, padding, scroll gutter, and border + // Assuming integer scroll gutter, subtract the rest and round down + delta += Math.max( 0, Math.ceil( + elem[ "offset" + dimension[ 0 ].toUpperCase() + dimension.slice( 1 ) ] - + computedVal - + delta - + extra - + 0.5 + + // If offsetWidth/offsetHeight is unknown, then we can't determine content-box scroll gutter + // Use an explicit zero to avoid NaN (gh-3964) + ) ) || 0; + } + + return delta; +} + +function getWidthOrHeight( elem, dimension, extra ) { + + // Start with computed style + var styles = getStyles( elem ), + + // To avoid forcing a reflow, only fetch boxSizing if we need it (gh-4322). + // Fake content-box until we know it's needed to know the true value. + boxSizingNeeded = !support.boxSizingReliable() || extra, + isBorderBox = boxSizingNeeded && + jQuery.css( elem, "boxSizing", false, styles ) === "border-box", + valueIsBorderBox = isBorderBox, + + val = curCSS( elem, dimension, styles ), + offsetProp = "offset" + dimension[ 0 ].toUpperCase() + dimension.slice( 1 ); + + // Support: Firefox <=54 + // Return a confounding non-pixel value or feign ignorance, as appropriate. + if ( rnumnonpx.test( val ) ) { + if ( !extra ) { + return val; + } + val = "auto"; + } + + + // Support: IE 9 - 11 only + // Use offsetWidth/offsetHeight for when box sizing is unreliable. + // In those cases, the computed value can be trusted to be border-box. + if ( ( !support.boxSizingReliable() && isBorderBox || + + // Support: IE 10 - 11+, Edge 15 - 18+ + // IE/Edge misreport `getComputedStyle` of table rows with width/height + // set in CSS while `offset*` properties report correct values. + // Interestingly, in some cases IE 9 doesn't suffer from this issue. + !support.reliableTrDimensions() && nodeName( elem, "tr" ) || + + // Fall back to offsetWidth/offsetHeight when value is "auto" + // This happens for inline elements with no explicit setting (gh-3571) + val === "auto" || + + // Support: Android <=4.1 - 4.3 only + // Also use offsetWidth/offsetHeight for misreported inline dimensions (gh-3602) + !parseFloat( val ) && jQuery.css( elem, "display", false, styles ) === "inline" ) && + + // Make sure the element is visible & connected + elem.getClientRects().length ) { + + isBorderBox = jQuery.css( elem, "boxSizing", false, styles ) === "border-box"; + + // Where available, offsetWidth/offsetHeight approximate border box dimensions. + // Where not available (e.g., SVG), assume unreliable box-sizing and interpret the + // retrieved value as a content box dimension. + valueIsBorderBox = offsetProp in elem; + if ( valueIsBorderBox ) { + val = elem[ offsetProp ]; + } + } + + // Normalize "" and auto + val = parseFloat( val ) || 0; + + // Adjust for the element's box model + return ( val + + boxModelAdjustment( + elem, + dimension, + extra || ( isBorderBox ? "border" : "content" ), + valueIsBorderBox, + styles, + + // Provide the current computed size to request scroll gutter calculation (gh-3589) + val + ) + ) + "px"; +} + +jQuery.extend( { + + // Add in style property hooks for overriding the default + // behavior of getting and setting a style property + cssHooks: { + opacity: { + get: function( elem, computed ) { + if ( computed ) { + + // We should always get a number back from opacity + var ret = curCSS( elem, "opacity" ); + return ret === "" ? "1" : ret; + } + } + } + }, + + // Don't automatically add "px" to these possibly-unitless properties + cssNumber: { + "animationIterationCount": true, + "columnCount": true, + "fillOpacity": true, + "flexGrow": true, + "flexShrink": true, + "fontWeight": true, + "gridArea": true, + "gridColumn": true, + "gridColumnEnd": true, + "gridColumnStart": true, + "gridRow": true, + "gridRowEnd": true, + "gridRowStart": true, + "lineHeight": true, + "opacity": true, + "order": true, + "orphans": true, + "widows": true, + "zIndex": true, + "zoom": true + }, + + // Add in properties whose names you wish to fix before + // setting or getting the value + cssProps: {}, + + // Get and set the style property on a DOM Node + style: function( elem, name, value, extra ) { + + // Don't set styles on text and comment nodes + if ( !elem || elem.nodeType === 3 || elem.nodeType === 8 || !elem.style ) { + return; + } + + // Make sure that we're working with the right name + var ret, type, hooks, + origName = camelCase( name ), + isCustomProp = rcustomProp.test( name ), + style = elem.style; + + // Make sure that we're working with the right name. We don't + // want to query the value if it is a CSS custom property + // since they are user-defined. + if ( !isCustomProp ) { + name = finalPropName( origName ); + } + + // Gets hook for the prefixed version, then unprefixed version + hooks = jQuery.cssHooks[ name ] || jQuery.cssHooks[ origName ]; + + // Check if we're setting a value + if ( value !== undefined ) { + type = typeof value; + + // Convert "+=" or "-=" to relative numbers (#7345) + if ( type === "string" && ( ret = rcssNum.exec( value ) ) && ret[ 1 ] ) { + value = adjustCSS( elem, name, ret ); + + // Fixes bug #9237 + type = "number"; + } + + // Make sure that null and NaN values aren't set (#7116) + if ( value == null || value !== value ) { + return; + } + + // If a number was passed in, add the unit (except for certain CSS properties) + // The isCustomProp check can be removed in jQuery 4.0 when we only auto-append + // "px" to a few hardcoded values. + if ( type === "number" && !isCustomProp ) { + value += ret && ret[ 3 ] || ( jQuery.cssNumber[ origName ] ? "" : "px" ); + } + + // background-* props affect original clone's values + if ( !support.clearCloneStyle && value === "" && name.indexOf( "background" ) === 0 ) { + style[ name ] = "inherit"; + } + + // If a hook was provided, use that value, otherwise just set the specified value + if ( !hooks || !( "set" in hooks ) || + ( value = hooks.set( elem, value, extra ) ) !== undefined ) { + + if ( isCustomProp ) { + style.setProperty( name, value ); + } else { + style[ name ] = value; + } + } + + } else { + + // If a hook was provided get the non-computed value from there + if ( hooks && "get" in hooks && + ( ret = hooks.get( elem, false, extra ) ) !== undefined ) { + + return ret; + } + + // Otherwise just get the value from the style object + return style[ name ]; + } + }, + + css: function( elem, name, extra, styles ) { + var val, num, hooks, + origName = camelCase( name ), + isCustomProp = rcustomProp.test( name ); + + // Make sure that we're working with the right name. We don't + // want to modify the value if it is a CSS custom property + // since they are user-defined. + if ( !isCustomProp ) { + name = finalPropName( origName ); + } + + // Try prefixed name followed by the unprefixed name + hooks = jQuery.cssHooks[ name ] || jQuery.cssHooks[ origName ]; + + // If a hook was provided get the computed value from there + if ( hooks && "get" in hooks ) { + val = hooks.get( elem, true, extra ); + } + + // Otherwise, if a way to get the computed value exists, use that + if ( val === undefined ) { + val = curCSS( elem, name, styles ); + } + + // Convert "normal" to computed value + if ( val === "normal" && name in cssNormalTransform ) { + val = cssNormalTransform[ name ]; + } + + // Make numeric if forced or a qualifier was provided and val looks numeric + if ( extra === "" || extra ) { + num = parseFloat( val ); + return extra === true || isFinite( num ) ? num || 0 : val; + } + + return val; + } +} ); + +jQuery.each( [ "height", "width" ], function( _i, dimension ) { + jQuery.cssHooks[ dimension ] = { + get: function( elem, computed, extra ) { + if ( computed ) { + + // Certain elements can have dimension info if we invisibly show them + // but it must have a current display style that would benefit + return rdisplayswap.test( jQuery.css( elem, "display" ) ) && + + // Support: Safari 8+ + // Table columns in Safari have non-zero offsetWidth & zero + // getBoundingClientRect().width unless display is changed. + // Support: IE <=11 only + // Running getBoundingClientRect on a disconnected node + // in IE throws an error. + ( !elem.getClientRects().length || !elem.getBoundingClientRect().width ) ? + swap( elem, cssShow, function() { + return getWidthOrHeight( elem, dimension, extra ); + } ) : + getWidthOrHeight( elem, dimension, extra ); + } + }, + + set: function( elem, value, extra ) { + var matches, + styles = getStyles( elem ), + + // Only read styles.position if the test has a chance to fail + // to avoid forcing a reflow. + scrollboxSizeBuggy = !support.scrollboxSize() && + styles.position === "absolute", + + // To avoid forcing a reflow, only fetch boxSizing if we need it (gh-3991) + boxSizingNeeded = scrollboxSizeBuggy || extra, + isBorderBox = boxSizingNeeded && + jQuery.css( elem, "boxSizing", false, styles ) === "border-box", + subtract = extra ? + boxModelAdjustment( + elem, + dimension, + extra, + isBorderBox, + styles + ) : + 0; + + // Account for unreliable border-box dimensions by comparing offset* to computed and + // faking a content-box to get border and padding (gh-3699) + if ( isBorderBox && scrollboxSizeBuggy ) { + subtract -= Math.ceil( + elem[ "offset" + dimension[ 0 ].toUpperCase() + dimension.slice( 1 ) ] - + parseFloat( styles[ dimension ] ) - + boxModelAdjustment( elem, dimension, "border", false, styles ) - + 0.5 + ); + } + + // Convert to pixels if value adjustment is needed + if ( subtract && ( matches = rcssNum.exec( value ) ) && + ( matches[ 3 ] || "px" ) !== "px" ) { + + elem.style[ dimension ] = value; + value = jQuery.css( elem, dimension ); + } + + return setPositiveNumber( elem, value, subtract ); + } + }; +} ); + +jQuery.cssHooks.marginLeft = addGetHookIf( support.reliableMarginLeft, + function( elem, computed ) { + if ( computed ) { + return ( parseFloat( curCSS( elem, "marginLeft" ) ) || + elem.getBoundingClientRect().left - + swap( elem, { marginLeft: 0 }, function() { + return elem.getBoundingClientRect().left; + } ) + ) + "px"; + } + } +); + +// These hooks are used by animate to expand properties +jQuery.each( { + margin: "", + padding: "", + border: "Width" +}, function( prefix, suffix ) { + jQuery.cssHooks[ prefix + suffix ] = { + expand: function( value ) { + var i = 0, + expanded = {}, + + // Assumes a single number if not a string + parts = typeof value === "string" ? value.split( " " ) : [ value ]; + + for ( ; i < 4; i++ ) { + expanded[ prefix + cssExpand[ i ] + suffix ] = + parts[ i ] || parts[ i - 2 ] || parts[ 0 ]; + } + + return expanded; + } + }; + + if ( prefix !== "margin" ) { + jQuery.cssHooks[ prefix + suffix ].set = setPositiveNumber; + } +} ); + +jQuery.fn.extend( { + css: function( name, value ) { + return access( this, function( elem, name, value ) { + var styles, len, + map = {}, + i = 0; + + if ( Array.isArray( name ) ) { + styles = getStyles( elem ); + len = name.length; + + for ( ; i < len; i++ ) { + map[ name[ i ] ] = jQuery.css( elem, name[ i ], false, styles ); + } + + return map; + } + + return value !== undefined ? + jQuery.style( elem, name, value ) : + jQuery.css( elem, name ); + }, name, value, arguments.length > 1 ); + } +} ); + + +function Tween( elem, options, prop, end, easing ) { + return new Tween.prototype.init( elem, options, prop, end, easing ); +} +jQuery.Tween = Tween; + +Tween.prototype = { + constructor: Tween, + init: function( elem, options, prop, end, easing, unit ) { + this.elem = elem; + this.prop = prop; + this.easing = easing || jQuery.easing._default; + this.options = options; + this.start = this.now = this.cur(); + this.end = end; + this.unit = unit || ( jQuery.cssNumber[ prop ] ? "" : "px" ); + }, + cur: function() { + var hooks = Tween.propHooks[ this.prop ]; + + return hooks && hooks.get ? + hooks.get( this ) : + Tween.propHooks._default.get( this ); + }, + run: function( percent ) { + var eased, + hooks = Tween.propHooks[ this.prop ]; + + if ( this.options.duration ) { + this.pos = eased = jQuery.easing[ this.easing ]( + percent, this.options.duration * percent, 0, 1, this.options.duration + ); + } else { + this.pos = eased = percent; + } + this.now = ( this.end - this.start ) * eased + this.start; + + if ( this.options.step ) { + this.options.step.call( this.elem, this.now, this ); + } + + if ( hooks && hooks.set ) { + hooks.set( this ); + } else { + Tween.propHooks._default.set( this ); + } + return this; + } +}; + +Tween.prototype.init.prototype = Tween.prototype; + +Tween.propHooks = { + _default: { + get: function( tween ) { + var result; + + // Use a property on the element directly when it is not a DOM element, + // or when there is no matching style property that exists. + if ( tween.elem.nodeType !== 1 || + tween.elem[ tween.prop ] != null && tween.elem.style[ tween.prop ] == null ) { + return tween.elem[ tween.prop ]; + } + + // Passing an empty string as a 3rd parameter to .css will automatically + // attempt a parseFloat and fallback to a string if the parse fails. + // Simple values such as "10px" are parsed to Float; + // complex values such as "rotate(1rad)" are returned as-is. + result = jQuery.css( tween.elem, tween.prop, "" ); + + // Empty strings, null, undefined and "auto" are converted to 0. + return !result || result === "auto" ? 0 : result; + }, + set: function( tween ) { + + // Use step hook for back compat. + // Use cssHook if its there. + // Use .style if available and use plain properties where available. + if ( jQuery.fx.step[ tween.prop ] ) { + jQuery.fx.step[ tween.prop ]( tween ); + } else if ( tween.elem.nodeType === 1 && ( + jQuery.cssHooks[ tween.prop ] || + tween.elem.style[ finalPropName( tween.prop ) ] != null ) ) { + jQuery.style( tween.elem, tween.prop, tween.now + tween.unit ); + } else { + tween.elem[ tween.prop ] = tween.now; + } + } + } +}; + +// Support: IE <=9 only +// Panic based approach to setting things on disconnected nodes +Tween.propHooks.scrollTop = Tween.propHooks.scrollLeft = { + set: function( tween ) { + if ( tween.elem.nodeType && tween.elem.parentNode ) { + tween.elem[ tween.prop ] = tween.now; + } + } +}; + +jQuery.easing = { + linear: function( p ) { + return p; + }, + swing: function( p ) { + return 0.5 - Math.cos( p * Math.PI ) / 2; + }, + _default: "swing" +}; + +jQuery.fx = Tween.prototype.init; + +// Back compat <1.8 extension point +jQuery.fx.step = {}; + + + + +var + fxNow, inProgress, + rfxtypes = /^(?:toggle|show|hide)$/, + rrun = /queueHooks$/; + +function schedule() { + if ( inProgress ) { + if ( document.hidden === false && window.requestAnimationFrame ) { + window.requestAnimationFrame( schedule ); + } else { + window.setTimeout( schedule, jQuery.fx.interval ); + } + + jQuery.fx.tick(); + } +} + +// Animations created synchronously will run synchronously +function createFxNow() { + window.setTimeout( function() { + fxNow = undefined; + } ); + return ( fxNow = Date.now() ); +} + +// Generate parameters to create a standard animation +function genFx( type, includeWidth ) { + var which, + i = 0, + attrs = { height: type }; + + // If we include width, step value is 1 to do all cssExpand values, + // otherwise step value is 2 to skip over Left and Right + includeWidth = includeWidth ? 1 : 0; + for ( ; i < 4; i += 2 - includeWidth ) { + which = cssExpand[ i ]; + attrs[ "margin" + which ] = attrs[ "padding" + which ] = type; + } + + if ( includeWidth ) { + attrs.opacity = attrs.width = type; + } + + return attrs; +} + +function createTween( value, prop, animation ) { + var tween, + collection = ( Animation.tweeners[ prop ] || [] ).concat( Animation.tweeners[ "*" ] ), + index = 0, + length = collection.length; + for ( ; index < length; index++ ) { + if ( ( tween = collection[ index ].call( animation, prop, value ) ) ) { + + // We're done with this property + return tween; + } + } +} + +function defaultPrefilter( elem, props, opts ) { + var prop, value, toggle, hooks, oldfire, propTween, restoreDisplay, display, + isBox = "width" in props || "height" in props, + anim = this, + orig = {}, + style = elem.style, + hidden = elem.nodeType && isHiddenWithinTree( elem ), + dataShow = dataPriv.get( elem, "fxshow" ); + + // Queue-skipping animations hijack the fx hooks + if ( !opts.queue ) { + hooks = jQuery._queueHooks( elem, "fx" ); + if ( hooks.unqueued == null ) { + hooks.unqueued = 0; + oldfire = hooks.empty.fire; + hooks.empty.fire = function() { + if ( !hooks.unqueued ) { + oldfire(); + } + }; + } + hooks.unqueued++; + + anim.always( function() { + + // Ensure the complete handler is called before this completes + anim.always( function() { + hooks.unqueued--; + if ( !jQuery.queue( elem, "fx" ).length ) { + hooks.empty.fire(); + } + } ); + } ); + } + + // Detect show/hide animations + for ( prop in props ) { + value = props[ prop ]; + if ( rfxtypes.test( value ) ) { + delete props[ prop ]; + toggle = toggle || value === "toggle"; + if ( value === ( hidden ? "hide" : "show" ) ) { + + // Pretend to be hidden if this is a "show" and + // there is still data from a stopped show/hide + if ( value === "show" && dataShow && dataShow[ prop ] !== undefined ) { + hidden = true; + + // Ignore all other no-op show/hide data + } else { + continue; + } + } + orig[ prop ] = dataShow && dataShow[ prop ] || jQuery.style( elem, prop ); + } + } + + // Bail out if this is a no-op like .hide().hide() + propTween = !jQuery.isEmptyObject( props ); + if ( !propTween && jQuery.isEmptyObject( orig ) ) { + return; + } + + // Restrict "overflow" and "display" styles during box animations + if ( isBox && elem.nodeType === 1 ) { + + // Support: IE <=9 - 11, Edge 12 - 15 + // Record all 3 overflow attributes because IE does not infer the shorthand + // from identically-valued overflowX and overflowY and Edge just mirrors + // the overflowX value there. + opts.overflow = [ style.overflow, style.overflowX, style.overflowY ]; + + // Identify a display type, preferring old show/hide data over the CSS cascade + restoreDisplay = dataShow && dataShow.display; + if ( restoreDisplay == null ) { + restoreDisplay = dataPriv.get( elem, "display" ); + } + display = jQuery.css( elem, "display" ); + if ( display === "none" ) { + if ( restoreDisplay ) { + display = restoreDisplay; + } else { + + // Get nonempty value(s) by temporarily forcing visibility + showHide( [ elem ], true ); + restoreDisplay = elem.style.display || restoreDisplay; + display = jQuery.css( elem, "display" ); + showHide( [ elem ] ); + } + } + + // Animate inline elements as inline-block + if ( display === "inline" || display === "inline-block" && restoreDisplay != null ) { + if ( jQuery.css( elem, "float" ) === "none" ) { + + // Restore the original display value at the end of pure show/hide animations + if ( !propTween ) { + anim.done( function() { + style.display = restoreDisplay; + } ); + if ( restoreDisplay == null ) { + display = style.display; + restoreDisplay = display === "none" ? "" : display; + } + } + style.display = "inline-block"; + } + } + } + + if ( opts.overflow ) { + style.overflow = "hidden"; + anim.always( function() { + style.overflow = opts.overflow[ 0 ]; + style.overflowX = opts.overflow[ 1 ]; + style.overflowY = opts.overflow[ 2 ]; + } ); + } + + // Implement show/hide animations + propTween = false; + for ( prop in orig ) { + + // General show/hide setup for this element animation + if ( !propTween ) { + if ( dataShow ) { + if ( "hidden" in dataShow ) { + hidden = dataShow.hidden; + } + } else { + dataShow = dataPriv.access( elem, "fxshow", { display: restoreDisplay } ); + } + + // Store hidden/visible for toggle so `.stop().toggle()` "reverses" + if ( toggle ) { + dataShow.hidden = !hidden; + } + + // Show elements before animating them + if ( hidden ) { + showHide( [ elem ], true ); + } + + /* eslint-disable no-loop-func */ + + anim.done( function() { + + /* eslint-enable no-loop-func */ + + // The final step of a "hide" animation is actually hiding the element + if ( !hidden ) { + showHide( [ elem ] ); + } + dataPriv.remove( elem, "fxshow" ); + for ( prop in orig ) { + jQuery.style( elem, prop, orig[ prop ] ); + } + } ); + } + + // Per-property setup + propTween = createTween( hidden ? dataShow[ prop ] : 0, prop, anim ); + if ( !( prop in dataShow ) ) { + dataShow[ prop ] = propTween.start; + if ( hidden ) { + propTween.end = propTween.start; + propTween.start = 0; + } + } + } +} + +function propFilter( props, specialEasing ) { + var index, name, easing, value, hooks; + + // camelCase, specialEasing and expand cssHook pass + for ( index in props ) { + name = camelCase( index ); + easing = specialEasing[ name ]; + value = props[ index ]; + if ( Array.isArray( value ) ) { + easing = value[ 1 ]; + value = props[ index ] = value[ 0 ]; + } + + if ( index !== name ) { + props[ name ] = value; + delete props[ index ]; + } + + hooks = jQuery.cssHooks[ name ]; + if ( hooks && "expand" in hooks ) { + value = hooks.expand( value ); + delete props[ name ]; + + // Not quite $.extend, this won't overwrite existing keys. + // Reusing 'index' because we have the correct "name" + for ( index in value ) { + if ( !( index in props ) ) { + props[ index ] = value[ index ]; + specialEasing[ index ] = easing; + } + } + } else { + specialEasing[ name ] = easing; + } + } +} + +function Animation( elem, properties, options ) { + var result, + stopped, + index = 0, + length = Animation.prefilters.length, + deferred = jQuery.Deferred().always( function() { + + // Don't match elem in the :animated selector + delete tick.elem; + } ), + tick = function() { + if ( stopped ) { + return false; + } + var currentTime = fxNow || createFxNow(), + remaining = Math.max( 0, animation.startTime + animation.duration - currentTime ), + + // Support: Android 2.3 only + // Archaic crash bug won't allow us to use `1 - ( 0.5 || 0 )` (#12497) + temp = remaining / animation.duration || 0, + percent = 1 - temp, + index = 0, + length = animation.tweens.length; + + for ( ; index < length; index++ ) { + animation.tweens[ index ].run( percent ); + } + + deferred.notifyWith( elem, [ animation, percent, remaining ] ); + + // If there's more to do, yield + if ( percent < 1 && length ) { + return remaining; + } + + // If this was an empty animation, synthesize a final progress notification + if ( !length ) { + deferred.notifyWith( elem, [ animation, 1, 0 ] ); + } + + // Resolve the animation and report its conclusion + deferred.resolveWith( elem, [ animation ] ); + return false; + }, + animation = deferred.promise( { + elem: elem, + props: jQuery.extend( {}, properties ), + opts: jQuery.extend( true, { + specialEasing: {}, + easing: jQuery.easing._default + }, options ), + originalProperties: properties, + originalOptions: options, + startTime: fxNow || createFxNow(), + duration: options.duration, + tweens: [], + createTween: function( prop, end ) { + var tween = jQuery.Tween( elem, animation.opts, prop, end, + animation.opts.specialEasing[ prop ] || animation.opts.easing ); + animation.tweens.push( tween ); + return tween; + }, + stop: function( gotoEnd ) { + var index = 0, + + // If we are going to the end, we want to run all the tweens + // otherwise we skip this part + length = gotoEnd ? animation.tweens.length : 0; + if ( stopped ) { + return this; + } + stopped = true; + for ( ; index < length; index++ ) { + animation.tweens[ index ].run( 1 ); + } + + // Resolve when we played the last frame; otherwise, reject + if ( gotoEnd ) { + deferred.notifyWith( elem, [ animation, 1, 0 ] ); + deferred.resolveWith( elem, [ animation, gotoEnd ] ); + } else { + deferred.rejectWith( elem, [ animation, gotoEnd ] ); + } + return this; + } + } ), + props = animation.props; + + propFilter( props, animation.opts.specialEasing ); + + for ( ; index < length; index++ ) { + result = Animation.prefilters[ index ].call( animation, elem, props, animation.opts ); + if ( result ) { + if ( isFunction( result.stop ) ) { + jQuery._queueHooks( animation.elem, animation.opts.queue ).stop = + result.stop.bind( result ); + } + return result; + } + } + + jQuery.map( props, createTween, animation ); + + if ( isFunction( animation.opts.start ) ) { + animation.opts.start.call( elem, animation ); + } + + // Attach callbacks from options + animation + .progress( animation.opts.progress ) + .done( animation.opts.done, animation.opts.complete ) + .fail( animation.opts.fail ) + .always( animation.opts.always ); + + jQuery.fx.timer( + jQuery.extend( tick, { + elem: elem, + anim: animation, + queue: animation.opts.queue + } ) + ); + + return animation; +} + +jQuery.Animation = jQuery.extend( Animation, { + + tweeners: { + "*": [ function( prop, value ) { + var tween = this.createTween( prop, value ); + adjustCSS( tween.elem, prop, rcssNum.exec( value ), tween ); + return tween; + } ] + }, + + tweener: function( props, callback ) { + if ( isFunction( props ) ) { + callback = props; + props = [ "*" ]; + } else { + props = props.match( rnothtmlwhite ); + } + + var prop, + index = 0, + length = props.length; + + for ( ; index < length; index++ ) { + prop = props[ index ]; + Animation.tweeners[ prop ] = Animation.tweeners[ prop ] || []; + Animation.tweeners[ prop ].unshift( callback ); + } + }, + + prefilters: [ defaultPrefilter ], + + prefilter: function( callback, prepend ) { + if ( prepend ) { + Animation.prefilters.unshift( callback ); + } else { + Animation.prefilters.push( callback ); + } + } +} ); + +jQuery.speed = function( speed, easing, fn ) { + var opt = speed && typeof speed === "object" ? jQuery.extend( {}, speed ) : { + complete: fn || !fn && easing || + isFunction( speed ) && speed, + duration: speed, + easing: fn && easing || easing && !isFunction( easing ) && easing + }; + + // Go to the end state if fx are off + if ( jQuery.fx.off ) { + opt.duration = 0; + + } else { + if ( typeof opt.duration !== "number" ) { + if ( opt.duration in jQuery.fx.speeds ) { + opt.duration = jQuery.fx.speeds[ opt.duration ]; + + } else { + opt.duration = jQuery.fx.speeds._default; + } + } + } + + // Normalize opt.queue - true/undefined/null -> "fx" + if ( opt.queue == null || opt.queue === true ) { + opt.queue = "fx"; + } + + // Queueing + opt.old = opt.complete; + + opt.complete = function() { + if ( isFunction( opt.old ) ) { + opt.old.call( this ); + } + + if ( opt.queue ) { + jQuery.dequeue( this, opt.queue ); + } + }; + + return opt; +}; + +jQuery.fn.extend( { + fadeTo: function( speed, to, easing, callback ) { + + // Show any hidden elements after setting opacity to 0 + return this.filter( isHiddenWithinTree ).css( "opacity", 0 ).show() + + // Animate to the value specified + .end().animate( { opacity: to }, speed, easing, callback ); + }, + animate: function( prop, speed, easing, callback ) { + var empty = jQuery.isEmptyObject( prop ), + optall = jQuery.speed( speed, easing, callback ), + doAnimation = function() { + + // Operate on a copy of prop so per-property easing won't be lost + var anim = Animation( this, jQuery.extend( {}, prop ), optall ); + + // Empty animations, or finishing resolves immediately + if ( empty || dataPriv.get( this, "finish" ) ) { + anim.stop( true ); + } + }; + doAnimation.finish = doAnimation; + + return empty || optall.queue === false ? + this.each( doAnimation ) : + this.queue( optall.queue, doAnimation ); + }, + stop: function( type, clearQueue, gotoEnd ) { + var stopQueue = function( hooks ) { + var stop = hooks.stop; + delete hooks.stop; + stop( gotoEnd ); + }; + + if ( typeof type !== "string" ) { + gotoEnd = clearQueue; + clearQueue = type; + type = undefined; + } + if ( clearQueue ) { + this.queue( type || "fx", [] ); + } + + return this.each( function() { + var dequeue = true, + index = type != null && type + "queueHooks", + timers = jQuery.timers, + data = dataPriv.get( this ); + + if ( index ) { + if ( data[ index ] && data[ index ].stop ) { + stopQueue( data[ index ] ); + } + } else { + for ( index in data ) { + if ( data[ index ] && data[ index ].stop && rrun.test( index ) ) { + stopQueue( data[ index ] ); + } + } + } + + for ( index = timers.length; index--; ) { + if ( timers[ index ].elem === this && + ( type == null || timers[ index ].queue === type ) ) { + + timers[ index ].anim.stop( gotoEnd ); + dequeue = false; + timers.splice( index, 1 ); + } + } + + // Start the next in the queue if the last step wasn't forced. + // Timers currently will call their complete callbacks, which + // will dequeue but only if they were gotoEnd. + if ( dequeue || !gotoEnd ) { + jQuery.dequeue( this, type ); + } + } ); + }, + finish: function( type ) { + if ( type !== false ) { + type = type || "fx"; + } + return this.each( function() { + var index, + data = dataPriv.get( this ), + queue = data[ type + "queue" ], + hooks = data[ type + "queueHooks" ], + timers = jQuery.timers, + length = queue ? queue.length : 0; + + // Enable finishing flag on private data + data.finish = true; + + // Empty the queue first + jQuery.queue( this, type, [] ); + + if ( hooks && hooks.stop ) { + hooks.stop.call( this, true ); + } + + // Look for any active animations, and finish them + for ( index = timers.length; index--; ) { + if ( timers[ index ].elem === this && timers[ index ].queue === type ) { + timers[ index ].anim.stop( true ); + timers.splice( index, 1 ); + } + } + + // Look for any animations in the old queue and finish them + for ( index = 0; index < length; index++ ) { + if ( queue[ index ] && queue[ index ].finish ) { + queue[ index ].finish.call( this ); + } + } + + // Turn off finishing flag + delete data.finish; + } ); + } +} ); + +jQuery.each( [ "toggle", "show", "hide" ], function( _i, name ) { + var cssFn = jQuery.fn[ name ]; + jQuery.fn[ name ] = function( speed, easing, callback ) { + return speed == null || typeof speed === "boolean" ? + cssFn.apply( this, arguments ) : + this.animate( genFx( name, true ), speed, easing, callback ); + }; +} ); + +// Generate shortcuts for custom animations +jQuery.each( { + slideDown: genFx( "show" ), + slideUp: genFx( "hide" ), + slideToggle: genFx( "toggle" ), + fadeIn: { opacity: "show" }, + fadeOut: { opacity: "hide" }, + fadeToggle: { opacity: "toggle" } +}, function( name, props ) { + jQuery.fn[ name ] = function( speed, easing, callback ) { + return this.animate( props, speed, easing, callback ); + }; +} ); + +jQuery.timers = []; +jQuery.fx.tick = function() { + var timer, + i = 0, + timers = jQuery.timers; + + fxNow = Date.now(); + + for ( ; i < timers.length; i++ ) { + timer = timers[ i ]; + + // Run the timer and safely remove it when done (allowing for external removal) + if ( !timer() && timers[ i ] === timer ) { + timers.splice( i--, 1 ); + } + } + + if ( !timers.length ) { + jQuery.fx.stop(); + } + fxNow = undefined; +}; + +jQuery.fx.timer = function( timer ) { + jQuery.timers.push( timer ); + jQuery.fx.start(); +}; + +jQuery.fx.interval = 13; +jQuery.fx.start = function() { + if ( inProgress ) { + return; + } + + inProgress = true; + schedule(); +}; + +jQuery.fx.stop = function() { + inProgress = null; +}; + +jQuery.fx.speeds = { + slow: 600, + fast: 200, + + // Default speed + _default: 400 +}; + + +// Based off of the plugin by Clint Helfers, with permission. +// https://web.archive.org/web/20100324014747/http://blindsignals.com/index.php/2009/07/jquery-delay/ +jQuery.fn.delay = function( time, type ) { + time = jQuery.fx ? jQuery.fx.speeds[ time ] || time : time; + type = type || "fx"; + + return this.queue( type, function( next, hooks ) { + var timeout = window.setTimeout( next, time ); + hooks.stop = function() { + window.clearTimeout( timeout ); + }; + } ); +}; + + +( function() { + var input = document.createElement( "input" ), + select = document.createElement( "select" ), + opt = select.appendChild( document.createElement( "option" ) ); + + input.type = "checkbox"; + + // Support: Android <=4.3 only + // Default value for a checkbox should be "on" + support.checkOn = input.value !== ""; + + // Support: IE <=11 only + // Must access selectedIndex to make default options select + support.optSelected = opt.selected; + + // Support: IE <=11 only + // An input loses its value after becoming a radio + input = document.createElement( "input" ); + input.value = "t"; + input.type = "radio"; + support.radioValue = input.value === "t"; +} )(); + + +var boolHook, + attrHandle = jQuery.expr.attrHandle; + +jQuery.fn.extend( { + attr: function( name, value ) { + return access( this, jQuery.attr, name, value, arguments.length > 1 ); + }, + + removeAttr: function( name ) { + return this.each( function() { + jQuery.removeAttr( this, name ); + } ); + } +} ); + +jQuery.extend( { + attr: function( elem, name, value ) { + var ret, hooks, + nType = elem.nodeType; + + // Don't get/set attributes on text, comment and attribute nodes + if ( nType === 3 || nType === 8 || nType === 2 ) { + return; + } + + // Fallback to prop when attributes are not supported + if ( typeof elem.getAttribute === "undefined" ) { + return jQuery.prop( elem, name, value ); + } + + // Attribute hooks are determined by the lowercase version + // Grab necessary hook if one is defined + if ( nType !== 1 || !jQuery.isXMLDoc( elem ) ) { + hooks = jQuery.attrHooks[ name.toLowerCase() ] || + ( jQuery.expr.match.bool.test( name ) ? boolHook : undefined ); + } + + if ( value !== undefined ) { + if ( value === null ) { + jQuery.removeAttr( elem, name ); + return; + } + + if ( hooks && "set" in hooks && + ( ret = hooks.set( elem, value, name ) ) !== undefined ) { + return ret; + } + + elem.setAttribute( name, value + "" ); + return value; + } + + if ( hooks && "get" in hooks && ( ret = hooks.get( elem, name ) ) !== null ) { + return ret; + } + + ret = jQuery.find.attr( elem, name ); + + // Non-existent attributes return null, we normalize to undefined + return ret == null ? undefined : ret; + }, + + attrHooks: { + type: { + set: function( elem, value ) { + if ( !support.radioValue && value === "radio" && + nodeName( elem, "input" ) ) { + var val = elem.value; + elem.setAttribute( "type", value ); + if ( val ) { + elem.value = val; + } + return value; + } + } + } + }, + + removeAttr: function( elem, value ) { + var name, + i = 0, + + // Attribute names can contain non-HTML whitespace characters + // https://html.spec.whatwg.org/multipage/syntax.html#attributes-2 + attrNames = value && value.match( rnothtmlwhite ); + + if ( attrNames && elem.nodeType === 1 ) { + while ( ( name = attrNames[ i++ ] ) ) { + elem.removeAttribute( name ); + } + } + } +} ); + +// Hooks for boolean attributes +boolHook = { + set: function( elem, value, name ) { + if ( value === false ) { + + // Remove boolean attributes when set to false + jQuery.removeAttr( elem, name ); + } else { + elem.setAttribute( name, name ); + } + return name; + } +}; + +jQuery.each( jQuery.expr.match.bool.source.match( /\w+/g ), function( _i, name ) { + var getter = attrHandle[ name ] || jQuery.find.attr; + + attrHandle[ name ] = function( elem, name, isXML ) { + var ret, handle, + lowercaseName = name.toLowerCase(); + + if ( !isXML ) { + + // Avoid an infinite loop by temporarily removing this function from the getter + handle = attrHandle[ lowercaseName ]; + attrHandle[ lowercaseName ] = ret; + ret = getter( elem, name, isXML ) != null ? + lowercaseName : + null; + attrHandle[ lowercaseName ] = handle; + } + return ret; + }; +} ); + + + + +var rfocusable = /^(?:input|select|textarea|button)$/i, + rclickable = /^(?:a|area)$/i; + +jQuery.fn.extend( { + prop: function( name, value ) { + return access( this, jQuery.prop, name, value, arguments.length > 1 ); + }, + + removeProp: function( name ) { + return this.each( function() { + delete this[ jQuery.propFix[ name ] || name ]; + } ); + } +} ); + +jQuery.extend( { + prop: function( elem, name, value ) { + var ret, hooks, + nType = elem.nodeType; + + // Don't get/set properties on text, comment and attribute nodes + if ( nType === 3 || nType === 8 || nType === 2 ) { + return; + } + + if ( nType !== 1 || !jQuery.isXMLDoc( elem ) ) { + + // Fix name and attach hooks + name = jQuery.propFix[ name ] || name; + hooks = jQuery.propHooks[ name ]; + } + + if ( value !== undefined ) { + if ( hooks && "set" in hooks && + ( ret = hooks.set( elem, value, name ) ) !== undefined ) { + return ret; + } + + return ( elem[ name ] = value ); + } + + if ( hooks && "get" in hooks && ( ret = hooks.get( elem, name ) ) !== null ) { + return ret; + } + + return elem[ name ]; + }, + + propHooks: { + tabIndex: { + get: function( elem ) { + + // Support: IE <=9 - 11 only + // elem.tabIndex doesn't always return the + // correct value when it hasn't been explicitly set + // https://web.archive.org/web/20141116233347/http://fluidproject.org/blog/2008/01/09/getting-setting-and-removing-tabindex-values-with-javascript/ + // Use proper attribute retrieval(#12072) + var tabindex = jQuery.find.attr( elem, "tabindex" ); + + if ( tabindex ) { + return parseInt( tabindex, 10 ); + } + + if ( + rfocusable.test( elem.nodeName ) || + rclickable.test( elem.nodeName ) && + elem.href + ) { + return 0; + } + + return -1; + } + } + }, + + propFix: { + "for": "htmlFor", + "class": "className" + } +} ); + +// Support: IE <=11 only +// Accessing the selectedIndex property +// forces the browser to respect setting selected +// on the option +// The getter ensures a default option is selected +// when in an optgroup +// eslint rule "no-unused-expressions" is disabled for this code +// since it considers such accessions noop +if ( !support.optSelected ) { + jQuery.propHooks.selected = { + get: function( elem ) { + + /* eslint no-unused-expressions: "off" */ + + var parent = elem.parentNode; + if ( parent && parent.parentNode ) { + parent.parentNode.selectedIndex; + } + return null; + }, + set: function( elem ) { + + /* eslint no-unused-expressions: "off" */ + + var parent = elem.parentNode; + if ( parent ) { + parent.selectedIndex; + + if ( parent.parentNode ) { + parent.parentNode.selectedIndex; + } + } + } + }; +} + +jQuery.each( [ + "tabIndex", + "readOnly", + "maxLength", + "cellSpacing", + "cellPadding", + "rowSpan", + "colSpan", + "useMap", + "frameBorder", + "contentEditable" +], function() { + jQuery.propFix[ this.toLowerCase() ] = this; +} ); + + + + + // Strip and collapse whitespace according to HTML spec + // https://infra.spec.whatwg.org/#strip-and-collapse-ascii-whitespace + function stripAndCollapse( value ) { + var tokens = value.match( rnothtmlwhite ) || []; + return tokens.join( " " ); + } + + +function getClass( elem ) { + return elem.getAttribute && elem.getAttribute( "class" ) || ""; +} + +function classesToArray( value ) { + if ( Array.isArray( value ) ) { + return value; + } + if ( typeof value === "string" ) { + return value.match( rnothtmlwhite ) || []; + } + return []; +} + +jQuery.fn.extend( { + addClass: function( value ) { + var classes, elem, cur, curValue, clazz, j, finalValue, + i = 0; + + if ( isFunction( value ) ) { + return this.each( function( j ) { + jQuery( this ).addClass( value.call( this, j, getClass( this ) ) ); + } ); + } + + classes = classesToArray( value ); + + if ( classes.length ) { + while ( ( elem = this[ i++ ] ) ) { + curValue = getClass( elem ); + cur = elem.nodeType === 1 && ( " " + stripAndCollapse( curValue ) + " " ); + + if ( cur ) { + j = 0; + while ( ( clazz = classes[ j++ ] ) ) { + if ( cur.indexOf( " " + clazz + " " ) < 0 ) { + cur += clazz + " "; + } + } + + // Only assign if different to avoid unneeded rendering. + finalValue = stripAndCollapse( cur ); + if ( curValue !== finalValue ) { + elem.setAttribute( "class", finalValue ); + } + } + } + } + + return this; + }, + + removeClass: function( value ) { + var classes, elem, cur, curValue, clazz, j, finalValue, + i = 0; + + if ( isFunction( value ) ) { + return this.each( function( j ) { + jQuery( this ).removeClass( value.call( this, j, getClass( this ) ) ); + } ); + } + + if ( !arguments.length ) { + return this.attr( "class", "" ); + } + + classes = classesToArray( value ); + + if ( classes.length ) { + while ( ( elem = this[ i++ ] ) ) { + curValue = getClass( elem ); + + // This expression is here for better compressibility (see addClass) + cur = elem.nodeType === 1 && ( " " + stripAndCollapse( curValue ) + " " ); + + if ( cur ) { + j = 0; + while ( ( clazz = classes[ j++ ] ) ) { + + // Remove *all* instances + while ( cur.indexOf( " " + clazz + " " ) > -1 ) { + cur = cur.replace( " " + clazz + " ", " " ); + } + } + + // Only assign if different to avoid unneeded rendering. + finalValue = stripAndCollapse( cur ); + if ( curValue !== finalValue ) { + elem.setAttribute( "class", finalValue ); + } + } + } + } + + return this; + }, + + toggleClass: function( value, stateVal ) { + var type = typeof value, + isValidValue = type === "string" || Array.isArray( value ); + + if ( typeof stateVal === "boolean" && isValidValue ) { + return stateVal ? this.addClass( value ) : this.removeClass( value ); + } + + if ( isFunction( value ) ) { + return this.each( function( i ) { + jQuery( this ).toggleClass( + value.call( this, i, getClass( this ), stateVal ), + stateVal + ); + } ); + } + + return this.each( function() { + var className, i, self, classNames; + + if ( isValidValue ) { + + // Toggle individual class names + i = 0; + self = jQuery( this ); + classNames = classesToArray( value ); + + while ( ( className = classNames[ i++ ] ) ) { + + // Check each className given, space separated list + if ( self.hasClass( className ) ) { + self.removeClass( className ); + } else { + self.addClass( className ); + } + } + + // Toggle whole class name + } else if ( value === undefined || type === "boolean" ) { + className = getClass( this ); + if ( className ) { + + // Store className if set + dataPriv.set( this, "__className__", className ); + } + + // If the element has a class name or if we're passed `false`, + // then remove the whole classname (if there was one, the above saved it). + // Otherwise bring back whatever was previously saved (if anything), + // falling back to the empty string if nothing was stored. + if ( this.setAttribute ) { + this.setAttribute( "class", + className || value === false ? + "" : + dataPriv.get( this, "__className__" ) || "" + ); + } + } + } ); + }, + + hasClass: function( selector ) { + var className, elem, + i = 0; + + className = " " + selector + " "; + while ( ( elem = this[ i++ ] ) ) { + if ( elem.nodeType === 1 && + ( " " + stripAndCollapse( getClass( elem ) ) + " " ).indexOf( className ) > -1 ) { + return true; + } + } + + return false; + } +} ); + + + + +var rreturn = /\r/g; + +jQuery.fn.extend( { + val: function( value ) { + var hooks, ret, valueIsFunction, + elem = this[ 0 ]; + + if ( !arguments.length ) { + if ( elem ) { + hooks = jQuery.valHooks[ elem.type ] || + jQuery.valHooks[ elem.nodeName.toLowerCase() ]; + + if ( hooks && + "get" in hooks && + ( ret = hooks.get( elem, "value" ) ) !== undefined + ) { + return ret; + } + + ret = elem.value; + + // Handle most common string cases + if ( typeof ret === "string" ) { + return ret.replace( rreturn, "" ); + } + + // Handle cases where value is null/undef or number + return ret == null ? "" : ret; + } + + return; + } + + valueIsFunction = isFunction( value ); + + return this.each( function( i ) { + var val; + + if ( this.nodeType !== 1 ) { + return; + } + + if ( valueIsFunction ) { + val = value.call( this, i, jQuery( this ).val() ); + } else { + val = value; + } + + // Treat null/undefined as ""; convert numbers to string + if ( val == null ) { + val = ""; + + } else if ( typeof val === "number" ) { + val += ""; + + } else if ( Array.isArray( val ) ) { + val = jQuery.map( val, function( value ) { + return value == null ? "" : value + ""; + } ); + } + + hooks = jQuery.valHooks[ this.type ] || jQuery.valHooks[ this.nodeName.toLowerCase() ]; + + // If set returns undefined, fall back to normal setting + if ( !hooks || !( "set" in hooks ) || hooks.set( this, val, "value" ) === undefined ) { + this.value = val; + } + } ); + } +} ); + +jQuery.extend( { + valHooks: { + option: { + get: function( elem ) { + + var val = jQuery.find.attr( elem, "value" ); + return val != null ? + val : + + // Support: IE <=10 - 11 only + // option.text throws exceptions (#14686, #14858) + // Strip and collapse whitespace + // https://html.spec.whatwg.org/#strip-and-collapse-whitespace + stripAndCollapse( jQuery.text( elem ) ); + } + }, + select: { + get: function( elem ) { + var value, option, i, + options = elem.options, + index = elem.selectedIndex, + one = elem.type === "select-one", + values = one ? null : [], + max = one ? index + 1 : options.length; + + if ( index < 0 ) { + i = max; + + } else { + i = one ? index : 0; + } + + // Loop through all the selected options + for ( ; i < max; i++ ) { + option = options[ i ]; + + // Support: IE <=9 only + // IE8-9 doesn't update selected after form reset (#2551) + if ( ( option.selected || i === index ) && + + // Don't return options that are disabled or in a disabled optgroup + !option.disabled && + ( !option.parentNode.disabled || + !nodeName( option.parentNode, "optgroup" ) ) ) { + + // Get the specific value for the option + value = jQuery( option ).val(); + + // We don't need an array for one selects + if ( one ) { + return value; + } + + // Multi-Selects return an array + values.push( value ); + } + } + + return values; + }, + + set: function( elem, value ) { + var optionSet, option, + options = elem.options, + values = jQuery.makeArray( value ), + i = options.length; + + while ( i-- ) { + option = options[ i ]; + + /* eslint-disable no-cond-assign */ + + if ( option.selected = + jQuery.inArray( jQuery.valHooks.option.get( option ), values ) > -1 + ) { + optionSet = true; + } + + /* eslint-enable no-cond-assign */ + } + + // Force browsers to behave consistently when non-matching value is set + if ( !optionSet ) { + elem.selectedIndex = -1; + } + return values; + } + } + } +} ); + +// Radios and checkboxes getter/setter +jQuery.each( [ "radio", "checkbox" ], function() { + jQuery.valHooks[ this ] = { + set: function( elem, value ) { + if ( Array.isArray( value ) ) { + return ( elem.checked = jQuery.inArray( jQuery( elem ).val(), value ) > -1 ); + } + } + }; + if ( !support.checkOn ) { + jQuery.valHooks[ this ].get = function( elem ) { + return elem.getAttribute( "value" ) === null ? "on" : elem.value; + }; + } +} ); + + + + +// Return jQuery for attributes-only inclusion + + +support.focusin = "onfocusin" in window; + + +var rfocusMorph = /^(?:focusinfocus|focusoutblur)$/, + stopPropagationCallback = function( e ) { + e.stopPropagation(); + }; + +jQuery.extend( jQuery.event, { + + trigger: function( event, data, elem, onlyHandlers ) { + + var i, cur, tmp, bubbleType, ontype, handle, special, lastElement, + eventPath = [ elem || document ], + type = hasOwn.call( event, "type" ) ? event.type : event, + namespaces = hasOwn.call( event, "namespace" ) ? event.namespace.split( "." ) : []; + + cur = lastElement = tmp = elem = elem || document; + + // Don't do events on text and comment nodes + if ( elem.nodeType === 3 || elem.nodeType === 8 ) { + return; + } + + // focus/blur morphs to focusin/out; ensure we're not firing them right now + if ( rfocusMorph.test( type + jQuery.event.triggered ) ) { + return; + } + + if ( type.indexOf( "." ) > -1 ) { + + // Namespaced trigger; create a regexp to match event type in handle() + namespaces = type.split( "." ); + type = namespaces.shift(); + namespaces.sort(); + } + ontype = type.indexOf( ":" ) < 0 && "on" + type; + + // Caller can pass in a jQuery.Event object, Object, or just an event type string + event = event[ jQuery.expando ] ? + event : + new jQuery.Event( type, typeof event === "object" && event ); + + // Trigger bitmask: & 1 for native handlers; & 2 for jQuery (always true) + event.isTrigger = onlyHandlers ? 2 : 3; + event.namespace = namespaces.join( "." ); + event.rnamespace = event.namespace ? + new RegExp( "(^|\\.)" + namespaces.join( "\\.(?:.*\\.|)" ) + "(\\.|$)" ) : + null; + + // Clean up the event in case it is being reused + event.result = undefined; + if ( !event.target ) { + event.target = elem; + } + + // Clone any incoming data and prepend the event, creating the handler arg list + data = data == null ? + [ event ] : + jQuery.makeArray( data, [ event ] ); + + // Allow special events to draw outside the lines + special = jQuery.event.special[ type ] || {}; + if ( !onlyHandlers && special.trigger && special.trigger.apply( elem, data ) === false ) { + return; + } + + // Determine event propagation path in advance, per W3C events spec (#9951) + // Bubble up to document, then to window; watch for a global ownerDocument var (#9724) + if ( !onlyHandlers && !special.noBubble && !isWindow( elem ) ) { + + bubbleType = special.delegateType || type; + if ( !rfocusMorph.test( bubbleType + type ) ) { + cur = cur.parentNode; + } + for ( ; cur; cur = cur.parentNode ) { + eventPath.push( cur ); + tmp = cur; + } + + // Only add window if we got to document (e.g., not plain obj or detached DOM) + if ( tmp === ( elem.ownerDocument || document ) ) { + eventPath.push( tmp.defaultView || tmp.parentWindow || window ); + } + } + + // Fire handlers on the event path + i = 0; + while ( ( cur = eventPath[ i++ ] ) && !event.isPropagationStopped() ) { + lastElement = cur; + event.type = i > 1 ? + bubbleType : + special.bindType || type; + + // jQuery handler + handle = ( + dataPriv.get( cur, "events" ) || Object.create( null ) + )[ event.type ] && + dataPriv.get( cur, "handle" ); + if ( handle ) { + handle.apply( cur, data ); + } + + // Native handler + handle = ontype && cur[ ontype ]; + if ( handle && handle.apply && acceptData( cur ) ) { + event.result = handle.apply( cur, data ); + if ( event.result === false ) { + event.preventDefault(); + } + } + } + event.type = type; + + // If nobody prevented the default action, do it now + if ( !onlyHandlers && !event.isDefaultPrevented() ) { + + if ( ( !special._default || + special._default.apply( eventPath.pop(), data ) === false ) && + acceptData( elem ) ) { + + // Call a native DOM method on the target with the same name as the event. + // Don't do default actions on window, that's where global variables be (#6170) + if ( ontype && isFunction( elem[ type ] ) && !isWindow( elem ) ) { + + // Don't re-trigger an onFOO event when we call its FOO() method + tmp = elem[ ontype ]; + + if ( tmp ) { + elem[ ontype ] = null; + } + + // Prevent re-triggering of the same event, since we already bubbled it above + jQuery.event.triggered = type; + + if ( event.isPropagationStopped() ) { + lastElement.addEventListener( type, stopPropagationCallback ); + } + + elem[ type ](); + + if ( event.isPropagationStopped() ) { + lastElement.removeEventListener( type, stopPropagationCallback ); + } + + jQuery.event.triggered = undefined; + + if ( tmp ) { + elem[ ontype ] = tmp; + } + } + } + } + + return event.result; + }, + + // Piggyback on a donor event to simulate a different one + // Used only for `focus(in | out)` events + simulate: function( type, elem, event ) { + var e = jQuery.extend( + new jQuery.Event(), + event, + { + type: type, + isSimulated: true + } + ); + + jQuery.event.trigger( e, null, elem ); + } + +} ); + +jQuery.fn.extend( { + + trigger: function( type, data ) { + return this.each( function() { + jQuery.event.trigger( type, data, this ); + } ); + }, + triggerHandler: function( type, data ) { + var elem = this[ 0 ]; + if ( elem ) { + return jQuery.event.trigger( type, data, elem, true ); + } + } +} ); + + +// Support: Firefox <=44 +// Firefox doesn't have focus(in | out) events +// Related ticket - https://bugzilla.mozilla.org/show_bug.cgi?id=687787 +// +// Support: Chrome <=48 - 49, Safari <=9.0 - 9.1 +// focus(in | out) events fire after focus & blur events, +// which is spec violation - http://www.w3.org/TR/DOM-Level-3-Events/#events-focusevent-event-order +// Related ticket - https://bugs.chromium.org/p/chromium/issues/detail?id=449857 +if ( !support.focusin ) { + jQuery.each( { focus: "focusin", blur: "focusout" }, function( orig, fix ) { + + // Attach a single capturing handler on the document while someone wants focusin/focusout + var handler = function( event ) { + jQuery.event.simulate( fix, event.target, jQuery.event.fix( event ) ); + }; + + jQuery.event.special[ fix ] = { + setup: function() { + + // Handle: regular nodes (via `this.ownerDocument`), window + // (via `this.document`) & document (via `this`). + var doc = this.ownerDocument || this.document || this, + attaches = dataPriv.access( doc, fix ); + + if ( !attaches ) { + doc.addEventListener( orig, handler, true ); + } + dataPriv.access( doc, fix, ( attaches || 0 ) + 1 ); + }, + teardown: function() { + var doc = this.ownerDocument || this.document || this, + attaches = dataPriv.access( doc, fix ) - 1; + + if ( !attaches ) { + doc.removeEventListener( orig, handler, true ); + dataPriv.remove( doc, fix ); + + } else { + dataPriv.access( doc, fix, attaches ); + } + } + }; + } ); +} +var location = window.location; + +var nonce = { guid: Date.now() }; + +var rquery = ( /\?/ ); + + + +// Cross-browser xml parsing +jQuery.parseXML = function( data ) { + var xml; + if ( !data || typeof data !== "string" ) { + return null; + } + + // Support: IE 9 - 11 only + // IE throws on parseFromString with invalid input. + try { + xml = ( new window.DOMParser() ).parseFromString( data, "text/xml" ); + } catch ( e ) { + xml = undefined; + } + + if ( !xml || xml.getElementsByTagName( "parsererror" ).length ) { + jQuery.error( "Invalid XML: " + data ); + } + return xml; +}; + + +var + rbracket = /\[\]$/, + rCRLF = /\r?\n/g, + rsubmitterTypes = /^(?:submit|button|image|reset|file)$/i, + rsubmittable = /^(?:input|select|textarea|keygen)/i; + +function buildParams( prefix, obj, traditional, add ) { + var name; + + if ( Array.isArray( obj ) ) { + + // Serialize array item. + jQuery.each( obj, function( i, v ) { + if ( traditional || rbracket.test( prefix ) ) { + + // Treat each array item as a scalar. + add( prefix, v ); + + } else { + + // Item is non-scalar (array or object), encode its numeric index. + buildParams( + prefix + "[" + ( typeof v === "object" && v != null ? i : "" ) + "]", + v, + traditional, + add + ); + } + } ); + + } else if ( !traditional && toType( obj ) === "object" ) { + + // Serialize object item. + for ( name in obj ) { + buildParams( prefix + "[" + name + "]", obj[ name ], traditional, add ); + } + + } else { + + // Serialize scalar item. + add( prefix, obj ); + } +} + +// Serialize an array of form elements or a set of +// key/values into a query string +jQuery.param = function( a, traditional ) { + var prefix, + s = [], + add = function( key, valueOrFunction ) { + + // If value is a function, invoke it and use its return value + var value = isFunction( valueOrFunction ) ? + valueOrFunction() : + valueOrFunction; + + s[ s.length ] = encodeURIComponent( key ) + "=" + + encodeURIComponent( value == null ? "" : value ); + }; + + if ( a == null ) { + return ""; + } + + // If an array was passed in, assume that it is an array of form elements. + if ( Array.isArray( a ) || ( a.jquery && !jQuery.isPlainObject( a ) ) ) { + + // Serialize the form elements + jQuery.each( a, function() { + add( this.name, this.value ); + } ); + + } else { + + // If traditional, encode the "old" way (the way 1.3.2 or older + // did it), otherwise encode params recursively. + for ( prefix in a ) { + buildParams( prefix, a[ prefix ], traditional, add ); + } + } + + // Return the resulting serialization + return s.join( "&" ); +}; + +jQuery.fn.extend( { + serialize: function() { + return jQuery.param( this.serializeArray() ); + }, + serializeArray: function() { + return this.map( function() { + + // Can add propHook for "elements" to filter or add form elements + var elements = jQuery.prop( this, "elements" ); + return elements ? jQuery.makeArray( elements ) : this; + } ) + .filter( function() { + var type = this.type; + + // Use .is( ":disabled" ) so that fieldset[disabled] works + return this.name && !jQuery( this ).is( ":disabled" ) && + rsubmittable.test( this.nodeName ) && !rsubmitterTypes.test( type ) && + ( this.checked || !rcheckableType.test( type ) ); + } ) + .map( function( _i, elem ) { + var val = jQuery( this ).val(); + + if ( val == null ) { + return null; + } + + if ( Array.isArray( val ) ) { + return jQuery.map( val, function( val ) { + return { name: elem.name, value: val.replace( rCRLF, "\r\n" ) }; + } ); + } + + return { name: elem.name, value: val.replace( rCRLF, "\r\n" ) }; + } ).get(); + } +} ); + + +var + r20 = /%20/g, + rhash = /#.*$/, + rantiCache = /([?&])_=[^&]*/, + rheaders = /^(.*?):[ \t]*([^\r\n]*)$/mg, + + // #7653, #8125, #8152: local protocol detection + rlocalProtocol = /^(?:about|app|app-storage|.+-extension|file|res|widget):$/, + rnoContent = /^(?:GET|HEAD)$/, + rprotocol = /^\/\//, + + /* Prefilters + * 1) They are useful to introduce custom dataTypes (see ajax/jsonp.js for an example) + * 2) These are called: + * - BEFORE asking for a transport + * - AFTER param serialization (s.data is a string if s.processData is true) + * 3) key is the dataType + * 4) the catchall symbol "*" can be used + * 5) execution will start with transport dataType and THEN continue down to "*" if needed + */ + prefilters = {}, + + /* Transports bindings + * 1) key is the dataType + * 2) the catchall symbol "*" can be used + * 3) selection will start with transport dataType and THEN go to "*" if needed + */ + transports = {}, + + // Avoid comment-prolog char sequence (#10098); must appease lint and evade compression + allTypes = "*/".concat( "*" ), + + // Anchor tag for parsing the document origin + originAnchor = document.createElement( "a" ); + originAnchor.href = location.href; + +// Base "constructor" for jQuery.ajaxPrefilter and jQuery.ajaxTransport +function addToPrefiltersOrTransports( structure ) { + + // dataTypeExpression is optional and defaults to "*" + return function( dataTypeExpression, func ) { + + if ( typeof dataTypeExpression !== "string" ) { + func = dataTypeExpression; + dataTypeExpression = "*"; + } + + var dataType, + i = 0, + dataTypes = dataTypeExpression.toLowerCase().match( rnothtmlwhite ) || []; + + if ( isFunction( func ) ) { + + // For each dataType in the dataTypeExpression + while ( ( dataType = dataTypes[ i++ ] ) ) { + + // Prepend if requested + if ( dataType[ 0 ] === "+" ) { + dataType = dataType.slice( 1 ) || "*"; + ( structure[ dataType ] = structure[ dataType ] || [] ).unshift( func ); + + // Otherwise append + } else { + ( structure[ dataType ] = structure[ dataType ] || [] ).push( func ); + } + } + } + }; +} + +// Base inspection function for prefilters and transports +function inspectPrefiltersOrTransports( structure, options, originalOptions, jqXHR ) { + + var inspected = {}, + seekingTransport = ( structure === transports ); + + function inspect( dataType ) { + var selected; + inspected[ dataType ] = true; + jQuery.each( structure[ dataType ] || [], function( _, prefilterOrFactory ) { + var dataTypeOrTransport = prefilterOrFactory( options, originalOptions, jqXHR ); + if ( typeof dataTypeOrTransport === "string" && + !seekingTransport && !inspected[ dataTypeOrTransport ] ) { + + options.dataTypes.unshift( dataTypeOrTransport ); + inspect( dataTypeOrTransport ); + return false; + } else if ( seekingTransport ) { + return !( selected = dataTypeOrTransport ); + } + } ); + return selected; + } + + return inspect( options.dataTypes[ 0 ] ) || !inspected[ "*" ] && inspect( "*" ); +} + +// A special extend for ajax options +// that takes "flat" options (not to be deep extended) +// Fixes #9887 +function ajaxExtend( target, src ) { + var key, deep, + flatOptions = jQuery.ajaxSettings.flatOptions || {}; + + for ( key in src ) { + if ( src[ key ] !== undefined ) { + ( flatOptions[ key ] ? target : ( deep || ( deep = {} ) ) )[ key ] = src[ key ]; + } + } + if ( deep ) { + jQuery.extend( true, target, deep ); + } + + return target; +} + +/* Handles responses to an ajax request: + * - finds the right dataType (mediates between content-type and expected dataType) + * - returns the corresponding response + */ +function ajaxHandleResponses( s, jqXHR, responses ) { + + var ct, type, finalDataType, firstDataType, + contents = s.contents, + dataTypes = s.dataTypes; + + // Remove auto dataType and get content-type in the process + while ( dataTypes[ 0 ] === "*" ) { + dataTypes.shift(); + if ( ct === undefined ) { + ct = s.mimeType || jqXHR.getResponseHeader( "Content-Type" ); + } + } + + // Check if we're dealing with a known content-type + if ( ct ) { + for ( type in contents ) { + if ( contents[ type ] && contents[ type ].test( ct ) ) { + dataTypes.unshift( type ); + break; + } + } + } + + // Check to see if we have a response for the expected dataType + if ( dataTypes[ 0 ] in responses ) { + finalDataType = dataTypes[ 0 ]; + } else { + + // Try convertible dataTypes + for ( type in responses ) { + if ( !dataTypes[ 0 ] || s.converters[ type + " " + dataTypes[ 0 ] ] ) { + finalDataType = type; + break; + } + if ( !firstDataType ) { + firstDataType = type; + } + } + + // Or just use first one + finalDataType = finalDataType || firstDataType; + } + + // If we found a dataType + // We add the dataType to the list if needed + // and return the corresponding response + if ( finalDataType ) { + if ( finalDataType !== dataTypes[ 0 ] ) { + dataTypes.unshift( finalDataType ); + } + return responses[ finalDataType ]; + } +} + +/* Chain conversions given the request and the original response + * Also sets the responseXXX fields on the jqXHR instance + */ +function ajaxConvert( s, response, jqXHR, isSuccess ) { + var conv2, current, conv, tmp, prev, + converters = {}, + + // Work with a copy of dataTypes in case we need to modify it for conversion + dataTypes = s.dataTypes.slice(); + + // Create converters map with lowercased keys + if ( dataTypes[ 1 ] ) { + for ( conv in s.converters ) { + converters[ conv.toLowerCase() ] = s.converters[ conv ]; + } + } + + current = dataTypes.shift(); + + // Convert to each sequential dataType + while ( current ) { + + if ( s.responseFields[ current ] ) { + jqXHR[ s.responseFields[ current ] ] = response; + } + + // Apply the dataFilter if provided + if ( !prev && isSuccess && s.dataFilter ) { + response = s.dataFilter( response, s.dataType ); + } + + prev = current; + current = dataTypes.shift(); + + if ( current ) { + + // There's only work to do if current dataType is non-auto + if ( current === "*" ) { + + current = prev; + + // Convert response if prev dataType is non-auto and differs from current + } else if ( prev !== "*" && prev !== current ) { + + // Seek a direct converter + conv = converters[ prev + " " + current ] || converters[ "* " + current ]; + + // If none found, seek a pair + if ( !conv ) { + for ( conv2 in converters ) { + + // If conv2 outputs current + tmp = conv2.split( " " ); + if ( tmp[ 1 ] === current ) { + + // If prev can be converted to accepted input + conv = converters[ prev + " " + tmp[ 0 ] ] || + converters[ "* " + tmp[ 0 ] ]; + if ( conv ) { + + // Condense equivalence converters + if ( conv === true ) { + conv = converters[ conv2 ]; + + // Otherwise, insert the intermediate dataType + } else if ( converters[ conv2 ] !== true ) { + current = tmp[ 0 ]; + dataTypes.unshift( tmp[ 1 ] ); + } + break; + } + } + } + } + + // Apply converter (if not an equivalence) + if ( conv !== true ) { + + // Unless errors are allowed to bubble, catch and return them + if ( conv && s.throws ) { + response = conv( response ); + } else { + try { + response = conv( response ); + } catch ( e ) { + return { + state: "parsererror", + error: conv ? e : "No conversion from " + prev + " to " + current + }; + } + } + } + } + } + } + + return { state: "success", data: response }; +} + +jQuery.extend( { + + // Counter for holding the number of active queries + active: 0, + + // Last-Modified header cache for next request + lastModified: {}, + etag: {}, + + ajaxSettings: { + url: location.href, + type: "GET", + isLocal: rlocalProtocol.test( location.protocol ), + global: true, + processData: true, + async: true, + contentType: "application/x-www-form-urlencoded; charset=UTF-8", + + /* + timeout: 0, + data: null, + dataType: null, + username: null, + password: null, + cache: null, + throws: false, + traditional: false, + headers: {}, + */ + + accepts: { + "*": allTypes, + text: "text/plain", + html: "text/html", + xml: "application/xml, text/xml", + json: "application/json, text/javascript" + }, + + contents: { + xml: /\bxml\b/, + html: /\bhtml/, + json: /\bjson\b/ + }, + + responseFields: { + xml: "responseXML", + text: "responseText", + json: "responseJSON" + }, + + // Data converters + // Keys separate source (or catchall "*") and destination types with a single space + converters: { + + // Convert anything to text + "* text": String, + + // Text to html (true = no transformation) + "text html": true, + + // Evaluate text as a json expression + "text json": JSON.parse, + + // Parse text as xml + "text xml": jQuery.parseXML + }, + + // For options that shouldn't be deep extended: + // you can add your own custom options here if + // and when you create one that shouldn't be + // deep extended (see ajaxExtend) + flatOptions: { + url: true, + context: true + } + }, + + // Creates a full fledged settings object into target + // with both ajaxSettings and settings fields. + // If target is omitted, writes into ajaxSettings. + ajaxSetup: function( target, settings ) { + return settings ? + + // Building a settings object + ajaxExtend( ajaxExtend( target, jQuery.ajaxSettings ), settings ) : + + // Extending ajaxSettings + ajaxExtend( jQuery.ajaxSettings, target ); + }, + + ajaxPrefilter: addToPrefiltersOrTransports( prefilters ), + ajaxTransport: addToPrefiltersOrTransports( transports ), + + // Main method + ajax: function( url, options ) { + + // If url is an object, simulate pre-1.5 signature + if ( typeof url === "object" ) { + options = url; + url = undefined; + } + + // Force options to be an object + options = options || {}; + + var transport, + + // URL without anti-cache param + cacheURL, + + // Response headers + responseHeadersString, + responseHeaders, + + // timeout handle + timeoutTimer, + + // Url cleanup var + urlAnchor, + + // Request state (becomes false upon send and true upon completion) + completed, + + // To know if global events are to be dispatched + fireGlobals, + + // Loop variable + i, + + // uncached part of the url + uncached, + + // Create the final options object + s = jQuery.ajaxSetup( {}, options ), + + // Callbacks context + callbackContext = s.context || s, + + // Context for global events is callbackContext if it is a DOM node or jQuery collection + globalEventContext = s.context && + ( callbackContext.nodeType || callbackContext.jquery ) ? + jQuery( callbackContext ) : + jQuery.event, + + // Deferreds + deferred = jQuery.Deferred(), + completeDeferred = jQuery.Callbacks( "once memory" ), + + // Status-dependent callbacks + statusCode = s.statusCode || {}, + + // Headers (they are sent all at once) + requestHeaders = {}, + requestHeadersNames = {}, + + // Default abort message + strAbort = "canceled", + + // Fake xhr + jqXHR = { + readyState: 0, + + // Builds headers hashtable if needed + getResponseHeader: function( key ) { + var match; + if ( completed ) { + if ( !responseHeaders ) { + responseHeaders = {}; + while ( ( match = rheaders.exec( responseHeadersString ) ) ) { + responseHeaders[ match[ 1 ].toLowerCase() + " " ] = + ( responseHeaders[ match[ 1 ].toLowerCase() + " " ] || [] ) + .concat( match[ 2 ] ); + } + } + match = responseHeaders[ key.toLowerCase() + " " ]; + } + return match == null ? null : match.join( ", " ); + }, + + // Raw string + getAllResponseHeaders: function() { + return completed ? responseHeadersString : null; + }, + + // Caches the header + setRequestHeader: function( name, value ) { + if ( completed == null ) { + name = requestHeadersNames[ name.toLowerCase() ] = + requestHeadersNames[ name.toLowerCase() ] || name; + requestHeaders[ name ] = value; + } + return this; + }, + + // Overrides response content-type header + overrideMimeType: function( type ) { + if ( completed == null ) { + s.mimeType = type; + } + return this; + }, + + // Status-dependent callbacks + statusCode: function( map ) { + var code; + if ( map ) { + if ( completed ) { + + // Execute the appropriate callbacks + jqXHR.always( map[ jqXHR.status ] ); + } else { + + // Lazy-add the new callbacks in a way that preserves old ones + for ( code in map ) { + statusCode[ code ] = [ statusCode[ code ], map[ code ] ]; + } + } + } + return this; + }, + + // Cancel the request + abort: function( statusText ) { + var finalText = statusText || strAbort; + if ( transport ) { + transport.abort( finalText ); + } + done( 0, finalText ); + return this; + } + }; + + // Attach deferreds + deferred.promise( jqXHR ); + + // Add protocol if not provided (prefilters might expect it) + // Handle falsy url in the settings object (#10093: consistency with old signature) + // We also use the url parameter if available + s.url = ( ( url || s.url || location.href ) + "" ) + .replace( rprotocol, location.protocol + "//" ); + + // Alias method option to type as per ticket #12004 + s.type = options.method || options.type || s.method || s.type; + + // Extract dataTypes list + s.dataTypes = ( s.dataType || "*" ).toLowerCase().match( rnothtmlwhite ) || [ "" ]; + + // A cross-domain request is in order when the origin doesn't match the current origin. + if ( s.crossDomain == null ) { + urlAnchor = document.createElement( "a" ); + + // Support: IE <=8 - 11, Edge 12 - 15 + // IE throws exception on accessing the href property if url is malformed, + // e.g. http://example.com:80x/ + try { + urlAnchor.href = s.url; + + // Support: IE <=8 - 11 only + // Anchor's host property isn't correctly set when s.url is relative + urlAnchor.href = urlAnchor.href; + s.crossDomain = originAnchor.protocol + "//" + originAnchor.host !== + urlAnchor.protocol + "//" + urlAnchor.host; + } catch ( e ) { + + // If there is an error parsing the URL, assume it is crossDomain, + // it can be rejected by the transport if it is invalid + s.crossDomain = true; + } + } + + // Convert data if not already a string + if ( s.data && s.processData && typeof s.data !== "string" ) { + s.data = jQuery.param( s.data, s.traditional ); + } + + // Apply prefilters + inspectPrefiltersOrTransports( prefilters, s, options, jqXHR ); + + // If request was aborted inside a prefilter, stop there + if ( completed ) { + return jqXHR; + } + + // We can fire global events as of now if asked to + // Don't fire events if jQuery.event is undefined in an AMD-usage scenario (#15118) + fireGlobals = jQuery.event && s.global; + + // Watch for a new set of requests + if ( fireGlobals && jQuery.active++ === 0 ) { + jQuery.event.trigger( "ajaxStart" ); + } + + // Uppercase the type + s.type = s.type.toUpperCase(); + + // Determine if request has content + s.hasContent = !rnoContent.test( s.type ); + + // Save the URL in case we're toying with the If-Modified-Since + // and/or If-None-Match header later on + // Remove hash to simplify url manipulation + cacheURL = s.url.replace( rhash, "" ); + + // More options handling for requests with no content + if ( !s.hasContent ) { + + // Remember the hash so we can put it back + uncached = s.url.slice( cacheURL.length ); + + // If data is available and should be processed, append data to url + if ( s.data && ( s.processData || typeof s.data === "string" ) ) { + cacheURL += ( rquery.test( cacheURL ) ? "&" : "?" ) + s.data; + + // #9682: remove data so that it's not used in an eventual retry + delete s.data; + } + + // Add or update anti-cache param if needed + if ( s.cache === false ) { + cacheURL = cacheURL.replace( rantiCache, "$1" ); + uncached = ( rquery.test( cacheURL ) ? "&" : "?" ) + "_=" + ( nonce.guid++ ) + + uncached; + } + + // Put hash and anti-cache on the URL that will be requested (gh-1732) + s.url = cacheURL + uncached; + + // Change '%20' to '+' if this is encoded form body content (gh-2658) + } else if ( s.data && s.processData && + ( s.contentType || "" ).indexOf( "application/x-www-form-urlencoded" ) === 0 ) { + s.data = s.data.replace( r20, "+" ); + } + + // Set the If-Modified-Since and/or If-None-Match header, if in ifModified mode. + if ( s.ifModified ) { + if ( jQuery.lastModified[ cacheURL ] ) { + jqXHR.setRequestHeader( "If-Modified-Since", jQuery.lastModified[ cacheURL ] ); + } + if ( jQuery.etag[ cacheURL ] ) { + jqXHR.setRequestHeader( "If-None-Match", jQuery.etag[ cacheURL ] ); + } + } + + // Set the correct header, if data is being sent + if ( s.data && s.hasContent && s.contentType !== false || options.contentType ) { + jqXHR.setRequestHeader( "Content-Type", s.contentType ); + } + + // Set the Accepts header for the server, depending on the dataType + jqXHR.setRequestHeader( + "Accept", + s.dataTypes[ 0 ] && s.accepts[ s.dataTypes[ 0 ] ] ? + s.accepts[ s.dataTypes[ 0 ] ] + + ( s.dataTypes[ 0 ] !== "*" ? ", " + allTypes + "; q=0.01" : "" ) : + s.accepts[ "*" ] + ); + + // Check for headers option + for ( i in s.headers ) { + jqXHR.setRequestHeader( i, s.headers[ i ] ); + } + + // Allow custom headers/mimetypes and early abort + if ( s.beforeSend && + ( s.beforeSend.call( callbackContext, jqXHR, s ) === false || completed ) ) { + + // Abort if not done already and return + return jqXHR.abort(); + } + + // Aborting is no longer a cancellation + strAbort = "abort"; + + // Install callbacks on deferreds + completeDeferred.add( s.complete ); + jqXHR.done( s.success ); + jqXHR.fail( s.error ); + + // Get transport + transport = inspectPrefiltersOrTransports( transports, s, options, jqXHR ); + + // If no transport, we auto-abort + if ( !transport ) { + done( -1, "No Transport" ); + } else { + jqXHR.readyState = 1; + + // Send global event + if ( fireGlobals ) { + globalEventContext.trigger( "ajaxSend", [ jqXHR, s ] ); + } + + // If request was aborted inside ajaxSend, stop there + if ( completed ) { + return jqXHR; + } + + // Timeout + if ( s.async && s.timeout > 0 ) { + timeoutTimer = window.setTimeout( function() { + jqXHR.abort( "timeout" ); + }, s.timeout ); + } + + try { + completed = false; + transport.send( requestHeaders, done ); + } catch ( e ) { + + // Rethrow post-completion exceptions + if ( completed ) { + throw e; + } + + // Propagate others as results + done( -1, e ); + } + } + + // Callback for when everything is done + function done( status, nativeStatusText, responses, headers ) { + var isSuccess, success, error, response, modified, + statusText = nativeStatusText; + + // Ignore repeat invocations + if ( completed ) { + return; + } + + completed = true; + + // Clear timeout if it exists + if ( timeoutTimer ) { + window.clearTimeout( timeoutTimer ); + } + + // Dereference transport for early garbage collection + // (no matter how long the jqXHR object will be used) + transport = undefined; + + // Cache response headers + responseHeadersString = headers || ""; + + // Set readyState + jqXHR.readyState = status > 0 ? 4 : 0; + + // Determine if successful + isSuccess = status >= 200 && status < 300 || status === 304; + + // Get response data + if ( responses ) { + response = ajaxHandleResponses( s, jqXHR, responses ); + } + + // Use a noop converter for missing script + if ( !isSuccess && jQuery.inArray( "script", s.dataTypes ) > -1 ) { + s.converters[ "text script" ] = function() {}; + } + + // Convert no matter what (that way responseXXX fields are always set) + response = ajaxConvert( s, response, jqXHR, isSuccess ); + + // If successful, handle type chaining + if ( isSuccess ) { + + // Set the If-Modified-Since and/or If-None-Match header, if in ifModified mode. + if ( s.ifModified ) { + modified = jqXHR.getResponseHeader( "Last-Modified" ); + if ( modified ) { + jQuery.lastModified[ cacheURL ] = modified; + } + modified = jqXHR.getResponseHeader( "etag" ); + if ( modified ) { + jQuery.etag[ cacheURL ] = modified; + } + } + + // if no content + if ( status === 204 || s.type === "HEAD" ) { + statusText = "nocontent"; + + // if not modified + } else if ( status === 304 ) { + statusText = "notmodified"; + + // If we have data, let's convert it + } else { + statusText = response.state; + success = response.data; + error = response.error; + isSuccess = !error; + } + } else { + + // Extract error from statusText and normalize for non-aborts + error = statusText; + if ( status || !statusText ) { + statusText = "error"; + if ( status < 0 ) { + status = 0; + } + } + } + + // Set data for the fake xhr object + jqXHR.status = status; + jqXHR.statusText = ( nativeStatusText || statusText ) + ""; + + // Success/Error + if ( isSuccess ) { + deferred.resolveWith( callbackContext, [ success, statusText, jqXHR ] ); + } else { + deferred.rejectWith( callbackContext, [ jqXHR, statusText, error ] ); + } + + // Status-dependent callbacks + jqXHR.statusCode( statusCode ); + statusCode = undefined; + + if ( fireGlobals ) { + globalEventContext.trigger( isSuccess ? "ajaxSuccess" : "ajaxError", + [ jqXHR, s, isSuccess ? success : error ] ); + } + + // Complete + completeDeferred.fireWith( callbackContext, [ jqXHR, statusText ] ); + + if ( fireGlobals ) { + globalEventContext.trigger( "ajaxComplete", [ jqXHR, s ] ); + + // Handle the global AJAX counter + if ( !( --jQuery.active ) ) { + jQuery.event.trigger( "ajaxStop" ); + } + } + } + + return jqXHR; + }, + + getJSON: function( url, data, callback ) { + return jQuery.get( url, data, callback, "json" ); + }, + + getScript: function( url, callback ) { + return jQuery.get( url, undefined, callback, "script" ); + } +} ); + +jQuery.each( [ "get", "post" ], function( _i, method ) { + jQuery[ method ] = function( url, data, callback, type ) { + + // Shift arguments if data argument was omitted + if ( isFunction( data ) ) { + type = type || callback; + callback = data; + data = undefined; + } + + // The url can be an options object (which then must have .url) + return jQuery.ajax( jQuery.extend( { + url: url, + type: method, + dataType: type, + data: data, + success: callback + }, jQuery.isPlainObject( url ) && url ) ); + }; +} ); + +jQuery.ajaxPrefilter( function( s ) { + var i; + for ( i in s.headers ) { + if ( i.toLowerCase() === "content-type" ) { + s.contentType = s.headers[ i ] || ""; + } + } +} ); + + +jQuery._evalUrl = function( url, options, doc ) { + return jQuery.ajax( { + url: url, + + // Make this explicit, since user can override this through ajaxSetup (#11264) + type: "GET", + dataType: "script", + cache: true, + async: false, + global: false, + + // Only evaluate the response if it is successful (gh-4126) + // dataFilter is not invoked for failure responses, so using it instead + // of the default converter is kludgy but it works. + converters: { + "text script": function() {} + }, + dataFilter: function( response ) { + jQuery.globalEval( response, options, doc ); + } + } ); +}; + + +jQuery.fn.extend( { + wrapAll: function( html ) { + var wrap; + + if ( this[ 0 ] ) { + if ( isFunction( html ) ) { + html = html.call( this[ 0 ] ); + } + + // The elements to wrap the target around + wrap = jQuery( html, this[ 0 ].ownerDocument ).eq( 0 ).clone( true ); + + if ( this[ 0 ].parentNode ) { + wrap.insertBefore( this[ 0 ] ); + } + + wrap.map( function() { + var elem = this; + + while ( elem.firstElementChild ) { + elem = elem.firstElementChild; + } + + return elem; + } ).append( this ); + } + + return this; + }, + + wrapInner: function( html ) { + if ( isFunction( html ) ) { + return this.each( function( i ) { + jQuery( this ).wrapInner( html.call( this, i ) ); + } ); + } + + return this.each( function() { + var self = jQuery( this ), + contents = self.contents(); + + if ( contents.length ) { + contents.wrapAll( html ); + + } else { + self.append( html ); + } + } ); + }, + + wrap: function( html ) { + var htmlIsFunction = isFunction( html ); + + return this.each( function( i ) { + jQuery( this ).wrapAll( htmlIsFunction ? html.call( this, i ) : html ); + } ); + }, + + unwrap: function( selector ) { + this.parent( selector ).not( "body" ).each( function() { + jQuery( this ).replaceWith( this.childNodes ); + } ); + return this; + } +} ); + + +jQuery.expr.pseudos.hidden = function( elem ) { + return !jQuery.expr.pseudos.visible( elem ); +}; +jQuery.expr.pseudos.visible = function( elem ) { + return !!( elem.offsetWidth || elem.offsetHeight || elem.getClientRects().length ); +}; + + + + +jQuery.ajaxSettings.xhr = function() { + try { + return new window.XMLHttpRequest(); + } catch ( e ) {} +}; + +var xhrSuccessStatus = { + + // File protocol always yields status code 0, assume 200 + 0: 200, + + // Support: IE <=9 only + // #1450: sometimes IE returns 1223 when it should be 204 + 1223: 204 + }, + xhrSupported = jQuery.ajaxSettings.xhr(); + +support.cors = !!xhrSupported && ( "withCredentials" in xhrSupported ); +support.ajax = xhrSupported = !!xhrSupported; + +jQuery.ajaxTransport( function( options ) { + var callback, errorCallback; + + // Cross domain only allowed if supported through XMLHttpRequest + if ( support.cors || xhrSupported && !options.crossDomain ) { + return { + send: function( headers, complete ) { + var i, + xhr = options.xhr(); + + xhr.open( + options.type, + options.url, + options.async, + options.username, + options.password + ); + + // Apply custom fields if provided + if ( options.xhrFields ) { + for ( i in options.xhrFields ) { + xhr[ i ] = options.xhrFields[ i ]; + } + } + + // Override mime type if needed + if ( options.mimeType && xhr.overrideMimeType ) { + xhr.overrideMimeType( options.mimeType ); + } + + // X-Requested-With header + // For cross-domain requests, seeing as conditions for a preflight are + // akin to a jigsaw puzzle, we simply never set it to be sure. + // (it can always be set on a per-request basis or even using ajaxSetup) + // For same-domain requests, won't change header if already provided. + if ( !options.crossDomain && !headers[ "X-Requested-With" ] ) { + headers[ "X-Requested-With" ] = "XMLHttpRequest"; + } + + // Set headers + for ( i in headers ) { + xhr.setRequestHeader( i, headers[ i ] ); + } + + // Callback + callback = function( type ) { + return function() { + if ( callback ) { + callback = errorCallback = xhr.onload = + xhr.onerror = xhr.onabort = xhr.ontimeout = + xhr.onreadystatechange = null; + + if ( type === "abort" ) { + xhr.abort(); + } else if ( type === "error" ) { + + // Support: IE <=9 only + // On a manual native abort, IE9 throws + // errors on any property access that is not readyState + if ( typeof xhr.status !== "number" ) { + complete( 0, "error" ); + } else { + complete( + + // File: protocol always yields status 0; see #8605, #14207 + xhr.status, + xhr.statusText + ); + } + } else { + complete( + xhrSuccessStatus[ xhr.status ] || xhr.status, + xhr.statusText, + + // Support: IE <=9 only + // IE9 has no XHR2 but throws on binary (trac-11426) + // For XHR2 non-text, let the caller handle it (gh-2498) + ( xhr.responseType || "text" ) !== "text" || + typeof xhr.responseText !== "string" ? + { binary: xhr.response } : + { text: xhr.responseText }, + xhr.getAllResponseHeaders() + ); + } + } + }; + }; + + // Listen to events + xhr.onload = callback(); + errorCallback = xhr.onerror = xhr.ontimeout = callback( "error" ); + + // Support: IE 9 only + // Use onreadystatechange to replace onabort + // to handle uncaught aborts + if ( xhr.onabort !== undefined ) { + xhr.onabort = errorCallback; + } else { + xhr.onreadystatechange = function() { + + // Check readyState before timeout as it changes + if ( xhr.readyState === 4 ) { + + // Allow onerror to be called first, + // but that will not handle a native abort + // Also, save errorCallback to a variable + // as xhr.onerror cannot be accessed + window.setTimeout( function() { + if ( callback ) { + errorCallback(); + } + } ); + } + }; + } + + // Create the abort callback + callback = callback( "abort" ); + + try { + + // Do send the request (this may raise an exception) + xhr.send( options.hasContent && options.data || null ); + } catch ( e ) { + + // #14683: Only rethrow if this hasn't been notified as an error yet + if ( callback ) { + throw e; + } + } + }, + + abort: function() { + if ( callback ) { + callback(); + } + } + }; + } +} ); + + + + +// Prevent auto-execution of scripts when no explicit dataType was provided (See gh-2432) +jQuery.ajaxPrefilter( function( s ) { + if ( s.crossDomain ) { + s.contents.script = false; + } +} ); + +// Install script dataType +jQuery.ajaxSetup( { + accepts: { + script: "text/javascript, application/javascript, " + + "application/ecmascript, application/x-ecmascript" + }, + contents: { + script: /\b(?:java|ecma)script\b/ + }, + converters: { + "text script": function( text ) { + jQuery.globalEval( text ); + return text; + } + } +} ); + +// Handle cache's special case and crossDomain +jQuery.ajaxPrefilter( "script", function( s ) { + if ( s.cache === undefined ) { + s.cache = false; + } + if ( s.crossDomain ) { + s.type = "GET"; + } +} ); + +// Bind script tag hack transport +jQuery.ajaxTransport( "script", function( s ) { + + // This transport only deals with cross domain or forced-by-attrs requests + if ( s.crossDomain || s.scriptAttrs ) { + var script, callback; + return { + send: function( _, complete ) { + script = jQuery( " + + + + diff --git a/package/appserver/static/js/lib/jquery-ui/jquery-ui.css b/package/appserver/static/js/lib/jquery-ui/jquery-ui.css new file mode 100644 index 0000000000..1b206a5e9e --- /dev/null +++ b/package/appserver/static/js/lib/jquery-ui/jquery-ui.css @@ -0,0 +1,1312 @@ +/*! jQuery UI - v1.12.1 - 2017-08-27 +* http://jqueryui.com +* Includes: draggable.css, core.css, resizable.css, selectable.css, sortable.css, accordion.css, autocomplete.css, menu.css, button.css, controlgroup.css, checkboxradio.css, datepicker.css, dialog.css, progressbar.css, selectmenu.css, slider.css, spinner.css, tabs.css, tooltip.css, theme.css +* To view and modify this theme, visit http://jqueryui.com/themeroller/?scope=&folderName=base&cornerRadiusShadow=8px&offsetLeftShadow=0px&offsetTopShadow=0px&thicknessShadow=5px&opacityShadow=30&bgImgOpacityShadow=0&bgTextureShadow=flat&bgColorShadow=666666&opacityOverlay=30&bgImgOpacityOverlay=0&bgTextureOverlay=flat&bgColorOverlay=aaaaaa&iconColorError=cc0000&fcError=5f3f3f&borderColorError=f1a899&bgTextureError=flat&bgColorError=fddfdf&iconColorHighlight=777620&fcHighlight=777620&borderColorHighlight=dad55e&bgTextureHighlight=flat&bgColorHighlight=fffa90&iconColorActive=ffffff&fcActive=ffffff&borderColorActive=003eff&bgTextureActive=flat&bgColorActive=007fff&iconColorHover=555555&fcHover=2b2b2b&borderColorHover=cccccc&bgTextureHover=flat&bgColorHover=ededed&iconColorDefault=777777&fcDefault=454545&borderColorDefault=c5c5c5&bgTextureDefault=flat&bgColorDefault=f6f6f6&iconColorContent=444444&fcContent=333333&borderColorContent=dddddd&bgTextureContent=flat&bgColorContent=ffffff&iconColorHeader=444444&fcHeader=333333&borderColorHeader=dddddd&bgTextureHeader=flat&bgColorHeader=e9e9e9&cornerRadius=3px&fwDefault=normal&fsDefault=1em&ffDefault=Arial%2CHelvetica%2Csans-serif +* Copyright jQuery Foundation and other contributors; Licensed MIT */ + +.ui-draggable-handle { + -ms-touch-action: none; + touch-action: none; +} +/* Layout helpers +----------------------------------*/ +.ui-helper-hidden { + display: none; +} +.ui-helper-hidden-accessible { + border: 0; + clip: rect(0 0 0 0); + height: 1px; + margin: -1px; + overflow: hidden; + padding: 0; + position: absolute; + width: 1px; +} +.ui-helper-reset { + margin: 0; + padding: 0; + border: 0; + outline: 0; + line-height: 1.3; + text-decoration: none; + font-size: 100%; + list-style: none; +} +.ui-helper-clearfix:before, +.ui-helper-clearfix:after { + content: ""; + display: table; + border-collapse: collapse; +} +.ui-helper-clearfix:after { + clear: both; +} +.ui-helper-zfix { + width: 100%; + height: 100%; + top: 0; + left: 0; + position: absolute; + opacity: 0; + filter:Alpha(Opacity=0); /* support: IE8 */ +} + +.ui-front { + z-index: 100; +} + + +/* Interaction Cues +----------------------------------*/ +.ui-state-disabled { + cursor: default !important; + pointer-events: none; +} + + +/* Icons +----------------------------------*/ +.ui-icon { + display: inline-block; + vertical-align: middle; + margin-top: -.25em; + position: relative; + text-indent: -99999px; + overflow: hidden; + background-repeat: no-repeat; +} + +.ui-widget-icon-block { + left: 50%; + margin-left: -8px; + display: block; +} + +/* Misc visuals +----------------------------------*/ + +/* Overlays */ +.ui-widget-overlay { + position: fixed; + top: 0; + left: 0; + width: 100%; + height: 100%; +} +.ui-resizable { + position: relative; +} +.ui-resizable-handle { + position: absolute; + font-size: 0.1px; + display: block; + -ms-touch-action: none; + touch-action: none; +} +.ui-resizable-disabled .ui-resizable-handle, +.ui-resizable-autohide .ui-resizable-handle { + display: none; +} +.ui-resizable-n { + cursor: n-resize; + height: 7px; + width: 100%; + top: -5px; + left: 0; +} +.ui-resizable-s { + cursor: s-resize; + height: 7px; + width: 100%; + bottom: -5px; + left: 0; +} +.ui-resizable-e { + cursor: e-resize; + width: 7px; + right: -5px; + top: 0; + height: 100%; +} +.ui-resizable-w { + cursor: w-resize; + width: 7px; + left: -5px; + top: 0; + height: 100%; +} +.ui-resizable-se { + cursor: se-resize; + width: 12px; + height: 12px; + right: 1px; + bottom: 1px; +} +.ui-resizable-sw { + cursor: sw-resize; + width: 9px; + height: 9px; + left: -5px; + bottom: -5px; +} +.ui-resizable-nw { + cursor: nw-resize; + width: 9px; + height: 9px; + left: -5px; + top: -5px; +} +.ui-resizable-ne { + cursor: ne-resize; + width: 9px; + height: 9px; + right: -5px; + top: -5px; +} +.ui-selectable { + -ms-touch-action: none; + touch-action: none; +} +.ui-selectable-helper { + position: absolute; + z-index: 100; + border: 1px dotted black; +} +.ui-sortable-handle { + -ms-touch-action: none; + touch-action: none; +} +.ui-accordion .ui-accordion-header { + display: block; + cursor: pointer; + position: relative; + margin: 2px 0 0 0; + padding: .5em .5em .5em 1.7em; + font-size: 100%; +} +.ui-accordion .ui-accordion-content { + padding: 1em 2.2em; + border-top: 0; + overflow: auto; +} +.ui-autocomplete { + position: absolute; + top: 0; + left: 0; + cursor: default; +} +.ui-menu { + list-style: none; + padding: 0; + margin: 0; + display: block; + outline: 0; +} +.ui-menu .ui-menu { + position: absolute; +} +.ui-menu .ui-menu-item { + margin: 0; + cursor: pointer; + /* support: IE10, see #8844 */ + list-style-image: url("data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7"); +} +.ui-menu .ui-menu-item-wrapper { + position: relative; + padding: 3px 1em 3px .4em; +} +.ui-menu .ui-menu-divider { + margin: 5px 0; + height: 0; + font-size: 0; + line-height: 0; + border-width: 1px 0 0 0; +} +.ui-menu .ui-state-focus, +.ui-menu .ui-state-active { + margin: -1px; +} + +/* icon support */ +.ui-menu-icons { + position: relative; +} +.ui-menu-icons .ui-menu-item-wrapper { + padding-left: 2em; +} + +/* left-aligned */ +.ui-menu .ui-icon { + position: absolute; + top: 0; + bottom: 0; + left: .2em; + margin: auto 0; +} + +/* right-aligned */ +.ui-menu .ui-menu-icon { + left: auto; + right: 0; +} +.ui-button { + padding: .4em 1em; + display: inline-block; + position: relative; + line-height: normal; + margin-right: .1em; + cursor: pointer; + vertical-align: middle; + text-align: center; + -webkit-user-select: none; + -moz-user-select: none; + -ms-user-select: none; + user-select: none; + + /* Support: IE <= 11 */ + overflow: visible; +} + +.ui-button, +.ui-button:link, +.ui-button:visited, +.ui-button:hover, +.ui-button:active { + text-decoration: none; +} + +/* to make room for the icon, a width needs to be set here */ +.ui-button-icon-only { + width: 2em; + box-sizing: border-box; + text-indent: -9999px; + white-space: nowrap; +} + +/* no icon support for input elements */ +input.ui-button.ui-button-icon-only { + text-indent: 0; +} + +/* button icon element(s) */ +.ui-button-icon-only .ui-icon { + position: absolute; + top: 50%; + left: 50%; + margin-top: -8px; + margin-left: -8px; +} + +.ui-button.ui-icon-notext .ui-icon { + padding: 0; + width: 2.1em; + height: 2.1em; + text-indent: -9999px; + white-space: nowrap; + +} + +input.ui-button.ui-icon-notext .ui-icon { + width: auto; + height: auto; + text-indent: 0; + white-space: normal; + padding: .4em 1em; +} + +/* workarounds */ +/* Support: Firefox 5 - 40 */ +input.ui-button::-moz-focus-inner, +button.ui-button::-moz-focus-inner { + border: 0; + padding: 0; +} +.ui-controlgroup { + vertical-align: middle; + display: inline-block; +} +.ui-controlgroup > .ui-controlgroup-item { + float: left; + margin-left: 0; + margin-right: 0; +} +.ui-controlgroup > .ui-controlgroup-item:focus, +.ui-controlgroup > .ui-controlgroup-item.ui-visual-focus { + z-index: 9999; +} +.ui-controlgroup-vertical > .ui-controlgroup-item { + display: block; + float: none; + width: 100%; + margin-top: 0; + margin-bottom: 0; + text-align: left; +} +.ui-controlgroup-vertical .ui-controlgroup-item { + box-sizing: border-box; +} +.ui-controlgroup .ui-controlgroup-label { + padding: .4em 1em; +} +.ui-controlgroup .ui-controlgroup-label span { + font-size: 80%; +} +.ui-controlgroup-horizontal .ui-controlgroup-label + .ui-controlgroup-item { + border-left: none; +} +.ui-controlgroup-vertical .ui-controlgroup-label + .ui-controlgroup-item { + border-top: none; +} +.ui-controlgroup-horizontal .ui-controlgroup-label.ui-widget-content { + border-right: none; +} +.ui-controlgroup-vertical .ui-controlgroup-label.ui-widget-content { + border-bottom: none; +} + +/* Spinner specific style fixes */ +.ui-controlgroup-vertical .ui-spinner-input { + + /* Support: IE8 only, Android < 4.4 only */ + width: 75%; + width: calc( 100% - 2.4em ); +} +.ui-controlgroup-vertical .ui-spinner .ui-spinner-up { + border-top-style: solid; +} + +.ui-checkboxradio-label .ui-icon-background { + box-shadow: inset 1px 1px 1px #ccc; + border-radius: .12em; + border: none; +} +.ui-checkboxradio-radio-label .ui-icon-background { + width: 16px; + height: 16px; + border-radius: 1em; + overflow: visible; + border: none; +} +.ui-checkboxradio-radio-label.ui-checkboxradio-checked .ui-icon, +.ui-checkboxradio-radio-label.ui-checkboxradio-checked:hover .ui-icon { + background-image: none; + width: 8px; + height: 8px; + border-width: 4px; + border-style: solid; +} +.ui-checkboxradio-disabled { + pointer-events: none; +} +.ui-datepicker { + width: 17em; + padding: .2em .2em 0; + display: none; +} +.ui-datepicker .ui-datepicker-header { + position: relative; + padding: .2em 0; +} +.ui-datepicker .ui-datepicker-prev, +.ui-datepicker .ui-datepicker-next { + position: absolute; + top: 2px; + width: 1.8em; + height: 1.8em; +} +.ui-datepicker .ui-datepicker-prev-hover, +.ui-datepicker .ui-datepicker-next-hover { + top: 1px; +} +.ui-datepicker .ui-datepicker-prev { + left: 2px; +} +.ui-datepicker .ui-datepicker-next { + right: 2px; +} +.ui-datepicker .ui-datepicker-prev-hover { + left: 1px; +} +.ui-datepicker .ui-datepicker-next-hover { + right: 1px; +} +.ui-datepicker .ui-datepicker-prev span, +.ui-datepicker .ui-datepicker-next span { + display: block; + position: absolute; + left: 50%; + margin-left: -8px; + top: 50%; + margin-top: -8px; +} +.ui-datepicker .ui-datepicker-title { + margin: 0 2.3em; + line-height: 1.8em; + text-align: center; +} +.ui-datepicker .ui-datepicker-title select { + font-size: 1em; + margin: 1px 0; +} +.ui-datepicker select.ui-datepicker-month, +.ui-datepicker select.ui-datepicker-year { + width: 45%; +} +.ui-datepicker table { + width: 100%; + font-size: .9em; + border-collapse: collapse; + margin: 0 0 .4em; +} +.ui-datepicker th { + padding: .7em .3em; + text-align: center; + font-weight: bold; + border: 0; +} +.ui-datepicker td { + border: 0; + padding: 1px; +} +.ui-datepicker td span, +.ui-datepicker td a { + display: block; + padding: .2em; + text-align: right; + text-decoration: none; +} +.ui-datepicker .ui-datepicker-buttonpane { + background-image: none; + margin: .7em 0 0 0; + padding: 0 .2em; + border-left: 0; + border-right: 0; + border-bottom: 0; +} +.ui-datepicker .ui-datepicker-buttonpane button { + float: right; + margin: .5em .2em .4em; + cursor: pointer; + padding: .2em .6em .3em .6em; + width: auto; + overflow: visible; +} +.ui-datepicker .ui-datepicker-buttonpane button.ui-datepicker-current { + float: left; +} + +/* with multiple calendars */ +.ui-datepicker.ui-datepicker-multi { + width: auto; +} +.ui-datepicker-multi .ui-datepicker-group { + float: left; +} +.ui-datepicker-multi .ui-datepicker-group table { + width: 95%; + margin: 0 auto .4em; +} +.ui-datepicker-multi-2 .ui-datepicker-group { + width: 50%; +} +.ui-datepicker-multi-3 .ui-datepicker-group { + width: 33.3%; +} +.ui-datepicker-multi-4 .ui-datepicker-group { + width: 25%; +} +.ui-datepicker-multi .ui-datepicker-group-last .ui-datepicker-header, +.ui-datepicker-multi .ui-datepicker-group-middle .ui-datepicker-header { + border-left-width: 0; +} +.ui-datepicker-multi .ui-datepicker-buttonpane { + clear: left; +} +.ui-datepicker-row-break { + clear: both; + width: 100%; + font-size: 0; +} + +/* RTL support */ +.ui-datepicker-rtl { + direction: rtl; +} +.ui-datepicker-rtl .ui-datepicker-prev { + right: 2px; + left: auto; +} +.ui-datepicker-rtl .ui-datepicker-next { + left: 2px; + right: auto; +} +.ui-datepicker-rtl .ui-datepicker-prev:hover { + right: 1px; + left: auto; +} +.ui-datepicker-rtl .ui-datepicker-next:hover { + left: 1px; + right: auto; +} +.ui-datepicker-rtl .ui-datepicker-buttonpane { + clear: right; +} +.ui-datepicker-rtl .ui-datepicker-buttonpane button { + float: left; +} +.ui-datepicker-rtl .ui-datepicker-buttonpane button.ui-datepicker-current, +.ui-datepicker-rtl .ui-datepicker-group { + float: right; +} +.ui-datepicker-rtl .ui-datepicker-group-last .ui-datepicker-header, +.ui-datepicker-rtl .ui-datepicker-group-middle .ui-datepicker-header { + border-right-width: 0; + border-left-width: 1px; +} + +/* Icons */ +.ui-datepicker .ui-icon { + display: block; + text-indent: -99999px; + overflow: hidden; + background-repeat: no-repeat; + left: .5em; + top: .3em; +} +.ui-dialog { + position: absolute; + top: 0; + left: 0; + padding: .2em; + outline: 0; +} +.ui-dialog .ui-dialog-titlebar { + padding: .4em 1em; + position: relative; +} +.ui-dialog .ui-dialog-title { + float: left; + margin: .1em 0; + white-space: nowrap; + width: 90%; + overflow: hidden; + text-overflow: ellipsis; +} +.ui-dialog .ui-dialog-titlebar-close { + position: absolute; + right: .3em; + top: 50%; + width: 20px; + margin: -10px 0 0 0; + padding: 1px; + height: 20px; +} +.ui-dialog .ui-dialog-content { + position: relative; + border: 0; + padding: .5em 1em; + background: none; + overflow: auto; +} +.ui-dialog .ui-dialog-buttonpane { + text-align: left; + border-width: 1px 0 0 0; + background-image: none; + margin-top: .5em; + padding: .3em 1em .5em .4em; +} +.ui-dialog .ui-dialog-buttonpane .ui-dialog-buttonset { + float: right; +} +.ui-dialog .ui-dialog-buttonpane button { + margin: .5em .4em .5em 0; + cursor: pointer; +} +.ui-dialog .ui-resizable-n { + height: 2px; + top: 0; +} +.ui-dialog .ui-resizable-e { + width: 2px; + right: 0; +} +.ui-dialog .ui-resizable-s { + height: 2px; + bottom: 0; +} +.ui-dialog .ui-resizable-w { + width: 2px; + left: 0; +} +.ui-dialog .ui-resizable-se, +.ui-dialog .ui-resizable-sw, +.ui-dialog .ui-resizable-ne, +.ui-dialog .ui-resizable-nw { + width: 7px; + height: 7px; +} +.ui-dialog .ui-resizable-se { + right: 0; + bottom: 0; +} +.ui-dialog .ui-resizable-sw { + left: 0; + bottom: 0; +} +.ui-dialog .ui-resizable-ne { + right: 0; + top: 0; +} +.ui-dialog .ui-resizable-nw { + left: 0; + top: 0; +} +.ui-draggable .ui-dialog-titlebar { + cursor: move; +} +.ui-progressbar { + height: 2em; + text-align: left; + overflow: hidden; +} +.ui-progressbar .ui-progressbar-value { + margin: -1px; + height: 100%; +} +.ui-progressbar .ui-progressbar-overlay { + background: url("data:image/gif;base64,R0lGODlhKAAoAIABAAAAAP///yH/C05FVFNDQVBFMi4wAwEAAAAh+QQJAQABACwAAAAAKAAoAAACkYwNqXrdC52DS06a7MFZI+4FHBCKoDeWKXqymPqGqxvJrXZbMx7Ttc+w9XgU2FB3lOyQRWET2IFGiU9m1frDVpxZZc6bfHwv4c1YXP6k1Vdy292Fb6UkuvFtXpvWSzA+HycXJHUXiGYIiMg2R6W459gnWGfHNdjIqDWVqemH2ekpObkpOlppWUqZiqr6edqqWQAAIfkECQEAAQAsAAAAACgAKAAAApSMgZnGfaqcg1E2uuzDmmHUBR8Qil95hiPKqWn3aqtLsS18y7G1SzNeowWBENtQd+T1JktP05nzPTdJZlR6vUxNWWjV+vUWhWNkWFwxl9VpZRedYcflIOLafaa28XdsH/ynlcc1uPVDZxQIR0K25+cICCmoqCe5mGhZOfeYSUh5yJcJyrkZWWpaR8doJ2o4NYq62lAAACH5BAkBAAEALAAAAAAoACgAAAKVDI4Yy22ZnINRNqosw0Bv7i1gyHUkFj7oSaWlu3ovC8GxNso5fluz3qLVhBVeT/Lz7ZTHyxL5dDalQWPVOsQWtRnuwXaFTj9jVVh8pma9JjZ4zYSj5ZOyma7uuolffh+IR5aW97cHuBUXKGKXlKjn+DiHWMcYJah4N0lYCMlJOXipGRr5qdgoSTrqWSq6WFl2ypoaUAAAIfkECQEAAQAsAAAAACgAKAAAApaEb6HLgd/iO7FNWtcFWe+ufODGjRfoiJ2akShbueb0wtI50zm02pbvwfWEMWBQ1zKGlLIhskiEPm9R6vRXxV4ZzWT2yHOGpWMyorblKlNp8HmHEb/lCXjcW7bmtXP8Xt229OVWR1fod2eWqNfHuMjXCPkIGNileOiImVmCOEmoSfn3yXlJWmoHGhqp6ilYuWYpmTqKUgAAIfkECQEAAQAsAAAAACgAKAAAApiEH6kb58biQ3FNWtMFWW3eNVcojuFGfqnZqSebuS06w5V80/X02pKe8zFwP6EFWOT1lDFk8rGERh1TTNOocQ61Hm4Xm2VexUHpzjymViHrFbiELsefVrn6XKfnt2Q9G/+Xdie499XHd2g4h7ioOGhXGJboGAnXSBnoBwKYyfioubZJ2Hn0RuRZaflZOil56Zp6iioKSXpUAAAh+QQJAQABACwAAAAAKAAoAAACkoQRqRvnxuI7kU1a1UU5bd5tnSeOZXhmn5lWK3qNTWvRdQxP8qvaC+/yaYQzXO7BMvaUEmJRd3TsiMAgswmNYrSgZdYrTX6tSHGZO73ezuAw2uxuQ+BbeZfMxsexY35+/Qe4J1inV0g4x3WHuMhIl2jXOKT2Q+VU5fgoSUI52VfZyfkJGkha6jmY+aaYdirq+lQAACH5BAkBAAEALAAAAAAoACgAAAKWBIKpYe0L3YNKToqswUlvznigd4wiR4KhZrKt9Upqip61i9E3vMvxRdHlbEFiEXfk9YARYxOZZD6VQ2pUunBmtRXo1Lf8hMVVcNl8JafV38aM2/Fu5V16Bn63r6xt97j09+MXSFi4BniGFae3hzbH9+hYBzkpuUh5aZmHuanZOZgIuvbGiNeomCnaxxap2upaCZsq+1kAACH5BAkBAAEALAAAAAAoACgAAAKXjI8By5zf4kOxTVrXNVlv1X0d8IGZGKLnNpYtm8Lr9cqVeuOSvfOW79D9aDHizNhDJidFZhNydEahOaDH6nomtJjp1tutKoNWkvA6JqfRVLHU/QUfau9l2x7G54d1fl995xcIGAdXqMfBNadoYrhH+Mg2KBlpVpbluCiXmMnZ2Sh4GBqJ+ckIOqqJ6LmKSllZmsoq6wpQAAAh+QQJAQABACwAAAAAKAAoAAAClYx/oLvoxuJDkU1a1YUZbJ59nSd2ZXhWqbRa2/gF8Gu2DY3iqs7yrq+xBYEkYvFSM8aSSObE+ZgRl1BHFZNr7pRCavZ5BW2142hY3AN/zWtsmf12p9XxxFl2lpLn1rseztfXZjdIWIf2s5dItwjYKBgo9yg5pHgzJXTEeGlZuenpyPmpGQoKOWkYmSpaSnqKileI2FAAACH5BAkBAAEALAAAAAAoACgAAAKVjB+gu+jG4kORTVrVhRlsnn2dJ3ZleFaptFrb+CXmO9OozeL5VfP99HvAWhpiUdcwkpBH3825AwYdU8xTqlLGhtCosArKMpvfa1mMRae9VvWZfeB2XfPkeLmm18lUcBj+p5dnN8jXZ3YIGEhYuOUn45aoCDkp16hl5IjYJvjWKcnoGQpqyPlpOhr3aElaqrq56Bq7VAAAOw=="); + height: 100%; + filter: alpha(opacity=25); /* support: IE8 */ + opacity: 0.25; +} +.ui-progressbar-indeterminate .ui-progressbar-value { + background-image: none; +} +.ui-selectmenu-menu { + padding: 0; + margin: 0; + position: absolute; + top: 0; + left: 0; + display: none; +} +.ui-selectmenu-menu .ui-menu { + overflow: auto; + overflow-x: hidden; + padding-bottom: 1px; +} +.ui-selectmenu-menu .ui-menu .ui-selectmenu-optgroup { + font-size: 1em; + font-weight: bold; + line-height: 1.5; + padding: 2px 0.4em; + margin: 0.5em 0 0 0; + height: auto; + border: 0; +} +.ui-selectmenu-open { + display: block; +} +.ui-selectmenu-text { + display: block; + margin-right: 20px; + overflow: hidden; + text-overflow: ellipsis; +} +.ui-selectmenu-button.ui-button { + text-align: left; + white-space: nowrap; + width: 14em; +} +.ui-selectmenu-icon.ui-icon { + float: right; + margin-top: 0; +} +.ui-slider { + position: relative; + text-align: left; +} +.ui-slider .ui-slider-handle { + position: absolute; + z-index: 2; + width: 1.2em; + height: 1.2em; + cursor: default; + -ms-touch-action: none; + touch-action: none; +} +.ui-slider .ui-slider-range { + position: absolute; + z-index: 1; + font-size: .7em; + display: block; + border: 0; + background-position: 0 0; +} + +/* support: IE8 - See #6727 */ +.ui-slider.ui-state-disabled .ui-slider-handle, +.ui-slider.ui-state-disabled .ui-slider-range { + filter: inherit; +} + +.ui-slider-horizontal { + height: .8em; +} +.ui-slider-horizontal .ui-slider-handle { + top: -.3em; + margin-left: -.6em; +} +.ui-slider-horizontal .ui-slider-range { + top: 0; + height: 100%; +} +.ui-slider-horizontal .ui-slider-range-min { + left: 0; +} +.ui-slider-horizontal .ui-slider-range-max { + right: 0; +} + +.ui-slider-vertical { + width: .8em; + height: 100px; +} +.ui-slider-vertical .ui-slider-handle { + left: -.3em; + margin-left: 0; + margin-bottom: -.6em; +} +.ui-slider-vertical .ui-slider-range { + left: 0; + width: 100%; +} +.ui-slider-vertical .ui-slider-range-min { + bottom: 0; +} +.ui-slider-vertical .ui-slider-range-max { + top: 0; +} +.ui-spinner { + position: relative; + display: inline-block; + overflow: hidden; + padding: 0; + vertical-align: middle; +} +.ui-spinner-input { + border: none; + background: none; + color: inherit; + padding: .222em 0; + margin: .2em 0; + vertical-align: middle; + margin-left: .4em; + margin-right: 2em; +} +.ui-spinner-button { + width: 1.6em; + height: 50%; + font-size: .5em; + padding: 0; + margin: 0; + text-align: center; + position: absolute; + cursor: default; + display: block; + overflow: hidden; + right: 0; +} +/* more specificity required here to override default borders */ +.ui-spinner a.ui-spinner-button { + border-top-style: none; + border-bottom-style: none; + border-right-style: none; +} +.ui-spinner-up { + top: 0; +} +.ui-spinner-down { + bottom: 0; +} +.ui-tabs { + position: relative;/* position: relative prevents IE scroll bug (element with position: relative inside container with overflow: auto appear as "fixed") */ + padding: .2em; +} +.ui-tabs .ui-tabs-nav { + margin: 0; + padding: .2em .2em 0; +} +.ui-tabs .ui-tabs-nav li { + list-style: none; + float: left; + position: relative; + top: 0; + margin: 1px .2em 0 0; + border-bottom-width: 0; + padding: 0; + white-space: nowrap; +} +.ui-tabs .ui-tabs-nav .ui-tabs-anchor { + float: left; + padding: .5em 1em; + text-decoration: none; +} +.ui-tabs .ui-tabs-nav li.ui-tabs-active { + margin-bottom: -1px; + padding-bottom: 1px; +} +.ui-tabs .ui-tabs-nav li.ui-tabs-active .ui-tabs-anchor, +.ui-tabs .ui-tabs-nav li.ui-state-disabled .ui-tabs-anchor, +.ui-tabs .ui-tabs-nav li.ui-tabs-loading .ui-tabs-anchor { + cursor: text; +} +.ui-tabs-collapsible .ui-tabs-nav li.ui-tabs-active .ui-tabs-anchor { + cursor: pointer; +} +.ui-tabs .ui-tabs-panel { + display: block; + border-width: 0; + padding: 1em 1.4em; + background: none; +} +.ui-tooltip { + padding: 8px; + position: absolute; + z-index: 9999; + max-width: 300px; +} +body .ui-tooltip { + border-width: 2px; +} + +/* Component containers +----------------------------------*/ +.ui-widget { + font-family: Arial,Helvetica,sans-serif; + font-size: 1em; +} +.ui-widget .ui-widget { + font-size: 1em; +} +.ui-widget input, +.ui-widget select, +.ui-widget textarea, +.ui-widget button { + font-family: Arial,Helvetica,sans-serif; + font-size: 1em; +} +.ui-widget.ui-widget-content { + border: 1px solid #c5c5c5; +} +.ui-widget-content { + border: 1px solid #dddddd; + background: #ffffff; + color: #333333; +} +.ui-widget-content a { + color: #333333; +} +.ui-widget-header { + border: 1px solid #dddddd; + background: #e9e9e9; + color: #333333; + font-weight: bold; +} +.ui-widget-header a { + color: #333333; +} + +/* Interaction states +----------------------------------*/ +.ui-state-default, +.ui-widget-content .ui-state-default, +.ui-widget-header .ui-state-default, +.ui-button, + +/* We use html here because we need a greater specificity to make sure disabled +works properly when clicked or hovered */ +html .ui-button.ui-state-disabled:hover, +html .ui-button.ui-state-disabled:active { + border: 1px solid #c5c5c5; + background: #f6f6f6; + font-weight: normal; + color: #454545; +} +.ui-state-default a, +.ui-state-default a:link, +.ui-state-default a:visited, +a.ui-button, +a:link.ui-button, +a:visited.ui-button, +.ui-button { + color: #454545; + text-decoration: none; +} +.ui-state-hover, +.ui-widget-content .ui-state-hover, +.ui-widget-header .ui-state-hover, +.ui-state-focus, +.ui-widget-content .ui-state-focus, +.ui-widget-header .ui-state-focus, +.ui-button:hover, +.ui-button:focus { + border: 1px solid #cccccc; + background: #ededed; + font-weight: normal; + color: #2b2b2b; +} +.ui-state-hover a, +.ui-state-hover a:hover, +.ui-state-hover a:link, +.ui-state-hover a:visited, +.ui-state-focus a, +.ui-state-focus a:hover, +.ui-state-focus a:link, +.ui-state-focus a:visited, +a.ui-button:hover, +a.ui-button:focus { + color: #2b2b2b; + text-decoration: none; +} + +.ui-visual-focus { + box-shadow: 0 0 3px 1px rgb(94, 158, 214); +} +.ui-state-active, +.ui-widget-content .ui-state-active, +.ui-widget-header .ui-state-active, +a.ui-button:active, +.ui-button:active, +.ui-button.ui-state-active:hover { + /* border: 1px solid #003eff; + background: #007fff; + font-weight: normal; + color: #ffffff; */ +} +.ui-icon-background, +.ui-state-active .ui-icon-background { + border: #003eff; + background-color: #ffffff; +} +.ui-state-active a, +.ui-state-active a:link, +.ui-state-active a:visited { + color: #ffffff; + text-decoration: none; +} + +/* Interaction Cues +----------------------------------*/ +.ui-state-highlight, +.ui-widget-content .ui-state-highlight, +.ui-widget-header .ui-state-highlight { + border: 1px solid #dad55e; + background: #fffa90; + color: #777620; +} +.ui-state-checked { + border: 1px solid #dad55e; + background: #fffa90; +} +.ui-state-highlight a, +.ui-widget-content .ui-state-highlight a, +.ui-widget-header .ui-state-highlight a { + color: #777620; +} +.ui-state-error, +.ui-widget-content .ui-state-error, +.ui-widget-header .ui-state-error { + border: 1px solid #f1a899; + background: #fddfdf; + color: #5f3f3f; +} +.ui-state-error a, +.ui-widget-content .ui-state-error a, +.ui-widget-header .ui-state-error a { + color: #5f3f3f; +} +.ui-state-error-text, +.ui-widget-content .ui-state-error-text, +.ui-widget-header .ui-state-error-text { + color: #5f3f3f; +} +.ui-priority-primary, +.ui-widget-content .ui-priority-primary, +.ui-widget-header .ui-priority-primary { + font-weight: bold; +} +.ui-priority-secondary, +.ui-widget-content .ui-priority-secondary, +.ui-widget-header .ui-priority-secondary { + opacity: .7; + filter:Alpha(Opacity=70); /* support: IE8 */ + font-weight: normal; +} +.ui-state-disabled, +.ui-widget-content .ui-state-disabled, +.ui-widget-header .ui-state-disabled { + opacity: .35; + filter:Alpha(Opacity=35); /* support: IE8 */ + background-image: none; +} +.ui-state-disabled .ui-icon { + filter:Alpha(Opacity=35); /* support: IE8 - See #6059 */ +} + +/* Icons +----------------------------------*/ + +/* states and images */ +.ui-icon { + width: 16px; + height: 16px; +} +.ui-icon, +.ui-widget-content .ui-icon { + background-image: url("images/ui-icons_444444_256x240.png"); +} +.ui-widget-header .ui-icon { + background-image: url("images/ui-icons_444444_256x240.png"); +} +.ui-state-hover .ui-icon, +.ui-state-focus .ui-icon, +.ui-button:hover .ui-icon, +.ui-button:focus .ui-icon { + background-image: url("images/ui-icons_555555_256x240.png"); +} +.ui-state-active .ui-icon, +.ui-button:active .ui-icon { + background-image: url("images/ui-icons_444444_256x240.png"); +} +.ui-state-highlight .ui-icon, +.ui-button .ui-state-highlight.ui-icon { + background-image: url("images/ui-icons_777620_256x240.png"); +} +.ui-state-error .ui-icon, +.ui-state-error-text .ui-icon { + background-image: url("images/ui-icons_cc0000_256x240.png"); +} +.ui-button .ui-icon { + background-image: url("images/ui-icons_777777_256x240.png"); +} + +/* positioning */ +.ui-icon-blank { background-position: 16px 16px; } +.ui-icon-caret-1-n { background-position: 0 0; } +.ui-icon-caret-1-ne { background-position: -16px 0; } +.ui-icon-caret-1-e { background-position: -32px 0; } +.ui-icon-caret-1-se { background-position: -48px 0; } +.ui-icon-caret-1-s { background-position: -65px 0; } +.ui-icon-caret-1-sw { background-position: -80px 0; } +.ui-icon-caret-1-w { background-position: -96px 0; } +.ui-icon-caret-1-nw { background-position: -112px 0; } +.ui-icon-caret-2-n-s { background-position: -128px 0; } +.ui-icon-caret-2-e-w { background-position: -144px 0; } +.ui-icon-triangle-1-n { background-position: 0 -16px; } +.ui-icon-triangle-1-ne { background-position: -16px -16px; } +.ui-icon-triangle-1-e { background-position: -32px -16px; } +.ui-icon-triangle-1-se { background-position: -48px -16px; } +.ui-icon-triangle-1-s { background-position: -65px -16px; } +.ui-icon-triangle-1-sw { background-position: -80px -16px; } +.ui-icon-triangle-1-w { background-position: -96px -16px; } +.ui-icon-triangle-1-nw { background-position: -112px -16px; } +.ui-icon-triangle-2-n-s { background-position: -128px -16px; } +.ui-icon-triangle-2-e-w { background-position: -144px -16px; } +.ui-icon-arrow-1-n { background-position: 0 -32px; } +.ui-icon-arrow-1-ne { background-position: -16px -32px; } +.ui-icon-arrow-1-e { background-position: -32px -32px; } +.ui-icon-arrow-1-se { background-position: -48px -32px; } +.ui-icon-arrow-1-s { background-position: -65px -32px; } +.ui-icon-arrow-1-sw { background-position: -80px -32px; } +.ui-icon-arrow-1-w { background-position: -96px -32px; } +.ui-icon-arrow-1-nw { background-position: -112px -32px; } +.ui-icon-arrow-2-n-s { background-position: -128px -32px; } +.ui-icon-arrow-2-ne-sw { background-position: -144px -32px; } +.ui-icon-arrow-2-e-w { background-position: -160px -32px; } +.ui-icon-arrow-2-se-nw { background-position: -176px -32px; } +.ui-icon-arrowstop-1-n { background-position: -192px -32px; } +.ui-icon-arrowstop-1-e { background-position: -208px -32px; } +.ui-icon-arrowstop-1-s { background-position: -224px -32px; } +.ui-icon-arrowstop-1-w { background-position: -240px -32px; } +.ui-icon-arrowthick-1-n { background-position: 1px -48px; } +.ui-icon-arrowthick-1-ne { background-position: -16px -48px; } +.ui-icon-arrowthick-1-e { background-position: -32px -48px; } +.ui-icon-arrowthick-1-se { background-position: -48px -48px; } +.ui-icon-arrowthick-1-s { background-position: -64px -48px; } +.ui-icon-arrowthick-1-sw { background-position: -80px -48px; } +.ui-icon-arrowthick-1-w { background-position: -96px -48px; } +.ui-icon-arrowthick-1-nw { background-position: -112px -48px; } +.ui-icon-arrowthick-2-n-s { background-position: -128px -48px; } +.ui-icon-arrowthick-2-ne-sw { background-position: -144px -48px; } +.ui-icon-arrowthick-2-e-w { background-position: -160px -48px; } +.ui-icon-arrowthick-2-se-nw { background-position: -176px -48px; } +.ui-icon-arrowthickstop-1-n { background-position: -192px -48px; } +.ui-icon-arrowthickstop-1-e { background-position: -208px -48px; } +.ui-icon-arrowthickstop-1-s { background-position: -224px -48px; } +.ui-icon-arrowthickstop-1-w { background-position: -240px -48px; } +.ui-icon-arrowreturnthick-1-w { background-position: 0 -64px; } +.ui-icon-arrowreturnthick-1-n { background-position: -16px -64px; } +.ui-icon-arrowreturnthick-1-e { background-position: -32px -64px; } +.ui-icon-arrowreturnthick-1-s { background-position: -48px -64px; } +.ui-icon-arrowreturn-1-w { background-position: -64px -64px; } +.ui-icon-arrowreturn-1-n { background-position: -80px -64px; } +.ui-icon-arrowreturn-1-e { background-position: -96px -64px; } +.ui-icon-arrowreturn-1-s { background-position: -112px -64px; } +.ui-icon-arrowrefresh-1-w { background-position: -128px -64px; } +.ui-icon-arrowrefresh-1-n { background-position: -144px -64px; } +.ui-icon-arrowrefresh-1-e { background-position: -160px -64px; } +.ui-icon-arrowrefresh-1-s { background-position: -176px -64px; } +.ui-icon-arrow-4 { background-position: 0 -80px; } +.ui-icon-arrow-4-diag { background-position: -16px -80px; } +.ui-icon-extlink { background-position: -32px -80px; } +.ui-icon-newwin { background-position: -48px -80px; } +.ui-icon-refresh { background-position: -64px -80px; } +.ui-icon-shuffle { background-position: -80px -80px; } +.ui-icon-transfer-e-w { background-position: -96px -80px; } +.ui-icon-transferthick-e-w { background-position: -112px -80px; } +.ui-icon-folder-collapsed { background-position: 0 -96px; } +.ui-icon-folder-open { background-position: -16px -96px; } +.ui-icon-document { background-position: -32px -96px; } +.ui-icon-document-b { background-position: -48px -96px; } +.ui-icon-note { background-position: -64px -96px; } +.ui-icon-mail-closed { background-position: -80px -96px; } +.ui-icon-mail-open { background-position: -96px -96px; } +.ui-icon-suitcase { background-position: -112px -96px; } +.ui-icon-comment { background-position: -128px -96px; } +.ui-icon-person { background-position: -144px -96px; } +.ui-icon-print { background-position: -160px -96px; } +.ui-icon-trash { background-position: -176px -96px; } +.ui-icon-locked { background-position: -192px -96px; } +.ui-icon-unlocked { background-position: -208px -96px; } +.ui-icon-bookmark { background-position: -224px -96px; } +.ui-icon-tag { background-position: -240px -96px; } +.ui-icon-home { background-position: 0 -112px; } +.ui-icon-flag { background-position: -16px -112px; } +.ui-icon-calendar { background-position: -32px -112px; } +.ui-icon-cart { background-position: -48px -112px; } +.ui-icon-pencil { background-position: -64px -112px; } +.ui-icon-clock { background-position: -80px -112px; } +.ui-icon-disk { background-position: -96px -112px; } +.ui-icon-calculator { background-position: -112px -112px; } +.ui-icon-zoomin { background-position: -128px -112px; } +.ui-icon-zoomout { background-position: -144px -112px; } +.ui-icon-search { background-position: -160px -112px; } +.ui-icon-wrench { background-position: -176px -112px; } +.ui-icon-gear { background-position: -192px -112px; } +.ui-icon-heart { background-position: -208px -112px; } +.ui-icon-star { background-position: -224px -112px; } +.ui-icon-link { background-position: -240px -112px; } +.ui-icon-cancel { background-position: 0 -128px; } +.ui-icon-plus { background-position: -16px -128px; } +.ui-icon-plusthick { background-position: -32px -128px; } +.ui-icon-minus { background-position: -48px -128px; } +.ui-icon-minusthick { background-position: -64px -128px; } +.ui-icon-close { background-position: -80px -128px; } +.ui-icon-closethick { background-position: -96px -128px; } +.ui-icon-key { background-position: -112px -128px; } +.ui-icon-lightbulb { background-position: -128px -128px; } +.ui-icon-scissors { background-position: -144px -128px; } +.ui-icon-clipboard { background-position: -160px -128px; } +.ui-icon-copy { background-position: -176px -128px; } +.ui-icon-contact { background-position: -192px -128px; } +.ui-icon-image { background-position: -208px -128px; } +.ui-icon-video { background-position: -224px -128px; } +.ui-icon-script { background-position: -240px -128px; } +.ui-icon-alert { background-position: 0 -144px; } +.ui-icon-info { background-position: -16px -144px; } +.ui-icon-notice { background-position: -32px -144px; } +.ui-icon-help { background-position: -48px -144px; } +.ui-icon-check { background-position: -64px -144px; } +.ui-icon-bullet { background-position: -80px -144px; } +.ui-icon-radio-on { background-position: -96px -144px; } +.ui-icon-radio-off { background-position: -112px -144px; } +.ui-icon-pin-w { background-position: -128px -144px; } +.ui-icon-pin-s { background-position: -144px -144px; } +.ui-icon-play { background-position: 0 -160px; } +.ui-icon-pause { background-position: -16px -160px; } +.ui-icon-seek-next { background-position: -32px -160px; } +.ui-icon-seek-prev { background-position: -48px -160px; } +.ui-icon-seek-end { background-position: -64px -160px; } +.ui-icon-seek-start { background-position: -80px -160px; } +/* ui-icon-seek-first is deprecated, use ui-icon-seek-start instead */ +.ui-icon-seek-first { background-position: -80px -160px; } +.ui-icon-stop { background-position: -96px -160px; } +.ui-icon-eject { background-position: -112px -160px; } +.ui-icon-volume-off { background-position: -128px -160px; } +.ui-icon-volume-on { background-position: -144px -160px; } +.ui-icon-power { background-position: 0 -176px; } +.ui-icon-signal-diag { background-position: -16px -176px; } +.ui-icon-signal { background-position: -32px -176px; } +.ui-icon-battery-0 { background-position: -48px -176px; } +.ui-icon-battery-1 { background-position: -64px -176px; } +.ui-icon-battery-2 { background-position: -80px -176px; } +.ui-icon-battery-3 { background-position: -96px -176px; } +.ui-icon-circle-plus { background-position: 0 -192px; } +.ui-icon-circle-minus { background-position: -16px -192px; } +.ui-icon-circle-close { background-position: -32px -192px; } +.ui-icon-circle-triangle-e { background-position: -48px -192px; } +.ui-icon-circle-triangle-s { background-position: -64px -192px; } +.ui-icon-circle-triangle-w { background-position: -80px -192px; } +.ui-icon-circle-triangle-n { background-position: -96px -192px; } +.ui-icon-circle-arrow-e { background-position: -112px -192px; } +.ui-icon-circle-arrow-s { background-position: -128px -192px; } +.ui-icon-circle-arrow-w { background-position: -144px -192px; } +.ui-icon-circle-arrow-n { background-position: -160px -192px; } +.ui-icon-circle-zoomin { background-position: -176px -192px; } +.ui-icon-circle-zoomout { background-position: -192px -192px; } +.ui-icon-circle-check { background-position: -208px -192px; } +.ui-icon-circlesmall-plus { background-position: 0 -208px; } +.ui-icon-circlesmall-minus { background-position: -16px -208px; } +.ui-icon-circlesmall-close { background-position: -32px -208px; } +.ui-icon-squaresmall-plus { background-position: -48px -208px; } +.ui-icon-squaresmall-minus { background-position: -64px -208px; } +.ui-icon-squaresmall-close { background-position: -80px -208px; } +.ui-icon-grip-dotted-vertical { background-position: 0 -224px; } +.ui-icon-grip-dotted-horizontal { background-position: -16px -224px; } +.ui-icon-grip-solid-vertical { background-position: -32px -224px; } +.ui-icon-grip-solid-horizontal { background-position: -48px -224px; } +.ui-icon-gripsmall-diagonal-se { background-position: -64px -224px; } +.ui-icon-grip-diagonal-se { background-position: -80px -224px; } + + +/* Misc visuals +----------------------------------*/ + +/* Corner radius */ +.ui-corner-all, +.ui-corner-top, +.ui-corner-left, +.ui-corner-tl { + border-top-left-radius: 3px; +} +.ui-corner-all, +.ui-corner-top, +.ui-corner-right, +.ui-corner-tr { + border-top-right-radius: 3px; +} +.ui-corner-all, +.ui-corner-bottom, +.ui-corner-left, +.ui-corner-bl { + border-bottom-left-radius: 3px; +} +.ui-corner-all, +.ui-corner-bottom, +.ui-corner-right, +.ui-corner-br { + border-bottom-right-radius: 3px; +} + +/* Overlays */ +.ui-widget-overlay { + background: #aaaaaa; + opacity: .3; + filter: Alpha(Opacity=30); /* support: IE8 */ +} +.ui-widget-shadow { + -webkit-box-shadow: 0px 0px 5px #666666; + box-shadow: 0px 0px 5px #666666; +} diff --git a/package/appserver/static/js/lib/jquery-ui/jquery-ui.js b/package/appserver/static/js/lib/jquery-ui/jquery-ui.js new file mode 100644 index 0000000000..fa736e8a04 --- /dev/null +++ b/package/appserver/static/js/lib/jquery-ui/jquery-ui.js @@ -0,0 +1,18706 @@ +/*! jQuery UI - v1.12.1 - 2017-08-27 +* http://jqueryui.com +* Includes: widget.js, position.js, data.js, disable-selection.js, focusable.js, form-reset-mixin.js, jquery-1-7.js, keycode.js, labels.js, scroll-parent.js, tabbable.js, unique-id.js, widgets/draggable.js, widgets/droppable.js, widgets/resizable.js, widgets/selectable.js, widgets/sortable.js, widgets/accordion.js, widgets/autocomplete.js, widgets/button.js, widgets/checkboxradio.js, widgets/controlgroup.js, widgets/datepicker.js, widgets/dialog.js, widgets/menu.js, widgets/mouse.js, widgets/progressbar.js, widgets/selectmenu.js, widgets/slider.js, widgets/spinner.js, widgets/tabs.js, widgets/tooltip.js, effect.js, effects/effect-blind.js, effects/effect-bounce.js, effects/effect-clip.js, effects/effect-drop.js, effects/effect-explode.js, effects/effect-fade.js, effects/effect-fold.js, effects/effect-highlight.js, effects/effect-puff.js, effects/effect-pulsate.js, effects/effect-scale.js, effects/effect-shake.js, effects/effect-size.js, effects/effect-slide.js, effects/effect-transfer.js +* Copyright jQuery Foundation and other contributors; Licensed MIT */ + +(function( factory ) { + if ( typeof define === "function" && define.amd ) { + + // AMD. Register as an anonymous module. + define([ "jquery" ], factory ); + } else { + + // Browser globals + factory( jQuery ); + } +}(function( $ ) { + +$.ui = $.ui || {}; + +var version = $.ui.version = "1.12.1"; + + +/*! + * jQuery UI Widget 1.12.1 + * http://jqueryui.com + * + * Copyright jQuery Foundation and other contributors + * Released under the MIT license. + * http://jquery.org/license + */ + +//>>label: Widget +//>>group: Core +//>>description: Provides a factory for creating stateful widgets with a common API. +//>>docs: http://api.jqueryui.com/jQuery.widget/ +//>>demos: http://jqueryui.com/widget/ + + + +var widgetUuid = 0; +var widgetSlice = Array.prototype.slice; + +$.cleanData = ( function( orig ) { + return function( elems ) { + var events, elem, i; + for ( i = 0; ( elem = elems[ i ] ) != null; i++ ) { + try { + + // Only trigger remove when necessary to save time + events = $._data( elem, "events" ); + if ( events && events.remove ) { + $( elem ).triggerHandler( "remove" ); + } + + // Http://bugs.jquery.com/ticket/8235 + } catch ( e ) {} + } + orig( elems ); + }; +} )( $.cleanData ); + +$.widget = function( name, base, prototype ) { + var existingConstructor, constructor, basePrototype; + + // ProxiedPrototype allows the provided prototype to remain unmodified + // so that it can be used as a mixin for multiple widgets (#8876) + var proxiedPrototype = {}; + + var namespace = name.split( "." )[ 0 ]; + name = name.split( "." )[ 1 ]; + var fullName = namespace + "-" + name; + + if ( !prototype ) { + prototype = base; + base = $.Widget; + } + + if ( $.isArray( prototype ) ) { + prototype = $.extend.apply( null, [ {} ].concat( prototype ) ); + } + + // Create selector for plugin + $.expr[ ":" ][ fullName.toLowerCase() ] = function( elem ) { + return !!$.data( elem, fullName ); + }; + + $[ namespace ] = $[ namespace ] || {}; + existingConstructor = $[ namespace ][ name ]; + constructor = $[ namespace ][ name ] = function( options, element ) { + + // Allow instantiation without "new" keyword + if ( !this._createWidget ) { + return new constructor( options, element ); + } + + // Allow instantiation without initializing for simple inheritance + // must use "new" keyword (the code above always passes args) + if ( arguments.length ) { + this._createWidget( options, element ); + } + }; + + // Extend with the existing constructor to carry over any static properties + $.extend( constructor, existingConstructor, { + version: prototype.version, + + // Copy the object used to create the prototype in case we need to + // redefine the widget later + _proto: $.extend( {}, prototype ), + + // Track widgets that inherit from this widget in case this widget is + // redefined after a widget inherits from it + _childConstructors: [] + } ); + + basePrototype = new base(); + + // We need to make the options hash a property directly on the new instance + // otherwise we'll modify the options hash on the prototype that we're + // inheriting from + basePrototype.options = $.widget.extend( {}, basePrototype.options ); + $.each( prototype, function( prop, value ) { + if ( !$.isFunction( value ) ) { + proxiedPrototype[ prop ] = value; + return; + } + proxiedPrototype[ prop ] = ( function() { + function _super() { + return base.prototype[ prop ].apply( this, arguments ); + } + + function _superApply( args ) { + return base.prototype[ prop ].apply( this, args ); + } + + return function() { + var __super = this._super; + var __superApply = this._superApply; + var returnValue; + + this._super = _super; + this._superApply = _superApply; + + returnValue = value.apply( this, arguments ); + + this._super = __super; + this._superApply = __superApply; + + return returnValue; + }; + } )(); + } ); + constructor.prototype = $.widget.extend( basePrototype, { + + // TODO: remove support for widgetEventPrefix + // always use the name + a colon as the prefix, e.g., draggable:start + // don't prefix for widgets that aren't DOM-based + widgetEventPrefix: existingConstructor ? ( basePrototype.widgetEventPrefix || name ) : name + }, proxiedPrototype, { + constructor: constructor, + namespace: namespace, + widgetName: name, + widgetFullName: fullName + } ); + + // If this widget is being redefined then we need to find all widgets that + // are inheriting from it and redefine all of them so that they inherit from + // the new version of this widget. We're essentially trying to replace one + // level in the prototype chain. + if ( existingConstructor ) { + $.each( existingConstructor._childConstructors, function( i, child ) { + var childPrototype = child.prototype; + + // Redefine the child widget using the same prototype that was + // originally used, but inherit from the new version of the base + $.widget( childPrototype.namespace + "." + childPrototype.widgetName, constructor, + child._proto ); + } ); + + // Remove the list of existing child constructors from the old constructor + // so the old child constructors can be garbage collected + delete existingConstructor._childConstructors; + } else { + base._childConstructors.push( constructor ); + } + + $.widget.bridge( name, constructor ); + + return constructor; +}; + +$.widget.extend = function( target ) { + var input = widgetSlice.call( arguments, 1 ); + var inputIndex = 0; + var inputLength = input.length; + var key; + var value; + + for ( ; inputIndex < inputLength; inputIndex++ ) { + for ( key in input[ inputIndex ] ) { + value = input[ inputIndex ][ key ]; + if ( input[ inputIndex ].hasOwnProperty( key ) && value !== undefined ) { + + // Clone objects + if ( $.isPlainObject( value ) ) { + target[ key ] = $.isPlainObject( target[ key ] ) ? + $.widget.extend( {}, target[ key ], value ) : + + // Don't extend strings, arrays, etc. with objects + $.widget.extend( {}, value ); + + // Copy everything else by reference + } else { + target[ key ] = value; + } + } + } + } + return target; +}; + +$.widget.bridge = function( name, object ) { + var fullName = object.prototype.widgetFullName || name; + $.fn[ name ] = function( options ) { + var isMethodCall = typeof options === "string"; + var args = widgetSlice.call( arguments, 1 ); + var returnValue = this; + + if ( isMethodCall ) { + + // If this is an empty collection, we need to have the instance method + // return undefined instead of the jQuery instance + if ( !this.length && options === "instance" ) { + returnValue = undefined; + } else { + this.each( function() { + var methodValue; + var instance = $.data( this, fullName ); + + if ( options === "instance" ) { + returnValue = instance; + return false; + } + + if ( !instance ) { + return $.error( "cannot call methods on " + name + + " prior to initialization; " + + "attempted to call method '" + options + "'" ); + } + + if ( !$.isFunction( instance[ options ] ) || options.charAt( 0 ) === "_" ) { + return $.error( "no such method '" + options + "' for " + name + + " widget instance" ); + } + + methodValue = instance[ options ].apply( instance, args ); + + if ( methodValue !== instance && methodValue !== undefined ) { + returnValue = methodValue && methodValue.jquery ? + returnValue.pushStack( methodValue.get() ) : + methodValue; + return false; + } + } ); + } + } else { + + // Allow multiple hashes to be passed on init + if ( args.length ) { + options = $.widget.extend.apply( null, [ options ].concat( args ) ); + } + + this.each( function() { + var instance = $.data( this, fullName ); + if ( instance ) { + instance.option( options || {} ); + if ( instance._init ) { + instance._init(); + } + } else { + $.data( this, fullName, new object( options, this ) ); + } + } ); + } + + return returnValue; + }; +}; + +$.Widget = function( /* options, element */ ) {}; +$.Widget._childConstructors = []; + +$.Widget.prototype = { + widgetName: "widget", + widgetEventPrefix: "", + defaultElement: "
    ", + + options: { + classes: {}, + disabled: false, + + // Callbacks + create: null + }, + + _createWidget: function( options, element ) { + element = $( element || this.defaultElement || this )[ 0 ]; + this.element = $( element ); + this.uuid = widgetUuid++; + this.eventNamespace = "." + this.widgetName + this.uuid; + + this.bindings = $(); + this.hoverable = $(); + this.focusable = $(); + this.classesElementLookup = {}; + + if ( element !== this ) { + $.data( element, this.widgetFullName, this ); + this._on( true, this.element, { + remove: function( event ) { + if ( event.target === element ) { + this.destroy(); + } + } + } ); + this.document = $( element.style ? + + // Element within the document + element.ownerDocument : + + // Element is window or document + element.document || element ); + this.window = $( this.document[ 0 ].defaultView || this.document[ 0 ].parentWindow ); + } + + this.options = $.widget.extend( {}, + this.options, + this._getCreateOptions(), + options ); + + this._create(); + + if ( this.options.disabled ) { + this._setOptionDisabled( this.options.disabled ); + } + + this._trigger( "create", null, this._getCreateEventData() ); + this._init(); + }, + + _getCreateOptions: function() { + return {}; + }, + + _getCreateEventData: $.noop, + + _create: $.noop, + + _init: $.noop, + + destroy: function() { + var that = this; + + this._destroy(); + $.each( this.classesElementLookup, function( key, value ) { + that._removeClass( value, key ); + } ); + + // We can probably remove the unbind calls in 2.0 + // all event bindings should go through this._on() + this.element + .off( this.eventNamespace ) + .removeData( this.widgetFullName ); + this.widget() + .off( this.eventNamespace ) + .removeAttr( "aria-disabled" ); + + // Clean up events and states + this.bindings.off( this.eventNamespace ); + }, + + _destroy: $.noop, + + widget: function() { + return this.element; + }, + + option: function( key, value ) { + var options = key; + var parts; + var curOption; + var i; + + if ( arguments.length === 0 ) { + + // Don't return a reference to the internal hash + return $.widget.extend( {}, this.options ); + } + + if ( typeof key === "string" ) { + + // Handle nested keys, e.g., "foo.bar" => { foo: { bar: ___ } } + options = {}; + parts = key.split( "." ); + key = parts.shift(); + if ( parts.length ) { + curOption = options[ key ] = $.widget.extend( {}, this.options[ key ] ); + for ( i = 0; i < parts.length - 1; i++ ) { + curOption[ parts[ i ] ] = curOption[ parts[ i ] ] || {}; + curOption = curOption[ parts[ i ] ]; + } + key = parts.pop(); + if ( arguments.length === 1 ) { + return curOption[ key ] === undefined ? null : curOption[ key ]; + } + curOption[ key ] = value; + } else { + if ( arguments.length === 1 ) { + return this.options[ key ] === undefined ? null : this.options[ key ]; + } + options[ key ] = value; + } + } + + this._setOptions( options ); + + return this; + }, + + _setOptions: function( options ) { + var key; + + for ( key in options ) { + this._setOption( key, options[ key ] ); + } + + return this; + }, + + _setOption: function( key, value ) { + if ( key === "classes" ) { + this._setOptionClasses( value ); + } + + this.options[ key ] = value; + + if ( key === "disabled" ) { + this._setOptionDisabled( value ); + } + + return this; + }, + + _setOptionClasses: function( value ) { + var classKey, elements, currentElements; + + for ( classKey in value ) { + currentElements = this.classesElementLookup[ classKey ]; + if ( value[ classKey ] === this.options.classes[ classKey ] || + !currentElements || + !currentElements.length ) { + continue; + } + + // We are doing this to create a new jQuery object because the _removeClass() call + // on the next line is going to destroy the reference to the current elements being + // tracked. We need to save a copy of this collection so that we can add the new classes + // below. + elements = $( currentElements.get() ); + this._removeClass( currentElements, classKey ); + + // We don't use _addClass() here, because that uses this.options.classes + // for generating the string of classes. We want to use the value passed in from + // _setOption(), this is the new value of the classes option which was passed to + // _setOption(). We pass this value directly to _classes(). + elements.addClass( this._classes( { + element: elements, + keys: classKey, + classes: value, + add: true + } ) ); + } + }, + + _setOptionDisabled: function( value ) { + this._toggleClass( this.widget(), this.widgetFullName + "-disabled", null, !!value ); + + // If the widget is becoming disabled, then nothing is interactive + if ( value ) { + this._removeClass( this.hoverable, null, "ui-state-hover" ); + this._removeClass( this.focusable, null, "ui-state-focus" ); + } + }, + + enable: function() { + return this._setOptions( { disabled: false } ); + }, + + disable: function() { + return this._setOptions( { disabled: true } ); + }, + + _classes: function( options ) { + var full = []; + var that = this; + + options = $.extend( { + element: this.element, + classes: this.options.classes || {} + }, options ); + + function processClassString( classes, checkOption ) { + var current, i; + for ( i = 0; i < classes.length; i++ ) { + current = that.classesElementLookup[ classes[ i ] ] || $(); + if ( options.add ) { + current = $( $.unique( current.get().concat( options.element.get() ) ) ); + } else { + current = $( current.not( options.element ).get() ); + } + that.classesElementLookup[ classes[ i ] ] = current; + full.push( classes[ i ] ); + if ( checkOption && options.classes[ classes[ i ] ] ) { + full.push( options.classes[ classes[ i ] ] ); + } + } + } + + this._on( options.element, { + "remove": "_untrackClassesElement" + } ); + + if ( options.keys ) { + processClassString( options.keys.match( /\S+/g ) || [], true ); + } + if ( options.extra ) { + processClassString( options.extra.match( /\S+/g ) || [] ); + } + + return full.join( " " ); + }, + + _untrackClassesElement: function( event ) { + var that = this; + $.each( that.classesElementLookup, function( key, value ) { + if ( $.inArray( event.target, value ) !== -1 ) { + that.classesElementLookup[ key ] = $( value.not( event.target ).get() ); + } + } ); + }, + + _removeClass: function( element, keys, extra ) { + return this._toggleClass( element, keys, extra, false ); + }, + + _addClass: function( element, keys, extra ) { + return this._toggleClass( element, keys, extra, true ); + }, + + _toggleClass: function( element, keys, extra, add ) { + add = ( typeof add === "boolean" ) ? add : extra; + var shift = ( typeof element === "string" || element === null ), + options = { + extra: shift ? keys : extra, + keys: shift ? element : keys, + element: shift ? this.element : element, + add: add + }; + options.element.toggleClass( this._classes( options ), add ); + return this; + }, + + _on: function( suppressDisabledCheck, element, handlers ) { + var delegateElement; + var instance = this; + + // No suppressDisabledCheck flag, shuffle arguments + if ( typeof suppressDisabledCheck !== "boolean" ) { + handlers = element; + element = suppressDisabledCheck; + suppressDisabledCheck = false; + } + + // No element argument, shuffle and use this.element + if ( !handlers ) { + handlers = element; + element = this.element; + delegateElement = this.widget(); + } else { + element = delegateElement = $( element ); + this.bindings = this.bindings.add( element ); + } + + $.each( handlers, function( event, handler ) { + function handlerProxy() { + + // Allow widgets to customize the disabled handling + // - disabled as an array instead of boolean + // - disabled class as method for disabling individual parts + if ( !suppressDisabledCheck && + ( instance.options.disabled === true || + $( this ).hasClass( "ui-state-disabled" ) ) ) { + return; + } + return ( typeof handler === "string" ? instance[ handler ] : handler ) + .apply( instance, arguments ); + } + + // Copy the guid so direct unbinding works + if ( typeof handler !== "string" ) { + handlerProxy.guid = handler.guid = + handler.guid || handlerProxy.guid || $.guid++; + } + + var match = event.match( /^([\w:-]*)\s*(.*)$/ ); + var eventName = match[ 1 ] + instance.eventNamespace; + var selector = match[ 2 ]; + + if ( selector ) { + delegateElement.on( eventName, selector, handlerProxy ); + } else { + element.on( eventName, handlerProxy ); + } + } ); + }, + + _off: function( element, eventName ) { + eventName = ( eventName || "" ).split( " " ).join( this.eventNamespace + " " ) + + this.eventNamespace; + element.off( eventName ).off( eventName ); + + // Clear the stack to avoid memory leaks (#10056) + this.bindings = $( this.bindings.not( element ).get() ); + this.focusable = $( this.focusable.not( element ).get() ); + this.hoverable = $( this.hoverable.not( element ).get() ); + }, + + _delay: function( handler, delay ) { + function handlerProxy() { + return ( typeof handler === "string" ? instance[ handler ] : handler ) + .apply( instance, arguments ); + } + var instance = this; + return setTimeout( handlerProxy, delay || 0 ); + }, + + _hoverable: function( element ) { + this.hoverable = this.hoverable.add( element ); + this._on( element, { + mouseenter: function( event ) { + this._addClass( $( event.currentTarget ), null, "ui-state-hover" ); + }, + mouseleave: function( event ) { + this._removeClass( $( event.currentTarget ), null, "ui-state-hover" ); + } + } ); + }, + + _focusable: function( element ) { + this.focusable = this.focusable.add( element ); + this._on( element, { + focusin: function( event ) { + this._addClass( $( event.currentTarget ), null, "ui-state-focus" ); + }, + focusout: function( event ) { + this._removeClass( $( event.currentTarget ), null, "ui-state-focus" ); + } + } ); + }, + + _trigger: function( type, event, data ) { + var prop, orig; + var callback = this.options[ type ]; + + data = data || {}; + event = $.Event( event ); + event.type = ( type === this.widgetEventPrefix ? + type : + this.widgetEventPrefix + type ).toLowerCase(); + + // The original event may come from any element + // so we need to reset the target on the new event + event.target = this.element[ 0 ]; + + // Copy original event properties over to the new event + orig = event.originalEvent; + if ( orig ) { + for ( prop in orig ) { + if ( !( prop in event ) ) { + event[ prop ] = orig[ prop ]; + } + } + } + + this.element.trigger( event, data ); + return !( $.isFunction( callback ) && + callback.apply( this.element[ 0 ], [ event ].concat( data ) ) === false || + event.isDefaultPrevented() ); + } +}; + +$.each( { show: "fadeIn", hide: "fadeOut" }, function( method, defaultEffect ) { + $.Widget.prototype[ "_" + method ] = function( element, options, callback ) { + if ( typeof options === "string" ) { + options = { effect: options }; + } + + var hasOptions; + var effectName = !options ? + method : + options === true || typeof options === "number" ? + defaultEffect : + options.effect || defaultEffect; + + options = options || {}; + if ( typeof options === "number" ) { + options = { duration: options }; + } + + hasOptions = !$.isEmptyObject( options ); + options.complete = callback; + + if ( options.delay ) { + element.delay( options.delay ); + } + + if ( hasOptions && $.effects && $.effects.effect[ effectName ] ) { + element[ method ]( options ); + } else if ( effectName !== method && element[ effectName ] ) { + element[ effectName ]( options.duration, options.easing, callback ); + } else { + element.queue( function( next ) { + $( this )[ method ](); + if ( callback ) { + callback.call( element[ 0 ] ); + } + next(); + } ); + } + }; +} ); + +var widget = $.widget; + + +/*! + * jQuery UI Position 1.12.1 + * http://jqueryui.com + * + * Copyright jQuery Foundation and other contributors + * Released under the MIT license. + * http://jquery.org/license + * + * http://api.jqueryui.com/position/ + */ + +//>>label: Position +//>>group: Core +//>>description: Positions elements relative to other elements. +//>>docs: http://api.jqueryui.com/position/ +//>>demos: http://jqueryui.com/position/ + + +( function() { +var cachedScrollbarWidth, + max = Math.max, + abs = Math.abs, + rhorizontal = /left|center|right/, + rvertical = /top|center|bottom/, + roffset = /[\+\-]\d+(\.[\d]+)?%?/, + rposition = /^\w+/, + rpercent = /%$/, + _position = $.fn.position; + +function getOffsets( offsets, width, height ) { + return [ + parseFloat( offsets[ 0 ] ) * ( rpercent.test( offsets[ 0 ] ) ? width / 100 : 1 ), + parseFloat( offsets[ 1 ] ) * ( rpercent.test( offsets[ 1 ] ) ? height / 100 : 1 ) + ]; +} + +function parseCss( element, property ) { + return parseInt( $.css( element, property ), 10 ) || 0; +} + +function getDimensions( elem ) { + var raw = elem[ 0 ]; + if ( raw.nodeType === 9 ) { + return { + width: elem.width(), + height: elem.height(), + offset: { top: 0, left: 0 } + }; + } + if ( $.isWindow( raw ) ) { + return { + width: elem.width(), + height: elem.height(), + offset: { top: elem.scrollTop(), left: elem.scrollLeft() } + }; + } + if ( raw.preventDefault ) { + return { + width: 0, + height: 0, + offset: { top: raw.pageY, left: raw.pageX } + }; + } + return { + width: elem.outerWidth(), + height: elem.outerHeight(), + offset: elem.offset() + }; +} + +$.position = { + scrollbarWidth: function() { + if ( cachedScrollbarWidth !== undefined ) { + return cachedScrollbarWidth; + } + var w1, w2, + div = $( "
    " + + "
    " ), + innerDiv = div.children()[ 0 ]; + + $( "body" ).append( div ); + w1 = innerDiv.offsetWidth; + div.css( "overflow", "scroll" ); + + w2 = innerDiv.offsetWidth; + + if ( w1 === w2 ) { + w2 = div[ 0 ].clientWidth; + } + + div.remove(); + + return ( cachedScrollbarWidth = w1 - w2 ); + }, + getScrollInfo: function( within ) { + var overflowX = within.isWindow || within.isDocument ? "" : + within.element.css( "overflow-x" ), + overflowY = within.isWindow || within.isDocument ? "" : + within.element.css( "overflow-y" ), + hasOverflowX = overflowX === "scroll" || + ( overflowX === "auto" && within.width < within.element[ 0 ].scrollWidth ), + hasOverflowY = overflowY === "scroll" || + ( overflowY === "auto" && within.height < within.element[ 0 ].scrollHeight ); + return { + width: hasOverflowY ? $.position.scrollbarWidth() : 0, + height: hasOverflowX ? $.position.scrollbarWidth() : 0 + }; + }, + getWithinInfo: function( element ) { + var withinElement = $( element || window ), + isWindow = $.isWindow( withinElement[ 0 ] ), + isDocument = !!withinElement[ 0 ] && withinElement[ 0 ].nodeType === 9, + hasOffset = !isWindow && !isDocument; + return { + element: withinElement, + isWindow: isWindow, + isDocument: isDocument, + offset: hasOffset ? $( element ).offset() : { left: 0, top: 0 }, + scrollLeft: withinElement.scrollLeft(), + scrollTop: withinElement.scrollTop(), + width: withinElement.outerWidth(), + height: withinElement.outerHeight() + }; + } +}; + +$.fn.position = function( options ) { + if ( !options || !options.of ) { + return _position.apply( this, arguments ); + } + + // Make a copy, we don't want to modify arguments + options = $.extend( {}, options ); + + var atOffset, targetWidth, targetHeight, targetOffset, basePosition, dimensions, + target = $( options.of ), + within = $.position.getWithinInfo( options.within ), + scrollInfo = $.position.getScrollInfo( within ), + collision = ( options.collision || "flip" ).split( " " ), + offsets = {}; + + dimensions = getDimensions( target ); + if ( target[ 0 ].preventDefault ) { + + // Force left top to allow flipping + options.at = "left top"; + } + targetWidth = dimensions.width; + targetHeight = dimensions.height; + targetOffset = dimensions.offset; + + // Clone to reuse original targetOffset later + basePosition = $.extend( {}, targetOffset ); + + // Force my and at to have valid horizontal and vertical positions + // if a value is missing or invalid, it will be converted to center + $.each( [ "my", "at" ], function() { + var pos = ( options[ this ] || "" ).split( " " ), + horizontalOffset, + verticalOffset; + + if ( pos.length === 1 ) { + pos = rhorizontal.test( pos[ 0 ] ) ? + pos.concat( [ "center" ] ) : + rvertical.test( pos[ 0 ] ) ? + [ "center" ].concat( pos ) : + [ "center", "center" ]; + } + pos[ 0 ] = rhorizontal.test( pos[ 0 ] ) ? pos[ 0 ] : "center"; + pos[ 1 ] = rvertical.test( pos[ 1 ] ) ? pos[ 1 ] : "center"; + + // Calculate offsets + horizontalOffset = roffset.exec( pos[ 0 ] ); + verticalOffset = roffset.exec( pos[ 1 ] ); + offsets[ this ] = [ + horizontalOffset ? horizontalOffset[ 0 ] : 0, + verticalOffset ? verticalOffset[ 0 ] : 0 + ]; + + // Reduce to just the positions without the offsets + options[ this ] = [ + rposition.exec( pos[ 0 ] )[ 0 ], + rposition.exec( pos[ 1 ] )[ 0 ] + ]; + } ); + + // Normalize collision option + if ( collision.length === 1 ) { + collision[ 1 ] = collision[ 0 ]; + } + + if ( options.at[ 0 ] === "right" ) { + basePosition.left += targetWidth; + } else if ( options.at[ 0 ] === "center" ) { + basePosition.left += targetWidth / 2; + } + + if ( options.at[ 1 ] === "bottom" ) { + basePosition.top += targetHeight; + } else if ( options.at[ 1 ] === "center" ) { + basePosition.top += targetHeight / 2; + } + + atOffset = getOffsets( offsets.at, targetWidth, targetHeight ); + basePosition.left += atOffset[ 0 ]; + basePosition.top += atOffset[ 1 ]; + + return this.each( function() { + var collisionPosition, using, + elem = $( this ), + elemWidth = elem.outerWidth(), + elemHeight = elem.outerHeight(), + marginLeft = parseCss( this, "marginLeft" ), + marginTop = parseCss( this, "marginTop" ), + collisionWidth = elemWidth + marginLeft + parseCss( this, "marginRight" ) + + scrollInfo.width, + collisionHeight = elemHeight + marginTop + parseCss( this, "marginBottom" ) + + scrollInfo.height, + position = $.extend( {}, basePosition ), + myOffset = getOffsets( offsets.my, elem.outerWidth(), elem.outerHeight() ); + + if ( options.my[ 0 ] === "right" ) { + position.left -= elemWidth; + } else if ( options.my[ 0 ] === "center" ) { + position.left -= elemWidth / 2; + } + + if ( options.my[ 1 ] === "bottom" ) { + position.top -= elemHeight; + } else if ( options.my[ 1 ] === "center" ) { + position.top -= elemHeight / 2; + } + + position.left += myOffset[ 0 ]; + position.top += myOffset[ 1 ]; + + collisionPosition = { + marginLeft: marginLeft, + marginTop: marginTop + }; + + $.each( [ "left", "top" ], function( i, dir ) { + if ( $.ui.position[ collision[ i ] ] ) { + $.ui.position[ collision[ i ] ][ dir ]( position, { + targetWidth: targetWidth, + targetHeight: targetHeight, + elemWidth: elemWidth, + elemHeight: elemHeight, + collisionPosition: collisionPosition, + collisionWidth: collisionWidth, + collisionHeight: collisionHeight, + offset: [ atOffset[ 0 ] + myOffset[ 0 ], atOffset [ 1 ] + myOffset[ 1 ] ], + my: options.my, + at: options.at, + within: within, + elem: elem + } ); + } + } ); + + if ( options.using ) { + + // Adds feedback as second argument to using callback, if present + using = function( props ) { + var left = targetOffset.left - position.left, + right = left + targetWidth - elemWidth, + top = targetOffset.top - position.top, + bottom = top + targetHeight - elemHeight, + feedback = { + target: { + element: target, + left: targetOffset.left, + top: targetOffset.top, + width: targetWidth, + height: targetHeight + }, + element: { + element: elem, + left: position.left, + top: position.top, + width: elemWidth, + height: elemHeight + }, + horizontal: right < 0 ? "left" : left > 0 ? "right" : "center", + vertical: bottom < 0 ? "top" : top > 0 ? "bottom" : "middle" + }; + if ( targetWidth < elemWidth && abs( left + right ) < targetWidth ) { + feedback.horizontal = "center"; + } + if ( targetHeight < elemHeight && abs( top + bottom ) < targetHeight ) { + feedback.vertical = "middle"; + } + if ( max( abs( left ), abs( right ) ) > max( abs( top ), abs( bottom ) ) ) { + feedback.important = "horizontal"; + } else { + feedback.important = "vertical"; + } + options.using.call( this, props, feedback ); + }; + } + + elem.offset( $.extend( position, { using: using } ) ); + } ); +}; + +$.ui.position = { + fit: { + left: function( position, data ) { + var within = data.within, + withinOffset = within.isWindow ? within.scrollLeft : within.offset.left, + outerWidth = within.width, + collisionPosLeft = position.left - data.collisionPosition.marginLeft, + overLeft = withinOffset - collisionPosLeft, + overRight = collisionPosLeft + data.collisionWidth - outerWidth - withinOffset, + newOverRight; + + // Element is wider than within + if ( data.collisionWidth > outerWidth ) { + + // Element is initially over the left side of within + if ( overLeft > 0 && overRight <= 0 ) { + newOverRight = position.left + overLeft + data.collisionWidth - outerWidth - + withinOffset; + position.left += overLeft - newOverRight; + + // Element is initially over right side of within + } else if ( overRight > 0 && overLeft <= 0 ) { + position.left = withinOffset; + + // Element is initially over both left and right sides of within + } else { + if ( overLeft > overRight ) { + position.left = withinOffset + outerWidth - data.collisionWidth; + } else { + position.left = withinOffset; + } + } + + // Too far left -> align with left edge + } else if ( overLeft > 0 ) { + position.left += overLeft; + + // Too far right -> align with right edge + } else if ( overRight > 0 ) { + position.left -= overRight; + + // Adjust based on position and margin + } else { + position.left = max( position.left - collisionPosLeft, position.left ); + } + }, + top: function( position, data ) { + var within = data.within, + withinOffset = within.isWindow ? within.scrollTop : within.offset.top, + outerHeight = data.within.height, + collisionPosTop = position.top - data.collisionPosition.marginTop, + overTop = withinOffset - collisionPosTop, + overBottom = collisionPosTop + data.collisionHeight - outerHeight - withinOffset, + newOverBottom; + + // Element is taller than within + if ( data.collisionHeight > outerHeight ) { + + // Element is initially over the top of within + if ( overTop > 0 && overBottom <= 0 ) { + newOverBottom = position.top + overTop + data.collisionHeight - outerHeight - + withinOffset; + position.top += overTop - newOverBottom; + + // Element is initially over bottom of within + } else if ( overBottom > 0 && overTop <= 0 ) { + position.top = withinOffset; + + // Element is initially over both top and bottom of within + } else { + if ( overTop > overBottom ) { + position.top = withinOffset + outerHeight - data.collisionHeight; + } else { + position.top = withinOffset; + } + } + + // Too far up -> align with top + } else if ( overTop > 0 ) { + position.top += overTop; + + // Too far down -> align with bottom edge + } else if ( overBottom > 0 ) { + position.top -= overBottom; + + // Adjust based on position and margin + } else { + position.top = max( position.top - collisionPosTop, position.top ); + } + } + }, + flip: { + left: function( position, data ) { + var within = data.within, + withinOffset = within.offset.left + within.scrollLeft, + outerWidth = within.width, + offsetLeft = within.isWindow ? within.scrollLeft : within.offset.left, + collisionPosLeft = position.left - data.collisionPosition.marginLeft, + overLeft = collisionPosLeft - offsetLeft, + overRight = collisionPosLeft + data.collisionWidth - outerWidth - offsetLeft, + myOffset = data.my[ 0 ] === "left" ? + -data.elemWidth : + data.my[ 0 ] === "right" ? + data.elemWidth : + 0, + atOffset = data.at[ 0 ] === "left" ? + data.targetWidth : + data.at[ 0 ] === "right" ? + -data.targetWidth : + 0, + offset = -2 * data.offset[ 0 ], + newOverRight, + newOverLeft; + + if ( overLeft < 0 ) { + newOverRight = position.left + myOffset + atOffset + offset + data.collisionWidth - + outerWidth - withinOffset; + if ( newOverRight < 0 || newOverRight < abs( overLeft ) ) { + position.left += myOffset + atOffset + offset; + } + } else if ( overRight > 0 ) { + newOverLeft = position.left - data.collisionPosition.marginLeft + myOffset + + atOffset + offset - offsetLeft; + if ( newOverLeft > 0 || abs( newOverLeft ) < overRight ) { + position.left += myOffset + atOffset + offset; + } + } + }, + top: function( position, data ) { + var within = data.within, + withinOffset = within.offset.top + within.scrollTop, + outerHeight = within.height, + offsetTop = within.isWindow ? within.scrollTop : within.offset.top, + collisionPosTop = position.top - data.collisionPosition.marginTop, + overTop = collisionPosTop - offsetTop, + overBottom = collisionPosTop + data.collisionHeight - outerHeight - offsetTop, + top = data.my[ 1 ] === "top", + myOffset = top ? + -data.elemHeight : + data.my[ 1 ] === "bottom" ? + data.elemHeight : + 0, + atOffset = data.at[ 1 ] === "top" ? + data.targetHeight : + data.at[ 1 ] === "bottom" ? + -data.targetHeight : + 0, + offset = -2 * data.offset[ 1 ], + newOverTop, + newOverBottom; + if ( overTop < 0 ) { + newOverBottom = position.top + myOffset + atOffset + offset + data.collisionHeight - + outerHeight - withinOffset; + if ( newOverBottom < 0 || newOverBottom < abs( overTop ) ) { + position.top += myOffset + atOffset + offset; + } + } else if ( overBottom > 0 ) { + newOverTop = position.top - data.collisionPosition.marginTop + myOffset + atOffset + + offset - offsetTop; + if ( newOverTop > 0 || abs( newOverTop ) < overBottom ) { + position.top += myOffset + atOffset + offset; + } + } + } + }, + flipfit: { + left: function() { + $.ui.position.flip.left.apply( this, arguments ); + $.ui.position.fit.left.apply( this, arguments ); + }, + top: function() { + $.ui.position.flip.top.apply( this, arguments ); + $.ui.position.fit.top.apply( this, arguments ); + } + } +}; + +} )(); + +var position = $.ui.position; + + +/*! + * jQuery UI :data 1.12.1 + * http://jqueryui.com + * + * Copyright jQuery Foundation and other contributors + * Released under the MIT license. + * http://jquery.org/license + */ + +//>>label: :data Selector +//>>group: Core +//>>description: Selects elements which have data stored under the specified key. +//>>docs: http://api.jqueryui.com/data-selector/ + + +var data = $.extend( $.expr[ ":" ], { + data: $.expr.createPseudo ? + $.expr.createPseudo( function( dataName ) { + return function( elem ) { + return !!$.data( elem, dataName ); + }; + } ) : + + // Support: jQuery <1.8 + function( elem, i, match ) { + return !!$.data( elem, match[ 3 ] ); + } +} ); + +/*! + * jQuery UI Disable Selection 1.12.1 + * http://jqueryui.com + * + * Copyright jQuery Foundation and other contributors + * Released under the MIT license. + * http://jquery.org/license + */ + +//>>label: disableSelection +//>>group: Core +//>>description: Disable selection of text content within the set of matched elements. +//>>docs: http://api.jqueryui.com/disableSelection/ + +// This file is deprecated + + +var disableSelection = $.fn.extend( { + disableSelection: ( function() { + var eventType = "onselectstart" in document.createElement( "div" ) ? + "selectstart" : + "mousedown"; + + return function() { + return this.on( eventType + ".ui-disableSelection", function( event ) { + event.preventDefault(); + } ); + }; + } )(), + + enableSelection: function() { + return this.off( ".ui-disableSelection" ); + } +} ); + + +/*! + * jQuery UI Focusable 1.12.1 + * http://jqueryui.com + * + * Copyright jQuery Foundation and other contributors + * Released under the MIT license. + * http://jquery.org/license + */ + +//>>label: :focusable Selector +//>>group: Core +//>>description: Selects elements which can be focused. +//>>docs: http://api.jqueryui.com/focusable-selector/ + + + +// Selectors +$.ui.focusable = function( element, hasTabindex ) { + var map, mapName, img, focusableIfVisible, fieldset, + nodeName = element.nodeName.toLowerCase(); + + if ( "area" === nodeName ) { + map = element.parentNode; + mapName = map.name; + if ( !element.href || !mapName || map.nodeName.toLowerCase() !== "map" ) { + return false; + } + img = $( "img[usemap='#" + mapName + "']" ); + return img.length > 0 && img.is( ":visible" ); + } + + if ( /^(input|select|textarea|button|object)$/.test( nodeName ) ) { + focusableIfVisible = !element.disabled; + + if ( focusableIfVisible ) { + + // Form controls within a disabled fieldset are disabled. + // However, controls within the fieldset's legend do not get disabled. + // Since controls generally aren't placed inside legends, we skip + // this portion of the check. + fieldset = $( element ).closest( "fieldset" )[ 0 ]; + if ( fieldset ) { + focusableIfVisible = !fieldset.disabled; + } + } + } else if ( "a" === nodeName ) { + focusableIfVisible = element.href || hasTabindex; + } else { + focusableIfVisible = hasTabindex; + } + + return focusableIfVisible && $( element ).is( ":visible" ) && visible( $( element ) ); +}; + +// Support: IE 8 only +// IE 8 doesn't resolve inherit to visible/hidden for computed values +function visible( element ) { + var visibility = element.css( "visibility" ); + while ( visibility === "inherit" ) { + element = element.parent(); + visibility = element.css( "visibility" ); + } + return visibility !== "hidden"; +} + +$.extend( $.expr[ ":" ], { + focusable: function( element ) { + return $.ui.focusable( element, $.attr( element, "tabindex" ) != null ); + } +} ); + +var focusable = $.ui.focusable; + + + + +// Support: IE8 Only +// IE8 does not support the form attribute and when it is supplied. It overwrites the form prop +// with a string, so we need to find the proper form. +var form = $.fn.form = function() { + return typeof this[ 0 ].form === "string" ? this.closest( "form" ) : $( this[ 0 ].form ); +}; + + +/*! + * jQuery UI Form Reset Mixin 1.12.1 + * http://jqueryui.com + * + * Copyright jQuery Foundation and other contributors + * Released under the MIT license. + * http://jquery.org/license + */ + +//>>label: Form Reset Mixin +//>>group: Core +//>>description: Refresh input widgets when their form is reset +//>>docs: http://api.jqueryui.com/form-reset-mixin/ + + + +var formResetMixin = $.ui.formResetMixin = { + _formResetHandler: function() { + var form = $( this ); + + // Wait for the form reset to actually happen before refreshing + setTimeout( function() { + var instances = form.data( "ui-form-reset-instances" ); + $.each( instances, function() { + this.refresh(); + } ); + } ); + }, + + _bindFormResetHandler: function() { + this.form = this.element.form(); + if ( !this.form.length ) { + return; + } + + var instances = this.form.data( "ui-form-reset-instances" ) || []; + if ( !instances.length ) { + + // We don't use _on() here because we use a single event handler per form + this.form.on( "reset.ui-form-reset", this._formResetHandler ); + } + instances.push( this ); + this.form.data( "ui-form-reset-instances", instances ); + }, + + _unbindFormResetHandler: function() { + if ( !this.form.length ) { + return; + } + + var instances = this.form.data( "ui-form-reset-instances" ); + instances.splice( $.inArray( this, instances ), 1 ); + if ( instances.length ) { + this.form.data( "ui-form-reset-instances", instances ); + } else { + this.form + .removeData( "ui-form-reset-instances" ) + .off( "reset.ui-form-reset" ); + } + } +}; + + +/*! + * jQuery UI Support for jQuery core 1.7.x 1.12.1 + * http://jqueryui.com + * + * Copyright jQuery Foundation and other contributors + * Released under the MIT license. + * http://jquery.org/license + * + */ + +//>>label: jQuery 1.7 Support +//>>group: Core +//>>description: Support version 1.7.x of jQuery core + + + +// Support: jQuery 1.7 only +// Not a great way to check versions, but since we only support 1.7+ and only +// need to detect <1.8, this is a simple check that should suffice. Checking +// for "1.7." would be a bit safer, but the version string is 1.7, not 1.7.0 +// and we'll never reach 1.70.0 (if we do, we certainly won't be supporting +// 1.7 anymore). See #11197 for why we're not using feature detection. +if ( $.fn.jquery.substring( 0, 3 ) === "1.7" ) { + + // Setters for .innerWidth(), .innerHeight(), .outerWidth(), .outerHeight() + // Unlike jQuery Core 1.8+, these only support numeric values to set the + // dimensions in pixels + $.each( [ "Width", "Height" ], function( i, name ) { + var side = name === "Width" ? [ "Left", "Right" ] : [ "Top", "Bottom" ], + type = name.toLowerCase(), + orig = { + innerWidth: $.fn.innerWidth, + innerHeight: $.fn.innerHeight, + outerWidth: $.fn.outerWidth, + outerHeight: $.fn.outerHeight + }; + + function reduce( elem, size, border, margin ) { + $.each( side, function() { + size -= parseFloat( $.css( elem, "padding" + this ) ) || 0; + if ( border ) { + size -= parseFloat( $.css( elem, "border" + this + "Width" ) ) || 0; + } + if ( margin ) { + size -= parseFloat( $.css( elem, "margin" + this ) ) || 0; + } + } ); + return size; + } + + $.fn[ "inner" + name ] = function( size ) { + if ( size === undefined ) { + return orig[ "inner" + name ].call( this ); + } + + return this.each( function() { + $( this ).css( type, reduce( this, size ) + "px" ); + } ); + }; + + $.fn[ "outer" + name ] = function( size, margin ) { + if ( typeof size !== "number" ) { + return orig[ "outer" + name ].call( this, size ); + } + + return this.each( function() { + $( this ).css( type, reduce( this, size, true, margin ) + "px" ); + } ); + }; + } ); + + $.fn.addBack = function( selector ) { + return this.add( selector == null ? + this.prevObject : this.prevObject.filter( selector ) + ); + }; +} + +; +/*! + * jQuery UI Keycode 1.12.1 + * http://jqueryui.com + * + * Copyright jQuery Foundation and other contributors + * Released under the MIT license. + * http://jquery.org/license + */ + +//>>label: Keycode +//>>group: Core +//>>description: Provide keycodes as keynames +//>>docs: http://api.jqueryui.com/jQuery.ui.keyCode/ + + +var keycode = $.ui.keyCode = { + BACKSPACE: 8, + COMMA: 188, + DELETE: 46, + DOWN: 40, + END: 35, + ENTER: 13, + ESCAPE: 27, + HOME: 36, + LEFT: 37, + PAGE_DOWN: 34, + PAGE_UP: 33, + PERIOD: 190, + RIGHT: 39, + SPACE: 32, + TAB: 9, + UP: 38 +}; + + + + +// Internal use only +var escapeSelector = $.ui.escapeSelector = ( function() { + var selectorEscape = /([!"#$%&'()*+,./:;<=>?@[\]^`{|}~])/g; + return function( selector ) { + return selector.replace( selectorEscape, "\\$1" ); + }; +} )(); + + +/*! + * jQuery UI Labels 1.12.1 + * http://jqueryui.com + * + * Copyright jQuery Foundation and other contributors + * Released under the MIT license. + * http://jquery.org/license + */ + +//>>label: labels +//>>group: Core +//>>description: Find all the labels associated with a given input +//>>docs: http://api.jqueryui.com/labels/ + + + +var labels = $.fn.labels = function() { + var ancestor, selector, id, labels, ancestors; + + // Check control.labels first + if ( this[ 0 ].labels && this[ 0 ].labels.length ) { + return this.pushStack( this[ 0 ].labels ); + } + + // Support: IE <= 11, FF <= 37, Android <= 2.3 only + // Above browsers do not support control.labels. Everything below is to support them + // as well as document fragments. control.labels does not work on document fragments + labels = this.eq( 0 ).parents( "label" ); + + // Look for the label based on the id + id = this.attr( "id" ); + if ( id ) { + + // We don't search against the document in case the element + // is disconnected from the DOM + ancestor = this.eq( 0 ).parents().last(); + + // Get a full set of top level ancestors + ancestors = ancestor.add( ancestor.length ? ancestor.siblings() : this.siblings() ); + + // Create a selector for the label based on the id + selector = "label[for='" + $.ui.escapeSelector( id ) + "']"; + + labels = labels.add( ancestors.find( selector ).addBack( selector ) ); + + } + + // Return whatever we have found for labels + return this.pushStack( labels ); +}; + + +/*! + * jQuery UI Scroll Parent 1.12.1 + * http://jqueryui.com + * + * Copyright jQuery Foundation and other contributors + * Released under the MIT license. + * http://jquery.org/license + */ + +//>>label: scrollParent +//>>group: Core +//>>description: Get the closest ancestor element that is scrollable. +//>>docs: http://api.jqueryui.com/scrollParent/ + + + +var scrollParent = $.fn.scrollParent = function( includeHidden ) { + var position = this.css( "position" ), + excludeStaticParent = position === "absolute", + overflowRegex = includeHidden ? /(auto|scroll|hidden)/ : /(auto|scroll)/, + scrollParent = this.parents().filter( function() { + var parent = $( this ); + if ( excludeStaticParent && parent.css( "position" ) === "static" ) { + return false; + } + return overflowRegex.test( parent.css( "overflow" ) + parent.css( "overflow-y" ) + + parent.css( "overflow-x" ) ); + } ).eq( 0 ); + + return position === "fixed" || !scrollParent.length ? + $( this[ 0 ].ownerDocument || document ) : + scrollParent; +}; + + +/*! + * jQuery UI Tabbable 1.12.1 + * http://jqueryui.com + * + * Copyright jQuery Foundation and other contributors + * Released under the MIT license. + * http://jquery.org/license + */ + +//>>label: :tabbable Selector +//>>group: Core +//>>description: Selects elements which can be tabbed to. +//>>docs: http://api.jqueryui.com/tabbable-selector/ + + + +var tabbable = $.extend( $.expr[ ":" ], { + tabbable: function( element ) { + var tabIndex = $.attr( element, "tabindex" ), + hasTabindex = tabIndex != null; + return ( !hasTabindex || tabIndex >= 0 ) && $.ui.focusable( element, hasTabindex ); + } +} ); + + +/*! + * jQuery UI Unique ID 1.12.1 + * http://jqueryui.com + * + * Copyright jQuery Foundation and other contributors + * Released under the MIT license. + * http://jquery.org/license + */ + +//>>label: uniqueId +//>>group: Core +//>>description: Functions to generate and remove uniqueId's +//>>docs: http://api.jqueryui.com/uniqueId/ + + + +var uniqueId = $.fn.extend( { + uniqueId: ( function() { + var uuid = 0; + + return function() { + return this.each( function() { + if ( !this.id ) { + this.id = "ui-id-" + ( ++uuid ); + } + } ); + }; + } )(), + + removeUniqueId: function() { + return this.each( function() { + if ( /^ui-id-\d+$/.test( this.id ) ) { + $( this ).removeAttr( "id" ); + } + } ); + } +} ); + + + + +// This file is deprecated +var ie = $.ui.ie = !!/msie [\w.]+/.exec( navigator.userAgent.toLowerCase() ); + +/*! + * jQuery UI Mouse 1.12.1 + * http://jqueryui.com + * + * Copyright jQuery Foundation and other contributors + * Released under the MIT license. + * http://jquery.org/license + */ + +//>>label: Mouse +//>>group: Widgets +//>>description: Abstracts mouse-based interactions to assist in creating certain widgets. +//>>docs: http://api.jqueryui.com/mouse/ + + + +var mouseHandled = false; +$( document ).on( "mouseup", function() { + mouseHandled = false; +} ); + +var widgetsMouse = $.widget( "ui.mouse", { + version: "1.12.1", + options: { + cancel: "input, textarea, button, select, option", + distance: 1, + delay: 0 + }, + _mouseInit: function() { + var that = this; + + this.element + .on( "mousedown." + this.widgetName, function( event ) { + return that._mouseDown( event ); + } ) + .on( "click." + this.widgetName, function( event ) { + if ( true === $.data( event.target, that.widgetName + ".preventClickEvent" ) ) { + $.removeData( event.target, that.widgetName + ".preventClickEvent" ); + event.stopImmediatePropagation(); + return false; + } + } ); + + this.started = false; + }, + + // TODO: make sure destroying one instance of mouse doesn't mess with + // other instances of mouse + _mouseDestroy: function() { + this.element.off( "." + this.widgetName ); + if ( this._mouseMoveDelegate ) { + this.document + .off( "mousemove." + this.widgetName, this._mouseMoveDelegate ) + .off( "mouseup." + this.widgetName, this._mouseUpDelegate ); + } + }, + + _mouseDown: function( event ) { + + // don't let more than one widget handle mouseStart + if ( mouseHandled ) { + return; + } + + this._mouseMoved = false; + + // We may have missed mouseup (out of window) + ( this._mouseStarted && this._mouseUp( event ) ); + + this._mouseDownEvent = event; + + var that = this, + btnIsLeft = ( event.which === 1 ), + + // event.target.nodeName works around a bug in IE 8 with + // disabled inputs (#7620) + elIsCancel = ( typeof this.options.cancel === "string" && event.target.nodeName ? + $( event.target ).closest( this.options.cancel ).length : false ); + if ( !btnIsLeft || elIsCancel || !this._mouseCapture( event ) ) { + return true; + } + + this.mouseDelayMet = !this.options.delay; + if ( !this.mouseDelayMet ) { + this._mouseDelayTimer = setTimeout( function() { + that.mouseDelayMet = true; + }, this.options.delay ); + } + + if ( this._mouseDistanceMet( event ) && this._mouseDelayMet( event ) ) { + this._mouseStarted = ( this._mouseStart( event ) !== false ); + if ( !this._mouseStarted ) { + event.preventDefault(); + return true; + } + } + + // Click event may never have fired (Gecko & Opera) + if ( true === $.data( event.target, this.widgetName + ".preventClickEvent" ) ) { + $.removeData( event.target, this.widgetName + ".preventClickEvent" ); + } + + // These delegates are required to keep context + this._mouseMoveDelegate = function( event ) { + return that._mouseMove( event ); + }; + this._mouseUpDelegate = function( event ) { + return that._mouseUp( event ); + }; + + this.document + .on( "mousemove." + this.widgetName, this._mouseMoveDelegate ) + .on( "mouseup." + this.widgetName, this._mouseUpDelegate ); + + event.preventDefault(); + + mouseHandled = true; + return true; + }, + + _mouseMove: function( event ) { + + // Only check for mouseups outside the document if you've moved inside the document + // at least once. This prevents the firing of mouseup in the case of IE<9, which will + // fire a mousemove event if content is placed under the cursor. See #7778 + // Support: IE <9 + if ( this._mouseMoved ) { + + // IE mouseup check - mouseup happened when mouse was out of window + if ( $.ui.ie && ( !document.documentMode || document.documentMode < 9 ) && + !event.button ) { + return this._mouseUp( event ); + + // Iframe mouseup check - mouseup occurred in another document + } else if ( !event.which ) { + + // Support: Safari <=8 - 9 + // Safari sets which to 0 if you press any of the following keys + // during a drag (#14461) + if ( event.originalEvent.altKey || event.originalEvent.ctrlKey || + event.originalEvent.metaKey || event.originalEvent.shiftKey ) { + this.ignoreMissingWhich = true; + } else if ( !this.ignoreMissingWhich ) { + return this._mouseUp( event ); + } + } + } + + if ( event.which || event.button ) { + this._mouseMoved = true; + } + + if ( this._mouseStarted ) { + this._mouseDrag( event ); + return event.preventDefault(); + } + + if ( this._mouseDistanceMet( event ) && this._mouseDelayMet( event ) ) { + this._mouseStarted = + ( this._mouseStart( this._mouseDownEvent, event ) !== false ); + ( this._mouseStarted ? this._mouseDrag( event ) : this._mouseUp( event ) ); + } + + return !this._mouseStarted; + }, + + _mouseUp: function( event ) { + this.document + .off( "mousemove." + this.widgetName, this._mouseMoveDelegate ) + .off( "mouseup." + this.widgetName, this._mouseUpDelegate ); + + if ( this._mouseStarted ) { + this._mouseStarted = false; + + if ( event.target === this._mouseDownEvent.target ) { + $.data( event.target, this.widgetName + ".preventClickEvent", true ); + } + + this._mouseStop( event ); + } + + if ( this._mouseDelayTimer ) { + clearTimeout( this._mouseDelayTimer ); + delete this._mouseDelayTimer; + } + + this.ignoreMissingWhich = false; + mouseHandled = false; + event.preventDefault(); + }, + + _mouseDistanceMet: function( event ) { + return ( Math.max( + Math.abs( this._mouseDownEvent.pageX - event.pageX ), + Math.abs( this._mouseDownEvent.pageY - event.pageY ) + ) >= this.options.distance + ); + }, + + _mouseDelayMet: function( /* event */ ) { + return this.mouseDelayMet; + }, + + // These are placeholder methods, to be overriden by extending plugin + _mouseStart: function( /* event */ ) {}, + _mouseDrag: function( /* event */ ) {}, + _mouseStop: function( /* event */ ) {}, + _mouseCapture: function( /* event */ ) { return true; } +} ); + + + + +// $.ui.plugin is deprecated. Use $.widget() extensions instead. +var plugin = $.ui.plugin = { + add: function( module, option, set ) { + var i, + proto = $.ui[ module ].prototype; + for ( i in set ) { + proto.plugins[ i ] = proto.plugins[ i ] || []; + proto.plugins[ i ].push( [ option, set[ i ] ] ); + } + }, + call: function( instance, name, args, allowDisconnected ) { + var i, + set = instance.plugins[ name ]; + + if ( !set ) { + return; + } + + if ( !allowDisconnected && ( !instance.element[ 0 ].parentNode || + instance.element[ 0 ].parentNode.nodeType === 11 ) ) { + return; + } + + for ( i = 0; i < set.length; i++ ) { + if ( instance.options[ set[ i ][ 0 ] ] ) { + set[ i ][ 1 ].apply( instance.element, args ); + } + } + } +}; + + + +var safeActiveElement = $.ui.safeActiveElement = function( document ) { + var activeElement; + + // Support: IE 9 only + // IE9 throws an "Unspecified error" accessing document.activeElement from an

    W5aFVK$5oECMZZ$xWg`bX8~S8m$o+v#fSG71u&EnYwW^Ov;=OO6q{tFD|j! z2#i2S9YW^hGg^7>skv;FL-YK=%JjrHcpKX>1ZXTg%gg_1+XM>j<6us*b^BRs%b(gu zCDln;J%e7Li=J_$Wh+s53IlBTiiyzUbj|K{M}5fxh;uKAM#>G2S*?MWFme(pw(k^M zb{L2?nfH6;@zB0vJ4ic_rjeXY({+&1t4G6(YxdQuyOVBE7TT&F^*`tzaQ=V|^$$ZZ z=3;J~)@=;HY9~y>6p@Yz6Fx<<#U9t#W=DXw`DO6h)}NJ`flT6dC1bz4hlOCCd0()| zM?-q-73o)co9MVeV&05=9B+D^VV|Sj5ri!6GvAr)H0an0wQPxPt8YR8>$ThAL5K4g4Uz4fu>{%=siKyz>8z0Pqr~B z++{U5A7l_b89Hb{3DkZzRsB!^0s_X++9ud)#&1d_dWCvO|DSGvZuaO;JXcO22kD&X zNSp!Dm9>pX3ZAMA7V;SY3IGoNc%a17*I=_>FZx-t&+M}bD799l`9^aTOH`BF2TD!2y33OUkgR$n!lpMBSfaF8UIp5`*s!mi@>gj%; zJ%JYIVgdprbfMsZ+tT;Sv(tp_OJ7__pk9L(2nQ=cz$obGYeVY(UiS|f4-aku9QgNv z%PV|gytZ=->tv+=PL`WRHo241AFa}-&EMY+<90X4r=lCyaeQk-IY20TF5iKEk%Vv8 zsYfLGIeJU5BQ$a}J$go)`D^=3%PDJ82=Ss|@zlzuYx`2^^gVyY% z`(lSLtQKyV0=zOsXgG$*feTHFF=@0(DX)#HGL^&y9yy!?Bx+)mEZDfX0{XT@7);&> zjdTg1YbM}|g!x=CHoxWnJ31HGv-8g-Hy42z*0=^yz5B{dZO>O!&?_7~Lf>2qdv*>nF(M!(TM=w@?TVFEOyy8j@w#+?Fn}8Sx<~Hkx_tmAz)`1wXTUGuYG~=D7VQ>Q%{OZ%@Rb3v&W(z5qGe(f_Y8XXIBxhlri3X`c=GXU(Aw8b_ zz3S)QH}Z_}1Hem8{FGK%}yvhV6VheYIe2=(lZryM-o#**%7B`{S-ey_iOcOxgcGN zGzf@*ptN)&NC?s`-QC>^NC*Owf(S@UBi-Glbf6zFo^1=LZUBa=0d0efkThR*uC(5nz4PvDqHBrvI2F;|Ru@Jvh)g28R8O zk*!_YK--0it>h3X{^7wiSE|#5k&r|4!HAM!^c+{oO#DHCeZsE>vgu_fQ!JpiPRvh* z#~pDj(ho}HLTX+}W->)Hl{A@blkj?-6+WhF$(5BB3Gfb1Y@B8xwJzBt&K4<7VyyAL zD4Wed{4);ExFo3@G+DILM43%M!2D<;j#8|35)$KghTY;{_{5i){e-AdLmyj2`PI`l zCWK!d%LtaWYm3iusSvYnL$j3Rfje}J#qaTGFp#bI(giWnq3OM*M^!)EYo>e zm(XC+P&{)`VAz~CoR0jF8Y|)~=211nI}#7~@8Z zzGo3V$U*ydHV|vD=_lt9IXmP8m}|SobwX9Wd`5}OZ)lc`TatG*$sC(o%mB)QJ!8$; zn?MLnmG$pH;KkM^l#ufN6~S3~2y7<>pej>T%6hTgCJ-VIzyCoh@mWk= zpAY?REssSW8E-wv+zcupBQlvkdab2@&~C7JKO$p0{FZ|@%VJ~DR#n1^-$3anb>k8X z|GL|N#^@PH7E1NxNtHVJ`CR+;I6Mnoy4N5E8Ry~e-@o75F<96c20|pg=gA@*U^!8< zSDXSY3K}p2_u`8HF6?!aN>)AZzAre~aEHZ7!}&aucC~$!+5j*5^}@+a@9s0{-I0uM zCqw%7PRg!hbyE`*wD0C(%dCSN0?xP!&r!P((Xs21Ib}j2_c=X{YAbbwyXds*9PK99 zISwKgql?J;<&7*e?|*pr;Q207noyEcGw$kC^pK0fDHh2YYu$8$#+&m*t37!Lp#k{R zhtyQ^4$2V}{4DeHPDiV6Vo{9MA+Am4X{M~DoLl;}LgEq<`*r)H9M8drFgm=;CdQHK2OQ8?B8+Xz(N;^;iK3%(#7DYa`YlDu@b)6Oz% z=)(^hxL1Nr)U2Q#1j`RPR`Ac71W7W~u|0PKaVhP^(UFZl>VK{hSH+A&Ubh~dOoz5V zpu8L9<9C(ZtR~gga>Eu{G91=OHmrt=tT`^L#&5rEc%0b{Y=7BbFH4TOG36OLHuJCy z30xI<9cp3#QW2so8F41;pdZYwFj1v>%xDqa3jI!5m=ABvg5rP^CRSua@b#B=L}Q9eSYUt_U7)xR5?W5-%t~t|F19gdVwg3yGnN^BQm)mdLSJ(J(PH$2}F1 zz?(=-)bqpuE&@F@364D`%Z`SSw$WzvXbmehr#8p@Oi(fq{^DwE3aSxIbeD0UZeYFg z!);$LXd{LiDY~=NAbKNr)qQLCDqpgi#lFph1k}F|QPJ(V=8X!=DY$?wxBZEl5sKIT z7}H&fe)%~+2m*IdBhoP&IDDdEIC?eA=w`w_#29~OgrD6v@80<}!AA&kT$%`o5FPBkU$ zcel!}Z5ImXAwFZ!u2B`6}O543_WLNEZ*8CFv0n9)Z}GL{>CpA&MLs3kqjqw3?YeZQEPs2}rfF*s>=o1T za9i*H{NT~ySSoL*N~!&xPWW3lP+5xC>Vt@fLK8TshI*EAL_;5TUp=hnMSe6g+R{}o zKjGnCC_W8Py>oya6W4JRZjR%@Sw+j%Z9ZFU44VE9axkUIQ4Z>Ofx0CWLM~r@wuYMS`-!vL2@|bTCgOH*0)k+nL8ix1nwa2Vlz&93` zYHICTJp7H%;}q=1Xw|6H654(s&(7@PXbrwx$2H6=lZymh6TYhD($kiuegAv%_ZIv} z_Dy&RWN{wEGY1DH63_Uo8N9*ZFzp9kj~Gf?m+C^<-^l3wwb~s?D55eWNy*3tO)P%w zE0s0SK=#5|95eJ(Gs>nPH_?f(uxj>KAZ^oB;We;}v?kELV&=*7)!8iwMP_Edm((x@ z#a<)|c){G$Do*75u8}u2*Pv_Q4Zwr1f!7HDO_oGAVT5Wk!FR&==U$18QU6bsqaZ$&U z9{}$wptd%}y16LgiYq;f&NPNx+jssU37jNqZ*1>PSc`%KIMZE#PWR84oX#)vC$XClE0|4Dk?ZJfGA0BDW}B z@|SYefSdMf%=%5(f#=&iMOq3<0N!EXYkpir^D{Lz5qv6$!{~FH4aRczn*&@lrj}5$ zo|Wz^fpVuFic+a)D-Yg#i1vUj|bQV-~3@RrdGuZCq1UgjAL>Z`@5sdF%7=2+$A_xu?Z z)B9-wmykTg5hu{)Y8Hb8+V||u)r~AXIXoT`UWx97>C_*sM9$HP|4{yUUY@z_-*PIX zQ|C--L00_x64M>B%Z{V|Lyv?B7-j~2q&M(H2T}+2pi_DK z11AlD{#mYj@*ws0@K@xN)C+CZHY>E~=A_E*>w|=1s<7L#i`yW$_g)k&tq2qG0qLKQ zAKM~C@xpBVw*0jkdy=UtPnxOnXTIp+!kzFEF{Hx20xz_Q4_t_?pXyxD82Kr`eXV=& ztbU57kAu-R?`osrJT?E!C*@Qe@ZGz`uMKLWhbx_0p*JVdU4Q&iIP>%LG>Q)w)7SWK z_MA#Iaea=35^yqs&V(ZRATTIdEiVC#8X zUHc9C2Ahc1;KCOfi3DbHU13_PSmU|d8wD$D@H6TP#vYVXn%4~p(LC<2!p^A+w|fG8 zbQ1;whMx%aM8KpVU)f#%XgF6rS@i1r<$bX-a!S?YXy?E`gXZKdYL07Mww_W%M%%LW z)E)L2=6%jqFV-p@1E}9BQhzck2h0J;@J%U&-G^~hl60pHIrBP-fh#aEjp`rcPVR#PR0t{B2_x5P;aqW!phYDP5`-kzkQK-+ZM+Gvxzc?kp%(4z4(H4Cp=Gy>JrhpD`x|s8n+BnV? z%hR^{bgi0^#T%x1ut(*0TCK7Xm0D-qZo4}1cf{EDgp66`sx1%>WBg#AJ4$^q9~wkl zw2Gt_1G+9?jKrI(b8tP-uD*~Y3?{mJ^bpK5*g4lcEBTHfU%^2PDcvHHf5QXUk_?@7 z24je4O@c65IpDwXk@}OKAp;JVN@q%@CW32j66P@(8PVYQK1`AbCIMPNAcVAnUlJMm zmhPRBKm15!qIhb#9L!1Kg@(a@(x7>25%>1?9-K+(oBfs-Sf`Z=1{Cy>? z?{n5rDqj#AUm*LFyN|w1_q+7~ll6w(oI}&;AmU>1gQ3*1W{C}|kDJvgL?7V7R}{<+ z+GdIal|ufb0x$c3H$Jvr0f5~YE$C@0=7Z*x`VBV3!sT-ZJ6Mm`TE#Y1mwEDyMI!o(I z7y6j@hy?ZBrnoG9OVkrnEEoh%@55agJl{J)Pe253vemub`hM^C z1i>H|8$4b74I1bHK7%uspe!CGd_0I)09gLl+zAx@ZzxMbci)Tu4B!KPYRczXaW0YG zJ$VBc#o$RJ?AFUWmmt^{zGhMLOs8a=?F7l1d+^PMOnph22sSNzGz%}2zzcqgLn-hs zT`kUPs(9(@6E!EC<|vto*Vo?8<;mC3m1t-t4lB+B_@%m&K%Ea~Ye=g&fQ1YKqyb0~i)4w^kM7oZkQy0@1qM)Z z;iS1cO2O){QhD*`3YnkkH%6A|1;Tj>Wr=XO>*sPoNn>j@+w0xCnJtmI?$3V!bj^=q zcyPC9?@lmYwCyDEIDhirx8$6k&La$8V*iyUc#UST+nY^OU5C?cRc|W72`o5o;Q5Mf zK&N1bSIO zJsDal?!FWt;1b4Op=B>3s}DP$JG)Nk^o(4Uvs zypwIT-8J+faG|nqN85f!7emO2oS{F73MTU1avp?8Mv!C%O(1?y!Th^<4fg@AhgEaJw2lP`M6rT zzq1um9ciiAK0_Im}ObAo64)QEuHMDY+i<}M^GLYTp$zysp{{(cw%er^IGB>x`R z|M!6QzXvt^2sNO#RuJgI;46CKNPzJJsgc6!ko}tg#ZP|0Cm`yMjq&$GNk&(!>EYt?|mAqSAlI`H%9xX4~W6^Q=xCmfJC$$M47m#reDLB{w~fHDdTU zPU~1N{*8nFcbo%$U{1rQH|MsH`StIT-2N^J(gf@PO89Gjw*vp)YhgGPVipC_Kwf|O zpVwewDk5-(2^RfFg4;C!X(FOq5WUhB{WbCL7`gw(fE`^Q4}Gne=mP$mVY$D2rt)`N zg8g2~$%%t8N*XUQ8#wQ_KUS~A)0O&9b#Jz=*I+)d zu_>6KzTR!yed!@zZ|KfBuJ7q!0GmF{%VTS%i>J|}!ocmb(MGHb|82SHjGvkv>@C-I z`A+xcRP_43VB^wUoc6qM<&M7DneWj;6KrF~j{k4WpHpJ^T)o?e)Y;&M7a-G&yF0%5bW`K; zB2b@aRmP{a9zS^*QPlmGm6LyhA+GR?jFb3+gl?K$8A;OOL;B_4A7iE#4~u+Y6&rge zO^Q7iydFb`Szi}mS78}Vby6=rL#+NW9#v0ww+LW7fZ>J%XMoEZ-#LWEcW~5Z!>b2#%;dovYVMt~S!cJ1oZ_kf; zru@Fq^h!WP{z}nn83hF#AS_e)-QcTvqwZVldkRcPn5&~z=WVu`8*Wo>&4TONEk|_;PX0YCHBn4@BHt)#e!yk;2d^^ z+`B(4Nhoo;Sa8gE{wZS{dKwLNOk&YCsKc{|UW;Af^?>w%FKP2RGMw&-|!(VSW1 zGt-@ozTQR{bfe%Ti!KoD-`Szt!(0R=c2)$#yV8|jw!|nOSWnJSLVf8*@s-?*7a_L5 zFw|F)O?9Qcr|!gkU%OC}q2|<$i2HNZ%^5Mwd#R1X%NP1t$`23mze(Z~G)uVTT!#(m z-@IL;TBtux$1X}^4Ui0+T_eILC6!qgbMk(@x)~^?B5R~}voi!7lN-yQs1BdeLNdhu z5fOr6kacOlbc9Ql?(5WYrKtG0mhVSi@$gSM`8wnDqzR_?@>Oq-=Q?-f>t=&)oy`GrZi)L~XtAO&Ule|_m zmFg}M?~lHJt`rZM9zl5iFRK7G46usB8fMXtmk$y%iqrjIeYz#rHp@wYrtitJQo|Dy zC}{76ucZ`qFbubixna#7{VwAWR=#4-y#L=}0@KJ;`29Ot-5Z*VF8hL!Wa=BY-gCO- zHUfPE*~e9ncpuh7C!tM=iK9?MG35W}Et)Px^}!~Ww<{TE^PiIR7u2kyhIkG=gChI8 z*LA#l;%hSZfJX+TJos+wkP7`qq4|&f0Oe>OL2q+Q^l!X7Dk!RFFuyL}ldpJ+uL;#? zEO&s;W82(^8Fl(KUO_V4vmXAt`>(-kt);0qTTS#Cte?wRJJmK*4c|!}e++3_<2Ora zG!x(Hzftr%+!a1d6nVq(-^m5EdJs;<<^$Wl&zwGeNS3?lQgzZxghZ;z^$f2~a@~uk z0-l^ak~%tp`Ts0V$^iDAqRCHiMC}3nJH74sS5j&dM+0C(LEMDI_xb)+Mq_6NHh#{3 zA{1~1gk(+l+N>vFqtnKGg{Z;fk!Mf0b5a{$KmseOM#08m)GmCsQ`95S|eXnBsuaETH?ZwBq zxS+p;iBfF5y>cq);tx?0!rsG1r$Z#KS}*+-K5%YpUVS*c%siDR|EuP|_rM+=L>igF z1g(bVs<6lB$!w*NfNRDO#ASp^zaLvkQ@~SYg)Lgy|9fM(7~yuWZXXD`iH~+{-hBHF z7Vkq&SB~i}N-WDt*$J8_x>IF;rB*l%gX^hFpVtuKza?rmdh-Dh9D`7tu5+=bJd*p_ z?S6IkMQYo;41&6J9}nEkcQixTDBwoqcPw#0ji}R5`rDf0(dz2zt0Z=SF$LFgs99OD zfi7`-wEzRcF&`Z+iMFGD1!J$fqhlWykw_ucyhy3+=FG|ayt2TQSbQ5?feK9Y>hz!8CsL~{cc}4!8qPao|-d#-8OyX-}8$=7RZikXp>(X z4-&qJ3<5uBq_8oR(M5}&B;fIUZ%i7bjZiWvDJl8$pFA_|e;}Z|2)8i-r~>GLp-3mf zdS@S+0EHATuC~XSyhRBOdvC)jqOEr=S-JVt6__i|R&az75<_$Go0Vue;THV7 z%+mKZCE&VjhaRrH1}g*qKnoaJBdFMJ*o-B!J{ME!ZH`fu*)_N=-iFT|CuJ%?YCL=TZoaT7N zLEObuv3}bW`Vu;rjQ`Xe^5gO8<+!n710=U6Gs z0(5^c2(x(C#wjp`MWX-qOa!6tyUBa=Uk#>LKPvq=hKTeHNL2|;m>V7Dd1)AR&bq}~ z3q4G&GB4QdgrRdC9MC5;-k2DRPh|MxkwB2UMw|j#Xc#Nn)tXb`L+tv4_o4qR>PQ6o z^(FHr>1-xa-U*0(z)P5?&9RzmsjEF7RVN}nc+T#1W-Ws<`1l*>fcZSfPvTj7e}DgM zwVl3)2j9BXFboeVWKoT^Is0YYVrP%tBnVf0y9gEwl83aEFd%5ou z=R7uFaU8%cEP}P?cQ$E{{Mq^>uaZzTA3NgGbzSVW?y`_Fzw*IjPFQxwi-E674CJ== ze~(Y%`2Hh$eiBKQ1@sA?Z18fEli9Satcreb@w>t6hJ^Li>Gnjv3Oe29SBEw&3_3ER z>)O7n2(O0EzkTLf6^4qXst_}-&-bCGG;qt1 zQVCy!8;LsHK8%3+fd=R6myQG7cmW{=G`ns^BNwErU7!N{SvoUtd~vRZR}3iSB7~0D z#I{+QcgvwYR<*6KK(nWr7Q=tTBSnm0f}@EV0`TtMeZxMN(L&EeGuDo_JY7mtMmh3F z-(g^4!oXE)t#%8hhDiRqdf>iQeF}U_Z;!oS`}&HJY~k7SgEW?3&_qd|zvmw}d>Cs* zSy#Mw@`qul$ozJ+ECIlic=0rB)H!)kmP==#$y=dE1i<=~hobv@`}mg9N&uxqNE{n=+8#|))R+T1~Ke0G%?+1&l<&lO%9Ur{eso^ymT&{syk=jJi@ z53_i?J96*=wsYaKZqudmwJ(@Fy`qcPrAF|qZ}pd7_9*}l+?d%CTnyLKo5n2O`>y(7 zzyCWwi#pz!7=}OhI%XKlV^da600p#Nv_f{kDh_uppk^aUiN^zI=j*)lOR<0yjU20@jS zbQBOOl}(^$3QV*ldEdE3} z6+$RJi7)^5Vx7v#t4X+8{WdVg43rKTNtXZEQF?$&`0&H`4qje0gNLd*O^XX#&`z3q zf0ReM;v6qJlK_fvl#zj-5-G#6&Fe8Z}(S7f)MLl|%FR0_%gT@r{8kJ}! zSmO0?l(02z8) zqvC0Q0r|ev#4m;y4EKuy;}#0;>4QY6U?doC<<9NLs7bMpjiFUFI`_ux+MEUmCpn>G zM%s&(PJn;FohcCs;DmC#QYu;1K~*nyHd^tRICbf2&$<)=cNi ztl104)vxjVkQ07DPSD)z|ErBaS#wP02_3O^TXwI+>ld=pcCD}nTEyRF4UHmoX(#5x zE#-3&))^wsayk^J8A;z{$rW`V_=I#pL@0@H;~8*ZMtKa%q6KP4%Gva2k4@XC++=an zF$|jK@dK$>;odnQ^0S3)TD$9g-i`^9X?5Kn7SV4bjjIEYo3T3sxFr?{$u^+24qfGn zQeg{MYcE*0l5c!rT^o^w%PetgcSZ`f#wO42(&}tdVfWVa^tbI^ufd=OMGL4O-&*}O zq2LN`d>duQq-ub# zhc!D*>l=khhi%0)fMLhg;QUfiK_reUft@oF$?(aQl1|-fG{KAuk;Nu8SgctoI)(w& zAWw*Qt>+Vs__X4TB9exdHljfuitrqhpgXnyjSo2RF&w}H40q2sETi1^LskyY-hZs) znUxsj*(6D{BHjMuZADrB)N=i3J%z(oFm)ORK+PTLdUR`1MG!br>OIB)cE9xP60Qpi ziGaN7UbKa)qh9}Eh56I4#xf(ZuA`N+Bp)ZQry8?+u@l(V3W6-0eSLcjpEnXVtg+K! z=N53ik&USpIBzRsqP&PYKE1)IC1M@bjBR&)v&EwMaMw;b4Gk7l9~<;~PBa=JAzjNa zE{AqB8v$#g3tk7rjwt!#Ndx&Ir3IbtI^)2^PZflCj!u$hB@Ex6DxL=-2v=88AV30< z)t*}%iex9)&zR=&HPZgr*z#OSzR<|&t-|>DpH9%(>6*84|9&fEqKwGzJFgoy5wG!j zp5VjP1&0;@n@1f+-Padq^yH(F!i*8~=vzw4Usxu2{=z8ir0|3n9vik_qK!|oNU!H&!O*~x#Ef->c+H{dcIA6_~RCP8r zk4pSo?(Cux%fvPs;t!s-w5y~>_x@*dm5hPYAMWmvLnI3qU#N!-CphyN0xRCnu@8d~w13hwEMDXv z%|O-kO;IWY`joRWXB8N_ygyFc0dWvlPBt@He&&6PNbNLq^y)p?_6wn^m6Qmj0F+Xz zcC@Yff&RbcEKltsK*rG9@|_E-DBL-Q0|C|+vLeK@ zG*0)PkJZ1Jkt!FXn!8uUN#PFdZS#VcwurZ!O2LIV= z!A()e_%<0Yp|6WCqA7~j4ik;pn zH<#{e7?bHAxXtE&+O!l6@@2%Osr%?Ww&z~>)bxRv>)q1ny%)l$Z+X$%*(+~e3nk(oQAR!6swaS0!f;|tkRH`ejvwsYQNvAL?DA~J?(kd+ zI>$kbs_Si#t#fFlxzhxwFD^+x<5$oi+_oKB16g_(O2Icr`{bm z=16_x@P4COz55!{;`@jb=}G@aofM zVeY{KoG!5&8Ge-DUNfiNTr9iPFDDHDx_sLc8&a;tBsW)a1lxeEmQ`YnH zcBI;SmzY?$zj>;sdOH+~yoRPdshvNc9aqm{79+S$=MeC|K5v&0aHFs6#~1V?vtV{z zSL$aal1yzAc=PykjSdGnVy?agAr2fRCyaCxwItNiqhL_dBKG|1--Wv475>mW_%Mf_97L`IaXovRiX zZ@J|!5zK-JQn^%-4!N@F#69CF5wWHsexSlHI%dlSAF6q#v{&f@ntIO4pnx;%b-{8j z{K}&}*oM2NK`3PfHyXmSpZY64MqgMc<5J*iL_{rMk-T>Pxsyjk+HqaNZ}ilInIyd! zGvXeFSO8=-Z*|}G@+N%UZFQXDqZ!icjs74OyW6V8dj^K4g%e+DCX;u930)kq39nccPm3dIuu;DjVL?oHu|fUajDxOYselc-W*8$pB7G-V zANE|N+JC)ga8S)U2bn4A0&kdYT{r#VIDY&`xd4 zENLcX!m9ZLRLnJ6fV--H0vsWm{>|q;CWJel8y+t)cFF{fH?z<{NQY#>ZG!BtZw?&L1aG#_$ z0f8y&z8|2U+{@d*!7!D}AS|@q?KW*couscj11Eb!Y<4)f8cNg0;)8{fIq$W9W?V0r zLH7!Z|GL56iNKS5fWuAr`T!ZsHKX3m@+wVoAaAIA2z$JHSU_d@MW0xv;6bp{FV+%6 z0d6HB;+|(FXNX?wr_jDpHMimdes;F!j~*g_p!088j073o-ziAnU*u&kSgVLV%W#Tj z9sGS{7o~4k>n7i@TBv5%zvDZ;_hs;55uE0s_vlGfZ*A{xOslf+btUsL@Bpd=_X zTW3x~-iqfplYCfeXBMN zVg}rW22yo43otT{c00z#+_1|?lrzj09&{%GAP$P1ED}~*w^>S+y@;3oA(VqZKqZ2H zUFq136&aSZ1kSzt*hZX)0wy~NUH9%ypKN{5{JxrizVpc1*)?(PXrIxDwGDt=o2hZL z_SavGjr&r+ZLlT@Z39){!V0@}03~_G(+m~cP5F85+Gpwe+_PTZ$cHN0ME)!^ zQB4#H`QCn3D>``gEu*A@SmJeCiK2Dz7j56VtSxvI;LE5}-*@{!IH~mfxY{`LbnuXq z@v~3I7)?xnhShJ5^x)6dlAx^N-rw-K1MtT=PX$k1yI))Z%-#sL zFQNK&^5%sc09Z(GeYpyK)YEHW)vJF`r)CrQj&jX-D3BF z3*U?y>I|clnk&%%VQ-5&TOLgT*pNHUM>Zz&E-|5Ir(ee#ITE>YYs-jOhPSI!kx zBVM=sM;mx9CD1Jo*An%!>KN)*Kzvw=nA4w4;5H??pCZDEm#e3(fUG{*VTY;2D=%=b zNG8h1#<#ks;32LnZ{m+7h5HGnuMh?7kK&R($wpH9OOkDovs%k`|LE5qC5dMj;G4%H zHVsQ0Y&yNIJPqS(ElmvIF=Y*Zbu|;GUZUHgZkF^fScY_$gE74w6pHAD>)rDW=96F9 zO;kD(X=w4q3pm#ljd`ZIVQOp}e^{N)oT5Ce^oFuk<py6o zEe8d>iSy3XMQ$PYt*lx&yn89jeSD{+)wzO=moPR4Reg$@Pr4IqyI^jRh0G-oGJ=Qv zA>^R)U&7_i&zIT7Fq?ZF#>QZ?B|4Yh@B=jWirq{-NtX0onXoM<)^pNO*d=r**5m9^mo&evN2oc=U)TsSja1WZ@au3#FBh?GSUT{2jw z`R#mP)o@pP?(hMIw=xzp4URb#W8RgDOeMgXV-dV5$iq^|E1@*O3J6bTNoDi1{( z_HuWl{{_k^D3&A1cyQub^*#yVPzgn%6V5NSe3fiE1Sl_e;Rkqe2rhbNGzfEe_Ev2| zTV-zLqF#mZeY1-)Sz4~@QV~dO{6ecRZ8Z7xPkhZh(#L3i$s|&l68yk2iujGxriZuH z>sli31#9yUfleJ?TQQd}nTGk?ZvI)*jMr9!kiw1^E&XL*MUu3gU4WJfwFZ*=Q4RrK zbCbvQvwms%(-%|ZKPKPyZLm#3*9)z>xdhA0EM9i9X55RWJ-6R}=6)oK#-=^)+y65U zzf9!~e_#0{l5sEQdJ;?q#6kpb{kMk@;NzBtuCD?WX)rc6AtCfT3Q6}PQ=VV60xYp4 z`ye2~D4!h6FO~}8iz})a#hk!<>vpfXqjd~t3FP+w5l{We2gSRICb{Ws!-%i? znQ7R3d9k|F6wPW&nV~4pV@vj!N2!TaZkn>X%bmqX^qf**SJ+FlPc)EdRRMn+O`Vf> zi1U|Wcpq1^7S(Bcz7&((OriF;$JKQ))wi<{D|G(X7D}N2>i;Olw)H=+_v z{a9fHm}}h?*KNYfUfd@%fDBVCgai~qqV7hnsH8!eD4ByGG;{z`q^H2*jUF4m+2o;A zu%4-c2gl4Glq$#y4=Fs(CsU-jKUcvk$}Uh@b|@;^;qY7}H?6GembGE(YXMonNyvDO zN^oimJ(f!n`nqIPH`l^v6}QgtbF}8O7LT=i3$r}62IE$sGkMYklx%-uh-3|&O1K;$E zus9F;dG??e+o;}4q0b-r6F=ZE#UhCok%26d_sFz@jWc>Inn&%^-Pha89?#BxLWau- z5`E!OIm_^8>`hzvddNLn4?EiuM=z`gR()&5(?%Ro2tNxA#EIJQjdz=7ft{zbJe^WB z^~E9v#_2=snqXdZ?e=@=PKw3{uK`=?%?@fclBr_!9K=An{vV zFof()YFgSrE2v~q*U}2ll=Xl9+A0|tk?y2c3Z7Ec1wuX7(V40a-&e;*M+Y;6qrc}N zkcO(PAU?0@3%F;zWZwfc_Rit_cO8A72zJc)Ek+*|rxcUF`w~kZnn=nI45!ea+dh`% zzp3RDJ0LZGq<3$2hee+FBi2aGE~#8QW5h8ky7Jj-{>Z4}t%dUf4Nj;f5`7zv;at;F zxV<#}tyjetje}ff1dnF-7rrYo*pXWA2MyaEXnz5@hT<6d91hD8K-d{XQ)PBeSgD)t z)^=&VQqik51Mt6BQu;`Q!$R73#xV zU~^kPG^Fa)tp$3w;zF&_iN0R3W?irGxJZ|2&bis?cbRC!o^un&Kj;=d^RoM~joAa) zpc-f6#r+aYUBN$vdp%sj^*=?w=RSwl2%4VP+X6RC7av)|#YsWLT1qDg7i@V3_wa@+ zIR-%uEke543$foPvNad$eB{qZfQb95fS@>|igFx<-P_DbU;Ti_cd;4q?4_=Pt$E`IRYCEMkA8u&cnUH%WqC+?^yb`YcQ0LeNFzH`SLl_B7<4X%|7DJc7-l z%OLrvmo>skL#mhu=Ajt@+~|h}?vEa$5BFz2_7SZIs&2))mT94N6<>K@=D6>xL(d$T zAO{^}5p+OXc(zgEcxsie>(mvww{{G*Jx~$?PJ956AgoAQYI9puo-pUUKYb~VDoD=A zY#fyGI7lB{pG@bVZE~2|dZou4rPiE*d5z*hj-|(Xdn+1@cP%TRxBDNB8S_PMmvBCc zeEt35>JM5?4kI)nB=Wrsy&9-v3RRPIaMj%Ee{t}>Fp~yxOI74{4MVKhz8Xb_#5nqT z#cMSCr4Dtj-4fBmfoyx%t;cF;-MF*5#B3Z4Hl1(Ai$_nE^t#8!-`m-R$t}KaSt&qr zB%*u}xyo=`g91skR0lrf@t~bgmcD5NDM~o*{{HnE*XQP!O8*XJmBEF%;I@G0#M^~IGpoz63Oyv!s_4@H*4)s^@GTzXVn`l@0HdULJis8>a{~>al-b?qrm(Y{IoriZ-)r9EJBA#gCqpt%q*uDw?%Bk|vPF zQwj(iJn~MRb_0HN#X?IEBChRLfxI__(qOqIiM9t~ofUFHUpfBijC?vM8C0;*Y!F88 zAU=KuE9`W0$P-1&0KkqKxK!=(Jl9?xT-r_k3OXfy}3Dv)v#5!nR?Q71}II zM3=eUM_u&x!YI*fgfT(})54GOpsP{w$P9$Bmv=_e!2AEj*$UXkbx-k@*tHEYAhjg`1T zAzOEfsK;P!vKin=U?|45D$P@e>#_6lYiRcR8+{*P+~|CT8H$h&T<|L2zReL392634 zr&u*yzB&)TNFRSsUM?LJdhKSpFmaDxs5bu@86P=;V6dhYd-q}yscqjPn=)EzDclvi zuh^#*+jetCg#=NWIe&EpWQaWz? zoiJAK-CIWG7{8i2OFKnD8Nw+he?$f3AdOZE)k6j&<)!RA<<*<&ISSRC+?gd3>Xq7Q z6dYa(Db-f0LIaciu_PVjW7R2f{i*@`H0XL>06Pl z`Ljn%`rhXybrE*7rv(d(WH&!lvCoHgcSYOSyf^)lr|mpl$3$_&-MG-7aSR*&^s@<4 zjdy>g-#QUv=5*%EeA=&Ci9L{KYvb?GyPJt);k{QgX-Z>$RIEWb3f4G3y1hJM0YSm5N+ zj&fVN%RYM($Vv9X>M3OZU)~eEz{XCwa--Z1cUJRPfAWxDcr4RH?^*3BZJ=ig#d(vR zU+j(c1`if*Y3>Gh*j>b9zx`51?WLl|HP6I(7O1mP+`7>j{4^dbZx)0NfJx^D0t6c@ zHgHAFZDSmC(!p{_@{PN{m1-=f9am2rRR?St>_jf0RgzSL`p(Qo~&1tutPe(G$_>@@Ov;BSf za&u9Cr9^t<*fU^Q@xJsr2=7KOyWDbx;_ZCwqcGUlKzTVQXEAH$; zjQuQQT~%7CwBN@`JK$>!isYGflPLC3O5Zx1_~16QkCQb{_4EFyaa$;`4Rspw2+jYr zpS~6+XW%V4$7Ezja-WW}i6$m-{t(?o*lq47ZKIuu>MJWA^0IaD=bpn;^ogI3%KMha zeStokj!iVh{a8ck6WAjkdl#RWme5ZTG1WhIvM^6wlJT+~`@I4?%Od1%P4=lIAo7kVe@gqYoSJRh)%YR#fK?Vg<>zBcpgbe)i{i+iZl$k|v}j z?|C8nt;UPR2&l57l&uJfQGo62mMD#|irT3Xo4;*MUMo9hpW`FQzvCZYLMheXQLBhP zUE~>jrdhU4u=#khP0X96fknHO174g3Z2jr4CvE9Q3x1AnujL+|7j%X4y}~WDI8gJ% zg>r5*PE`*4KCp_`tg1oY6s&#-kZZnl?)QG*(fCC={{426PY_Mrrpf4_Nlo|(kW z+uG%8EOj}>AWpvyWj#+5<|63vmIjpfyhJ_g@f>Uh)~_AS(++$jN=-VQNdQq7g#5%Q zaz^-G`|0@-zEgcnJ}J~soZQt(M0c$V92dG)J7P3s_GnDq1lR9As&RWPOq5=X_5A1~ zaVh1Su;a41B?gtz4&JHZ`&LH4UyrB|da=r%u7dO8TiToF7JlS%xqZ{sc2uE11GS}O zU;z(h$bQcfBkT0+Sg$XK=I0lsuF7}T-*3i>Ax{cNIDY_LafOm>85L@bEJn*Mj-KSu zRXBgN6j2OfWb`LqKnw7w5V-o_B$LY=W*yPQyI+?`m>wG&3mo=Tvsw-l;bX#-bxqmg z-o7rd_HiR>gLM7*-4gv za{~~J#5{o#UBY7Hv+>i@euDb?nzhrL%^x5lR~8Xj_cJ?bo$rM(JsEkc#EQLDU{1Zg z=iEf}zaY8=Pw_MxeIJJi6fhyn??HQ1vszwbgaiFs^A|+XQjxzaw z3wly19K{z<)WrPtq#zlQ##5_v9FmO?3LW*$1lG{xV-36K41$v>gAJq7a<3hs*LTM` z{Vst9C^Vw!4A-0jGK4rSE6gLeF43eMp*y;`A^um7P}WC|pge;#J_V%({Geb*{)(Ih z-oXh(LDWn1OsY$?4x2KX(rRkGylH$)ewG5%1>B|IeYQwj_mHB;$fng|$;;n5po`19 zqJAb#BUCM2OaPF!MncCdaG)L)2RaRMoU?pquVSx>FjYq(MqRy1To(8$m!yxx9uexMSa?_vxC&;eRPHpJ+n6C4=SJKvv{5$CnkB4AYEY? zcr?`V7km+Y`B|HRc<7crp|nmh-KZ(hzY(y51G#+C8HFvj2%&OCbW{YNV&pbkDIu)3 z8HinffKCaJ--8$;4?&()OXt(cm*d9-Hni7A!%}ZYk@!*o1KlF9eCfPLBKeq29dL>I zeHd#$Mhtx#fEXvBIB0cN`xTlB#QWKMIH&ZJ7MeQ>ocBHU&$u3N0tV}TjTFA2Fq9aI-D8;0EF4L;8VQ%x=6?#d4|tMn@&O$ijC z(G*!m8X2ylbBmH}8J})w=vIla_Ed6-9c>w_2g_{)#6^9=XJTQRC}+lE2=K3e+x|Bu z`hE5LJ<70WNZiZk_r+A3sVVg0(;0CTGGd~;KI#>nj4@Po6dz!*bEBna;W}1xIgb6S zZ~qQiFC)0AS#RXTJ7K)i4kY9oo&=}*RD77|ATPR>*IpWE6dvZ&uRH!6%*zcWXfkjn zdL*o&1;O^zvl!U#Y8N!SukXBFTehCaqaziVD^W)&ILzxmX>iE3lwH}++Kv)v6G6?% z0#}8d)Ooh!(YdiLhp;w}Q8IrnTA!ycJO%UW>)y%Y%YR01?X29l0;@!}L*bA%*b#6) z@@5lno)coPe9Fprx z`{^0&h95mStd0Q;Vz8|1t69;cD!)|sEMY`l#cbDbh^g@Dpa@iF0aWsuhL}Me^w1SeLSkwaBlf^(HDNGQvN!q zqgX68L+A_D_MCQB>-_vl2S1v_R(JbQ+uW>vLkaZ?B3m;1kWu_J3Vu_Euf2YJkJJ&q z{BAGuheX2|Vb7m28u6ll9AL+!cz51|8zjF1?15)@Wwo3wel_q|xG#BLFMxT#KbE#o z<8fl?OKJNOaz%O344xI^05A7YkRT|05W5C(cYa&+tY+D?M^SEw$&;4>GDEKcEYDU< z6pnpIWiC4Kr4i{Udpn{9hwz6VRgmpW>?a%bg1+XZNw&<2zaS)TYRTvWQkUz zbMe}Y6+2vs*7p#xGZu%eFU7Z$XG|aV%HhmF)6q%^=s-tNe{nwM z*7doHI7-E*6iH~(4BGu{z7B3c6ZIt2qi&%MvQ4KNmAB zc2#@#J2z%<8o(jpEY56{erYiPsS_9y`rozPWlLrnjo2jxzI7aNd4 zFg-DybiiKLX#!$~roK;~i?|2yplg(0Pvnc2I9%rkt_5T600W{tYfK|v{JlE&1O!YE z+Tbkk-bkq`sTp(_K7R9No+Oocbc-~}(#OnQJT4t-*Ai zD%?t46!ZpKYtV&k@1Ygwt+XUvMgbBZBEakc>YQqXZR7?j4Sl|sID(Mi^}U;n`qoK` zP_zqoYX_u_Ul?;TuaSdO46@-pZIp7Xw+_S43U9*%_7@-4235YsEfwIiIPfw?d>cZB z8{u46_nJ=KQ`b?Kte8T9d}W|%bdAkbNg_5TT$*9 z*3u?ebI2Sd8H(WLrm*?|#|t(_vwA2s(a=je|0u2f_Pnmt1daCqkFD}=Ai3t6F*5o; z#em-nr1k>+JpDVHOpL&%4|prsSmW&{jAUdEbHcx3{IvZCPx=@p_D};ok64jza8!HF z#^_w*9&YS%V=0`xknf*hAmvEDoNHBeB8h66w_HdKbftPqKnVeok%bci;BoM-}aj*YZPET!jNfBx>RiQE7El$8PwUhIIW8{Qv8W&V6ysgQo|IYrv1f z0<_@YZDP}`BeI{JxkG6^5l`FYL_ox*`aIf7K^nJQV5sG+S~J7;ItyF1tCiwI|i0I3XYbQQmm1EcwKvr@l>Beqlnz68qL4 zVAijD{?Dchn+qr{V7?eDl1rUPk3a!YTFWJub*2@hVyq$WXR0)P?E&Ybx*BFZ{Bzy<*nc7>$_KkrmDDU(ZaZYHcR$_vJeJ_^gO zxsL>&)m02hD1Gb*-$OY4_~y0qO?|b&!o@FlWw3T{(y>N0>=^lzf*l|7UYJ{;>_|%D z67K~nPA3F0%;auG81N6olJJH661-{&cw91E3t;bTM!)Tm7_bAaX>PH!VDjDe;Pt@@ zB}+@)$-0h`V}bDW8b^+Br<%EyIt7;Pfokjc%g?kYAp(Y}gYfTCWv27dF9DRUSZVX6 zy%HU})_2F_nzP}nDE@M36c zrpA5ibxyIX3lRsAFT+gL?Jpx}%x%%tN%UKk~6!cGQdB4Vo;iq;mMlwV5T*^;8 zL7F^u$RzyRx8qlC9@FEh_iX}S>VTSI!Q$pm3d|)H+L{M~?3YRrL4WmWcNBqV&dTwh zW^k3|R!;zR(4cdpi)imT@p3hYYtgm`Enb0Xc@by^Lq`8;mcD(ITLRy`R$av6FQ&KO zZks*jg$~i}nO(K);8K8a=KO@52B9vgbK^E#8GD4~MMe~0z_c*vnE~b-R zpb5lRY3yLxlio!sqK zT~)D@_QW+;0PMU?ksDj*dCm5xe}_fPxrIp+glvMw)ppQ+*vIoQ5WGJY{XviX8hBc& z$BqJ4$k4oRj9R}zP>g<2FbsKvqbPso3A|(he(t7T?@?L9K^i?k-a@5`kh9uI>;>pP zQ$3wTeWSRGslF+X(?%In?Bw47`nUoZM0lXHelI5n!yPS23n9M%jcCnn{7{m?lIKU& z5g6nH6HY%AH4kwB`}oI9(14;Imi;&0<>OJcxw$z35oX!=v|Jd%O9c$j1S%O~902<@ zeUe+_RBx9o9s+sv5zEK)rmWhdlLtQ#xbAGTE>lhnXCQ;_Ch-eImY+W9NP{)kWIna} zKsa!<3CfimN890kvs$rZ&|Q7eae`yFJg--y86=ZEXmW9mxUfA6?d7%eJpheU|EA{N ztw#Co1oHFo*gE?j`DBnTvG3N<;LWf8`TOPyst33~-fR!V2>9MG<9(U1fn9>RRhKKo zrmA;KZM!>=ErMRymKp+|X(McCprHZVG9Gy&6amA;O0+~+kqwLNGr0(mdpfWhw10~8 zLacq-*2In~xMQQK9quV&W3fkKl4ESc$u94!=eNJd%Lj>*4F?(4*|Hg89OXC8# zy$@;-WK0JpIc=SqnrPA@_}?S}o=%^x9H2o7A0}ez#vFx>;i_t`UzL!QZ!Tu93@bm{34-GZp_Cd z8{gF4&QnPLuI(pPXj!~Li8=!9Xc!gtklt`PPAxiA{unLw(cguY{@) zIkevdnU{t_YkznS5D5{Y5X|4MUtz)5Rob`QSH z#jDDCr#JRqKm-88!2Wcb<_=}Q8{&uVk+y5u;I0`D`t#P)=Ka-Tl~e5CuyUG(8GV(d z8+S2Nb;&ba2@6{$6R(gq3V)Oc1vMol3df}kE^F*!jv0$7oY*QG5W2^LrXR2=?8yJDNCB7L9xd7Rzk!6Erzn2X=@|wCMDD ze{jcu*+6^qY2VyFbY=rRAe{td=TccGw`tn9N_XL}B9qPs?fGW85G3v@I#Tj7QcXK} zXW<{lA%0JEY%Y1!F28*)_4%&Jbf@n;nKFymtaUR$mZ7U}ASJUO+_-2uGx3^ki_q?R zssD4$*N@IbVF&^roaTiUPL4F}`@y)9b47NW0M8S`#|(Oq9Ykv3AH|G7AvE0G){hXZ zpfjBnP%IzO#mEi@FNpx#Ab~oXby1FPKi+Z)JtN%V2!(UJeB7FY} z1C}L>1J;d4SvIp$l*Xt8J4XhwbYni{H5K?&dIb%Kbquttq`p7v^nkDLp@HRstx+30 z6d_%q7L*dLB-QeXgEYtz#&Z4qptgo$B&zf3Yj&PkjzQ_WaPr#mqxnzgFl2WBFZqsy z0vFKoG%_s^p%uMPoWwi9DNafU&d5P`6gee2U`gn3v=?1&5ET&w?ep}dj~mB&0bHo{ z!zrV>p`FZQd4kiRbr5~@un>YKQ1LvJp3o3~CuM z4ev_9t7!h9Aq4Hyxoj2A<~7xu1+;X1>^bS4(BW*}Zaf6d4BNG=#s12FUMpmEnpOxr z?`=Jy4S-RpCZUZHab_Lb*!@)In8TZ+^v zh4H%se0*ARrXcOED?Y@Svr#WuyZ^gJxIEsw`!%ADM;LbUmE|e>k@*Mxfv36&Zn%C< zpOfy=<4YzH;4L4U5XA9Q(z#@w^V_p5s+@pcV#seUvv-2;W&H%1%t{%w6pa(3I~yuR zVT7(HPbCCRs#i8rnr{U^_4c)t9Jl&_39Ty7so`rfU-atYckiAr9;P56y~GiUQmKol zS)f0~!_*CFBa^%=vAGBPY*OgU5@v+VKIaNMxXgg&kWf9h@<{^+C$Enbq4r0iD@3S7 zUTJ+vbrT)d-?PLgrrXxfj#1>@oqFoSwn{(*Nr5IJ1x-+ScLOVz(N4mP|WZ{O(4rYv}%>g}tLT zL=nf`wi=SB(^YdRFilF`~@Dc)V`d}1;9*zPHRzR*xK9Rm5pCjIx|>i zEUDsX0>*KRiEEEl4fQ-KN-xsj-P7lPd=smwAY~&Mhrs4BMhGHo!mbP!{r|j*{jt?q z8yq3bNd|8oFrl$=7OjlV+YQw8xEA86mszXUX2Koeom-_jg0(*}(cw36nq52u5q}3AsvH%_0g4_ztX?dE9n^6RN2g%T>eGN@=!TOy(e=#ZLn|YuE zLEsmL;~_Hn#lxUd1MeLkc`^>%`p&D`l-X_90>!a7xXHGYCZQZfJDk=0s#2cUI_s(h z9ujKhM5KeWgzU>)Q^qnY`$@V}2F>8gm20>N&1IH;%5zx2Fq!-9CbPK}3-J|4wkXl- zS!qpyy$>$sKXq&XVdnG-CAGdz%tls~Ds&6Z8o8g_E5GFk$2~)GzKm2IW@M&#ri9Sg zMz6r$0BkJ>xwlBc3_bkV=kQcAvokW57ETn)83f9v}iI zt~eY&9gt5??$+ghhJR%Z?n>qU`uxc3-Q9~I(C<+e0sVSIqM_9JGSoesnIm+LNZG2> zSHA<8f=H)X(nT4`8>G81X@X&=5U&nHXitW-E3taWHMu>0b?b3EV|GLm zXWiF5Gpj}~+Xi!?A%COeURu}wchh1q*RP);p1Ny?^DCO9tMO^>vn~)5`K<65IK-`{ zuDL$6-uDm@pyIz7HFjZc)(#Y4f4>7BB#@0ZRe5?~ZeY`(eAbSp-aE|<`EMyTf~Fxs zUw7S5?v4lQVQ0SKt4Qz@#w`VdV(S|GZR=khG;o~h|xX=gK{xtXnxycZwEj##XjC@JjdcRR8P9R>Gbye$$UhV)06BC zY#3LLRCZ$wHU5Wvw>LufX00iWu-E@IeB!?Ixr;$u=Z_qT57}3{8hawFJA~q0<4<0q zH2l=5tsO1PCn)_Upk1SvZHyTR(w5w*9lQ%;C;G3X(wpmnuYwYNI?KE=4^uF)XXj?Y zbMJXcRwgA~rZC(`s`JOoo!tSaSwwnUK zx>bw!JJRe#O~R-W9&UtoJ6UFD(}6S4M*Cn8sK0dhsb&aIQ-U>y1x?7*yiTlV{|de7 z2@p`=q%L@#1690hcxBch0?C>U4L{J7FV}sMg(O5NppG+uz|FcZI{>$V(2r!K9|AF) zJ;%auGQ5HOn7>=HaGKI7W=;yQ>3b$9gB~LGUMsY!Ck%mBZnv?=9ZV&9kiG7XB*_*{ znZf-=@)nM4m+pSgAjDE-iEo`YPp7Dhx}TW-8gCn^W(DUmi>LMWFH8$!B(* zXJ@u@+T%1WzN2<jM=%2?}yEh%I`W<}eDT3R`* z*gd7|HE0C>3C0aaV(YTu@M?v#a`Iw)q%*X)nJJyzN#Jj!+T;IVB4$lIWb`@$h#9k8 zEG-x&^Vso`R`XlTfSM;b7u-=%Ja?@_ZE^Vz1&Wt;Rj4nUKy|R9ecMT@t>&c69SCxB zfEX@-YdG`k*Aq`fFEJ(wyR{hfehIGf1}Yn-q}Y?Cr$GR-4eiEsW=JC>&=plIR)ru# zg(3Jw${-8;Ul*0MW1HeUa@rg>7Q1WpK-tvd_N1;5&KMfg>>`{anhD|Ji zMK@FYcoi$2_bF#7m_oRt2I(VE$etck#iK324c;FfQ2l>*$#IeA&vB^MuH37A1CS$$&+tMa@<}=*0dT;Y_Y|-FP zF1%%*8Ok$ZoBw*2^l@3s_W|{yYxx0o;hUlBq@qd$b)E-0#Hl9Zc?x;E9eNvyl?T!6 zFe+Z1(0su&ZOyantDK$Faa{jlvj1+U=&pK3x*D74=*};Y%&Z8(T}d6a+cRit3+0Z~ zY-seGzC$~S1L+-CI8PBEwKa?~5B`FlRWu`tqBrOz3?I-|00BCGWkmDjd9aK`+oX02 z7a#V@#8((!yREABDkhuD`mkKL=Pi;AW@fE9=a9>Cg-ALvIEPKY_BdMlKAh` zbd6Z-kS5>=S+DGOWfhl2d4OEo-K>hQdz!iL0Qf@XK9*LtFqdk76xsy<8jfq0{JNfv zSpauAJN)m4HwgDg&o4x3FQ!ua9S;7B&(t^wA*TB!vZ*P^`0Y)XBF-hzz@Ga0nH=V` zcxt9@Ooh5Ck8e$>gZ>c;+lTcQ@jYe@u||1XnKsXukx{#aR&E1P^?>Q3we7_iDLnX7 zgSgQKAogyuSUH?4YaBeDd{#K&b(W`|)8=(HRU5aYqJF3iss0Y=c2lbq?PpwV@joAM z=H3p@wYH_Wd=&D~m72f14#rCX){2NZF2SUwvy#qE2w0c5*(3siGMPqWCi>Z9jgv{P z=db?1Cj?XuJ-N*gz``S9{GUVmt@j_APB_#)0eYSo#)@xD5M9z=jq9Ct)JLz!E`WFO zxAk(<$MCC4n`zIp*6AF(vf`Q#&M`|^j}{p#Hr7`I4&%{TbrtR{0!(D2@{v!lGiQh4 zK&Pl1Ov^gB(roE6%8tINLcg32<)w>vPyOy*l8Cb{2IfqU{zTjbm`JKXidi4O& zAK>ZQvd;idhc`zC1IZkf>hL;QTfifKE3(M{9)&}S1t4p&$o`iB?C>jFAc76rve}$tdR^zj+eaEMw2b68yE%*X zSrvR$%^O-Ea(Y!ss4t4pX(r2&|I9fH2%o3J7I4bd`@*6j4*P zOWnapv?&JT;TzD>oqbbf12wNKbSVvMY&?7oXmIttYuBdWP2oCCoFl|ygV0eT{{4H1 z!ZU9zh7~c63-EOq2PU0j+5~9pa~Fc-_5IPm+xv_Us4u%kd_ixJ%E#h8VEAYVK&C$k zoALX1(zJhx);-EAr5jy7PgC9~I1<0J8!mK5m`qe}cYU70t!U4*lWg{S8OVC+9T!(N z8@1ZsBcZj!cd2F-7U?6Eg06Pk~E2{FQZ=DtM#vh5&{2Y3#rQtJt2W4eRu z1zq16bWmGjd@Voc{69Nyl2+$SX5^|~iwoRpfD)*1`e^Ba9>a!e^-s}h3>1{rFRV0U zR0n{{>gyi^Tk)qi6&BzS1dCsJyXv`FBx^NOpwZsPcGBInC%Kf`_@v@lyz<6)EOSqT zi@dXc#g)I*@W)F1z(kQlJq(7M1gqZETBXN}?jY3K|I~1qB0kh^^WyF@DpTR`7k$YU zAUnTGZ3JcXWoaor_f0!~ZTkOzYK>0i|MI{wLYX74fN4C=@r2k=NguX`W&MpwWlMsc z3awI?qQeTi_lSi8e|Vz&dPCi~(Cr4CoE53zNMq07cJMZc2=y5WAJx5TlFF$WJWgMy z{{FV?*-)OlY`##F)oP)^B5Q&?naNBtG%e3`p85Fq+z(U0UNxDm@N@Axos^%4Y0c}d zO$cG%m8|l;efYS;JDJfP%!%18d2J|?5wX@g9uK(*bKV}<43wzJ_XPp>+`nI%F|5lo z$pari2FUr_i>~q0^#umuE*(Ere$7Va#`>;^-0L#y!B`wuSJbwF>gvz(NA4pv#$Joq zt@M&~xR?DqF~RU{j{1*^(^pj)IR0sSeaqq79)PVF8*{29N-qOs%2baP3anwsJ;9oP^C0rXCTtF#Fl9|>z-(apSl zxc+B~oS~j58H5wX{AkD{sg|tiKDyhsR}`_>Y{(4*B{=!L)49#V>moTVW0s(H#_n>} zXd@qe`u8!NAtGreA7O!&dGEvcG^u>%y4a!Si*fVovrX-R0XYD}u0TRYgz7)>QWwce z3*fpsE4po^E_UeFfCrQsm?^I;r_%dcI>>ZzCaRWZm$IOn9d055-~IQG9KAS?wT!x+ zkcqs2JgGSpkufj0s0se=u)G?CgN3!h^fo(hpRXkUFZVRu7$~&8d|@~EdPrfhYQ1V` zrg+!=Lc4+~F2*^1u}R#wA9-HYIFDvH5+;~hJ26#Pn~(*RWRw_MIDL;~`!x`qI$>;= z{X=xMYLpN1E5!~WY@9%5o*P;y0(O(TNYTL81%EDJi=}s4zVcd=we*x5*SVb2+F= zQ#$emZb~#~2|?RrIII_V5MKb2{zHHU@&~@2CE-3q>tVL1GIJ_A=Eu)a5%FUHqkllh1IfCXs7k=b~SNTqPjd z*)BXaUfB8h9Ta#I1Izlml#JYCUhjlzX4^{DB2K8Rj9DKE$RMMpYv{biaOdEp?j0d^ zcbSur9R|tUAc2{eRM!Cy@)I@}rOZ4#jfPGo@Vos_TlPTCgDW=2F^lzWRYKq$3|?^9>GUCugPSnw+VX_o^azs< znPLoI3ZB1OM0O5-+g^W8WyU4%r}!xcyOS`JJ+56n>+;2TXw^S|=IE!t#*HBBO>S6Z zD@10ul=bI@yk}()S*-D!Hnk-t{cxt6L)2$3HOZ)ADx5KIxzg&xh3{s>Y%H#JxSsRB zcbJJ2aQN2T-XIX~bOIJw^&n7~M#pu@p|;fKg+)cijBlC^Iw|@ocL3hI!UA!@RS9<* zVw^s?&rI4Bb+)TRd~N)e%}jmh4Rj`^mVp6!ad)V>6CIayottAr!j_ZImwPh8Uu?#8uB_lC46C0HR z?GKgTVEl|?5N3|2Mz|{E`iz@+CQO}IiEgX`!TW5ZDo`es7|@U*by-wt;e@YqQ!WH6 zt92VguvTQ8d#WrCKVwHFH%1OmZ!=jv=h!+&oX-{!-?8~fjGAG7@QnOSj3MK@=%$-t zZ5DgZli0EK*$Bj(;~fVQb$rYP#_(?Nr6@eaS0g`l>IbbK=LAr>pW%`j`BR00SK-v^ zuVnq-v@ZhbJ(J8MGy$kk>FI-oX4fb5ltQJ2Mi=aGVgoj1EhQz$vs1@aQ4`XZQOOyQ zV)V^iyAw=CzARVd|Lz6Sn3jFWt1>lNF|Cp*=(P;l*Eq9 z@qmFh0#y)LG&*S2aAzE$$VM5kO#AO?SJpawIn)qVBm@A7WF0~jQ$|NWRjLOsYl(~}#N z56a6}D!rtLZI<7LL$sLy4Zb?vN{XAf4HzG@+`Q@>i>_bdWA)EwDCj6Rsvz)%q3J>d z=qGqnJp3L%fi{7Ofgz!>Y9ttu)e>==?iM?ftFEqY7JJ_7aKp_><#TZ_IG^(CuLWXOChrSLf`igu0vqMST zhc#YBsjyjD24ojM(ZfW&7w>q_O$^CgssBx4LyA{uKlAd!ij{`chmQ7%Oxd8o>-7Tz z+l3cxVT7m|>TFmWgR7baLuf7~FCnpN3ph&hG&eOuo>K7{5CsJd;0_kW=3G``^{A=? zw(c4BK^WtWeeF~8br{FrjZh3=hl2@#3qC{iKRE3FFO#Ms7TgdK&q__-tR@S4F2#~6 zIxr%6Z{N!{*8-2_g2foJC6u1hb8hi%-hZ=QIV3k!i=B-78QQBRs9GZR0Vl;7=ua>d zpdtV#a*p*`zz=rb2#8ujWe~gldz3umk(Ik{NOz)exhe;Ae&n5Q3>eSIif(M4mN{|1 zLG^l*FKUD@RR*iTi19nz+t%|SqL1>DKppY}`!tcVQVNPMDnG*suITP6YODn^WaL1? zhHyJQ(aEn60ORzXX!{VPPLHtPng(x$$YCZ#c?=N%C-yi~zvj>TvpJlBAED;KFO5#O z0zspG+vv8=?#Iybm|==FPtF!or`cI=E6{JQj;hgQGGdE1u)^`Wy?4XfeatN#KOuI# zgKkEiQWWKu|B6OdLHw4Q>;U=Xn@CJ-28kZOPe$R&JI0`n1K-awh+cF-MIDPB30tgC za3RH${y<`*M_sG~LpLwFSDUShEQsxu1{tDX$w!*!Dx(V%d~IMY22~R&K=Zzw_%oyr3qcNby9~G*9Fu<$S-raMVao4n%R(DX%2anFXu2dpBw6o>ev%K z|EUJ}3fpt=%%YjW8kuAV+wTfJJ-MuWq8Gi~xtFueZy>83ouCe8hKk z`m=Y?OsOLUp?k{LX8q^`59tgPS)7XQgnO9EWa=Gr3c zX2l0joG}kMv@vCQ-RXz(-gs4++wAw~t~$^1t%0|-WLRf5Zb#e+fEU)M<|#28wNXwd zxwow?=`Xlw_vv?2-DVZZd z1Fh8z{HBM8ULSAC)se$9_s_ou8;5#RkA{U;M5*g<{X%uv%aw^ksd%h(!nuu5+{C9F z?Q=&)Ds5rPRCjaJ63A9+X_t{Lpql1TqE)5w5WzyH#6BJMH{}(WJ*}h&?^VA=evAAL z@|3tSCE#rtaNKV}_SUno+sHAABEx}G|nkS=SaJ!-QM+_D@Pu6Sh4AnP=m!e*pmnz-3@(=?z!Mxye~o)bl+CLtm6pK z(?`fRNE$$PtG{iNp{?Nrt#%ysWR7L=B}(c}#*zvQ+%!r1>3sKAbJ%tYJ>!OMYX~Qt ziL18PBUvw2BmX037g((R4de06(^~O77wJ|4i%j&bk<@w4-;UuQEM&9B{#LtR6{tC9 zsVjDOzY(RE651(M>a9FkeMmDhhE>O2ezsECH-ujuFoD%7C3lkB&nz4A{7AfLJ;{2v z_lHNS!iQz%rDJqQr>NjHJQ9Y;8Lghc&@g(2T!myww z(3H6_hz$ukxg%2Wh5h$#Ene_pf9pG*kxaTF=A?b&%*FgW7052Vcxji!=gz-NrkSZQ zpA^IKOoUBBh>6tI)E54cOmhB3XdlbPxVzKMG#L8E-)AU4$hYnbUDM_%QJcf)CTI^^WiMg}B^GTz%a6ip@tAgaMJPVIA{vd}6eBp)QIlI} zKh@ZDT=o(Ol%u63Wu8PX{9n&5qw+YEZQ{;MhYDw}Cz>Q1dBdtF5Zpi63e7^P2xQN{ zs(eSh|7Yhaxd&C| zq6x4l6xA0g>tVE|^2u@J{gQNC-d56eO$lErKIOqJ?3N5|!K6V%;IL#w_9djH>r&Gf z1>fCeYW_Y$c|emS@e_UR`JFye)K>O;OvjXP&p4W08D}S1P~=t{S$md7xscNaB)V}6 z^mnUiYSwj}T6F32aT<&BK3ml))qFsj&dcbk&mMw&P$$G`^mF!&Lc7xGSy@qrse>*q zZg@*Df2LGXB4xz-wV2uZEd7%M1F}(~=K8&D;H!J;C$juac zq{_%@oN^#8lDU4A|Ji8yr`Q3JHM@J*T8f)z(V7f`soW%XK+eR`&j$H$pBk*RD5_hq zU0J6i-u~(?LZV#nSZ&g^@NJJw-nE$&W8t9kg%+IQ@k z%o`(;N<8yM!i(0a!{<7@>wfr(pPl6D>f}rt<7tJW*+8qEkxH|<#jl}OJ+5mx|ABYY zpKuic>W=O~EYi%Z_k!0@vSLG~hUNjs-}ige8}`67l6UE z6dUR0D-C#x{v`t*ZAhp_q-%t+tW*g?z@!5Bzt+ z+jzEGvC;i*wGFYmcdPXbk9Li^7Hffk_>Zbx7rti0)u?&5S}0oCyhbDAP&@f#7M>coOd}=PmI^UxR%bz5#y~4yu6RH-| z7xew4;gP$`Q{0?ZphL z1c~1$yh&#%Jeu70%P_OtU3DVZ;N|wi8A<1rwmFK(!*Q>KHR{ps9NVz$iOaxC;{UA= zVz7q7lKT4XK19VntW)U8U_G=6X?x0j3!@+iP9M7a8A`pds}LxiH~ah6wy0vuD2-|n zDou;`T0n>n4r{2VM#U|@hJJO!Yu62eC~R22x?sw?9lO(CHOY%svD~09ju}~if zGiNyzoKW@u%u;)IpcGxhAp!uJ_A&SXK?sx3}TayA|7)V-#(>PJqM^)VDNc86o{lHM3EB+Ib%g78m z2qsgEtGj~NvgxLlCZ#rV#FxF-+Py=fIU}c~6qYuQOKYplzTNJev7xhsQ@Bh&BTtp4 ztuw>Mbd#K><=ZO^zIyDtkAO$dz~fxfmA;S&Vw{j$T(%Tn>|O=)1?Kb+DcI zmS?XZ5VAXv!}zg%vDJM(R59<2JjGU$iRto(5W%x&rOja@LVXKa2iFX}%_lJ-+J?no zt?%=TDwwN@6Gs;fF+y{LX-E2gTI4EJ4oIc317WXdJd5l^dh1B@OJ8dMg7rexPGr#3 zmRt^5_vQnA3hQA_9?x||mDyA;-c5*+jYUIx$D zSnu~uEdP-i#!*Ye|6k+3r$5ZP;?X`$ZaD--QJqg$Fki)R(&zU_3IrAm5#vN5c-Rt2 zfS;{Hkie{;9is3O=!qob?erpQiEnV$+VovcGn0Y*?ZT>jVr}UHRR}T3T6NXs(lu zaQqZ0B)xL<+$k_So5$&K(Fw?O`W(0)wfK}o|2JJb=my$1N21p9s8b(9cr)8`&3ICS zi~rXm$EJczuHtQGkKC&Ytn`eb&v~ASZEs0`ET{~c^sZ^orG!KnX*e(<^NDlL>V9d9 z>>5feQz5?@-?4``pMBSLO9?+)U`u==zrW*^NT!Ic%U$X!8rr&yzS3;^Xk4z}n*Ylw zG$VG66y+3eT`VZ4g|;+v&h2;fy>nP6*J-pW0$1brOnwZ)KfSy1PtL9z44J%>foI4_ z#zzCwJBtw2f9-+px%u2aTdT3ftYpT4WP;F83-C{oblJGAIfJ+W%SM$;WRR3aL3T0G z@iDJ!XOlLwa|&vt&rD5cV(H+ypvF59Mxei{XFc||kiFL4DQGY~vL5(0$GAk{I@Tw9 z!Qh3ctX9CCoLXSzstsKn>cuQ7javzQ%ZSn+$Fyj*+)AxJoL2cVPZi5&@_e^q%0OU+ zU-LAxG$T8OXJ(E{1s_;A22YacmNU!pdZW7GE6QA&o6oYh6G~cYxD2`a{zv2Aj8pn~ zpi>XUJL8W2jUIk`nHU6>s7H0(XSdL$O?yf7u=QHH-AoJTww=qy0H9tP$}(m+}N=l&gdx<@>H!Rm?6KOijT#{v~ZY z%OTSH%=JHtldHjge3*k!|vYCPqeZY2M5_vb1HJR1O{4Fn*7fqMz^IlcZqM&r@#9e9R|{tcU#UTyE38hZwpA%7x0#q8c0P8jV$$ zs~l@?nfqxIGqj}pA49YwD?UMwJzmbviHp1PqY>Td1)Oq`NA^swE#G{&Z*A;2GnX4z zHFO_YRfX1f%)MP3R+e8`*luDfUL=QC6oYt3un#Dzt0y0k2KA6yjHdNCRy(a^3HV%D zjYvBDyE#c*io;zAdv+Fh?cdC{RGDJBA?~?$L)eY~vzck?yXjyvMpCAq>q9|Fmc^#_ zJ{(I$KKwOjdFE-{8H>wn{j%XSB~|Jg1OWmJ4(<}3zrt13cTZJn(k8trY}O(*Jgo4I zGfu9y=MPC9J2$3I*6-d+n(Y7XY5I=4Te>S3!3Bb@ z{q*(z+gE%K$sJQfTnR_qp3k%!cmned>vNSy+j1$Rua~eoj5{b?eZ(alSJ?drZ=~^= zttP)y>zd@iAL_O~&>G$8JjZnIMh#);JQS6SBaQ??j$wB)^-mN)mUe@l0~~HnuV^68ZdjFt|9|uStK&YdQP&$0uw2fA{TwVLg0^ zy~=$>2_j`Co2Co>$;xKxEd!Hpn%K;pc}0YOKKy)EIVXLmU$bAHvEKikdgU1Em*CUK z1XlkFziRH6tL`B9$k8UK$Mas)1Cl^`%&@zF2BX^4jD7qhk}HDh5=cTsuda991WhFP2? zMGEPEGB<{nk>lu|L^bSRRe=p~Yj^AQ@S@6)byxnQ`^K}Q-2S>K|N5~%f=iLV*H55x z4_AyCVSXnK4&(IN__N@n&OA&|kZ6vtX9Ahiw@H-oSR9!%9^k73NB-pY&lVK^2Q6@> zLq&%R`GaFJ&fRz{ai{J{_~ZC{QjioEFqk+hd`A$N=os(yJib3!U@@+_-mmI!XfG=p zlNvRRvhfTY^Ipdab3n($$;o+4QC#no>X+4A(#8efo@+CM7IYZBqy1R=%eLscK4zq*L#uN6DTUs^Zfup=!C`tek%U}Yu* z8Si}2I?^`AXx*c^(;JfS@=DiOdc;VKuJ)*ZHu<8G9S6iTV(%!)X&hgzdBXV)@NMs zxZMWPR_`_20*Zp2V~G#lrvy1e;XXPd3h($Vz>Ew80|L!p(W{p0|6jhP1jjx26sxPY z!ALt;7ExQoBxvJMHXyMNKGSNeilx%<2DCgH@CybvHzbD$i&3N7?vVjcSrDC=W^@WU-?-LeCE#y zwGpig;LJ))tA5KoMXS(eDm4#7?9YcCzu#Hd0GeouGZ)5S_(h%d?Mhnj-GGAFm&7^@T%XFx-Hi{(ZrOV0L) z_LcO0ouhR@O8u`t4w}MSQ@j|l6wvCg;sTy2&w1YIgFya#U(05(ad7I)=`~eUu=pM1 zHRs$MKHhf+I#FO^6-i3|u)=X+z{z5jG!%_`h%2!e733x7z}iXwm=uuMDq#c9G#~1V zu^yU_StQdf&|YZHJkd{RC@p;){Ck=2hCYonZ?y{Ze~P(ej!*yHoG-aiEJ(1Wz1g%Z_nb>8Ds~ zT3+QCK8AOmrXI>$4|Xs3Dotg0+)=5+)I#g&%nq%1zV1z_e)>VIf#!Oi<(odKLoGB> zs%5n-s@Re*(ezMpYG;3@2Sf5*b#jk9AL!r53HP)$lp8)`RezH@du;dF<}(QH??R1} z=<07;Of8Q(3~Jfxk_{2-qxH|>@q!y$3lC|)7{U}8Sox()yN-2kIjRZ3t=PRqrgrZ9)Z)xTDyA{q>gW+np zfTjo}pcH)m?EL%Z+x@OMzmgwC>4COig`|`MP0pniytA5~AdcZ%z63z@WLDUCZqF}F zB&C4Y-G<@CXI{b-&c1qfI2brF^k-r!IF8xu_I`lh=2T8$wdu3ZE40hr1=L9o!J5!- zgEFWOkRSBZ?IbtH`Z-zTQ|iJ>}D( zL$iGE@6@0-P&&eW0rkD$_!kruL`Fs~9`Y)wsPyUXY6S9=-H)QOK8@q}YC$yt6JL!0 zhuj;AT34W?pjN4uQF|j~Q<>@-SaE}ID&OAn`{o}mV#!vukn>_fo4`-*X8brT+_v(Q ze`&&1X;>OX4{KJM*a41JukMyOtyu9iqVFnNL3MRp`&!*y zn}2mlN9^k~3^YsgGCYZQSAK;#&=bN8{#U-Mnl&T=!-tt+I!px5@+xe?unt}f1!=^N zx$_w+wiu-p>PJ_42_w)I_9kKH@VoRrxUjMnSt+wrzwt!@42mmgp^(%D`OHoaCg++n=m~S#&QX(n{1uy>g+5NPNx{z251S!*l&$~A#8iKA{nb3o zxRhij$=%$**5a-2i3qUS=c@F^QApUiX3hEr2I@HPw_<_D0ktJ#=iGsl=Eh1si@!at z79O5124>6DfUmg-gAz?F*xG2@E7hIJSm_b4sJyPGe7!fGkI=PYtDv9&k3#r%$-WhG z87cDuamAI82bI8jK`+ju{G`PFLPNBW)IP0HfIOT~;hC_NN|~kwJh7#Gw9dSFY*JY& zqnJXWHc0}Y8j(-IS^XqYa#;bAUe1ZhNtRk7nGBV%nPO&-wx9EQTA~UPTq_hF$@S%F zpG-x(jUXw^5Yiw>Y!#|!GH;$;k&jSme8~H`Oy~C);&V1n3^+puLBT8{p@#Wq6_F>9 z^kR^V%a6{F5y19T)-$zuEMh4EpkQU@{&mGTE3S|2yF4l{icXKrd-T)KS<$lBHrCqUO#_-v@gr+kbaR+Gy&hHx5whM3^de^uq=`fV=rp!iiApdB{Y!_o z$wS=pMSHjQf=$Yy^`N&{ zz%hwz(d&EnFEk};D37-o45o8DIf}w#Uyx2l>2g+{h?r*WwNnId1%NTJupE{{MF)Ux zk|CY%Eh$0E+MGQ;Xy(OrSoBO_G0OV*MRvl?Dx7w}JK7h!t$Bp*Xwm{ro%&;xcdYL{ zikL{Ka~p?~s6QM6plkk>%Y{xPYTu71w0XD9L$Ii20a2P|Zon7iD;NhK%2l=jMXZO3 zs!cE9oVk%+ZdXS=4?oachL#VB=6o1>dDO+oFFM1XDQve~(Xp#u&uRXto??a;si%b0 zG=AYDC0p?a7rPzUj#eeF3e|y*+Rty?UBVYh+heFl8n0@zOoguos0&~AhBp1!xbdT9 zgQ7`MYD!Qp>ge-cO;Epg=O8k|WIab7qlnA7Rx6&aykAqQy_4 zUmMw#Vm475c5sPU-q0qEJK=!|6c^7s-oDP}3`}fnK%}g;O_dL8zXY#kPgq-`x^lr< zqsy7`Jx^_WiC3tx0+rG09SPop=f_0{qOPR~EPC}ytcv=2dQJ=~4aQgIx z%|AdcLDKNJup83TuzOQKJa;1!KDAq_+8}%MVYQ$A-my7I!|6N+D@-T0TC(qd#v1!j zq;66ozE^*De?5QP*3n1?TK~#YS$-2<^;uRH#jCW}wQhUc81jjo@3~=dM2uD{?$g1_ zsz?xS7Gd39xGhw{yB=NrZ+jQVP_#h(=BVztXkLtJqOd3*PVontg~H&#l=crh;1g!j z@63kk#Uj3v{|W{(va@A1!XnA9^*s4SiMXJQ<%eJCO;O*dRhn zPdBwV{`VDszK)#1f@F90_JBw)gC8zL$gyKP{x{dZMe~RnoumM9(_geOBw;7?B}8f2 z!X7sj4UU2=YA|)mlNO`CVMp{Xq?A%Be}a99)`4N)PLh`$UN+V9a2sTB4O|p7MhfB) z9h-i-|I~_voF9Rs%ob=_Mw=W{L*Vv|#gy63SB?rmuhY&4%o%>G8cW_P-2oxTT5CXp zwjRs|Cmc8>Q5vMm=@}+CKBD{j?Zu*fdO`FqOMw?6YeW0J+AQppj&{(OYy3ECbNs8Z z5}BU@FW30XYRz+2epZhunMu&O5)z}CrDf@~AU&?Yh%SG%KE=e(MHp9vDSQ(th(ANp z`a)E>{6Y$T^?i3NdO@0~Saq_w(!z2zIZQQRI}+bJGOvXwY^@TQE(Z|y*L9$E1dop% z=)xEo$>(^1)s=_NOkARs3zfRSHL`YnQ2J)5?M?tT>SOJJ3JNDjI$NwA?8^|MV|qd2l!g#PGE{ zYTbHAUtRwt+(l9nDbthP7i4cw$NV`wwY@(oWnlOH{oZr~mcLjBbDqo}T_aQG8k)A} zK6^nB|93s;r>*X_vb)Z-Fm2`+_d%4#GQ>##wRzuAiV%|n-64u{Kgp46W%QSQdru%={Txv%rFsWP;S1B?g95qdV>wVkS zXr2rF{p{XK#w7Lj-Nr{aP9ns_>5P-~b)_eFg*h?)e3pY#O}w)q#UNxLU%J+abF}!p z4@8&DgKNXs>A1-`i23CXb~^m=ZATqa*25?P zhip`?B`87eB>Nh5NKvo_{FnO5s}(({1ZCYE4M-v?`%u<4hY6rrY-ntLm@XzjLa)g# z;i$JFxL!K$yZ|`a>I6mM8~oMC4E8lG+B!r^AszeW!~`5r73aIEu5lQ4{4Gb#)@c1$ z7Y1s9OQcCr#C7(-IfWiX^i%O_c?ThrE{61-W5F>(v#%-hWx0;OFvi7VEP|pSqp(+3 z1o^VwCrwye)jzAiTQY5NTMbj$HARR#hOB?KF}S+>6u1@rpG_uSYvJAR2&OBb7Iq=q zukS>^+B&hm@AZq})Kv1C{|cfp+58jEFfaKwh1@lbZabBIUEt?@##m0Unes0J&Z%7D zloDB;nGVGvLCu47fbT93$qLQr2cwTo_i|3;;#Yk|1}F2O8zC9_=}mg3bteV4bIr~e zf`|=IIfMYcJaB2M^$+504Jl$~`bC`F#$r{_KFpnhiPMTaZB*zb3Uu*CdxZvy>WMNA zq)y%kH&E*PsJ$V%_vaXj zn6*LzS{KWoRr##m0sjHVdg$R)wM0aH;y zBK>0n_KShcG$3+dB_c$$eMk%Qh~X@OO7lV?dJ0@8+Q%R(5l8e_b`Gx7rVrV$>UJSX zts+TY=OGN5USQ_)DMo(kubmU_hwy*eIUJ2hn}|jCijqZz{1`T;{i=Zcl4e-FR)j0v z=MoL}=eD~)SwdFgyKMYdD?sRffPiO>&n_+KCYCvl;R&#n5`41dk@-fz!So#>TCs+; z+xwfZLXd`qTUTCj{{>`W(^*4nGkLYR3WQywkJ|@_!ljEit=s^j9K0UfcGjOI#X#Kw zVH#~fs|QI%Fa=V{XU;!f$R#0W9>#5y>r9brAei=mBS>+P7cETf9UddMRiM&x=ECm& zsMFt_%+~WSC=+Y?LaNj6Ww z0Xryc3StK7Sp3|M*p<&iedcY{>(7^!tFqt&HjtuMmQI5PzD^|-`MPpEY{uY+41N+v zI}lhju;(8TpDU%*3!}|9k$>CWSAC*m7hexf;y0I@wFR(B9o|8-w8myplc->kzUbYH z)?H>BGuh5NlhLf?vW!NXuD-IpMYWbxz*vFn=RHO8!wBuNa)PkMlaT()n()^Sh%OCJ z9nLiQC-qMQHr0^9Vc)>-c2(2m{`A1<8p2&cMzm4nn#IGbiQpL(#&o2Ss5MJ-BI-O? zUY=mme{b0jzC?ho9+mQ_Kt#dvns4R0r=|84$!gtOeG+XIgdsA0v{ffSp?Pm zrGGTw?;DUiSrV7Fn&=G6qvE0na8erdTEs~UDAIZR_R{8tlKeyH6zyATaGLRh*QC8Y zW0=;GI%C$_3XbfnUug4gH;dc^YZ?)En#fLn$0smpVJPSiwNlJkJam=-9Y8)Gb$^&? znl;K(MY@1WgZ?KU-T`bR*fu-_H7otL5xXne9Fkb=ySu{d{;&9-St()7<>rx3TvNxUb?X zhAyF5I{(h-zI-f{+}zBHUJ3Q1Cw<_~9HKzza=xp9KgRI;g;1H=hy%TP&HB-K3LDSA zj}Y{Z;~Wo?Pl?KeNli-9?)1$f%8+b+c-&EotY6YbMmi~^d6iaQ4NgGq z!|E>S+{!P!_BD)EIB4LFsLC~$pc#JlF*!Qhd{m~HB(!bN!`tF(K_mt`($oG~>A z@J8)U(=vs-0g58TFMo<%>zq5HfxrLGG7iL64sO&n5;9kbE( z-ZX-II88?L&%)riLE{rOi47;^ktyaGXfR&-WWJWCWIW&z<)?=ArK(}EixXgokgVs_ z%oHF-<8fc&o@wrR%>DB@(XW@2GFo+3USubG>h9M_O%Zos^_TLFVNv`(iT4bb3CU64{0OgX)C>n?Js@yG>exY|%8KO=Pbk26Fh7~N2$Y@kS9 z(4TkuUkJ3Tb%TW%jtxLNgU!7578VvV(Fsl7<*g6vdtA5Q;9NC(KV$$DBhU^~a z9lv0KQNtvT(W1+49^Tqp@Ii%fo8z3%1hK20mgW>?L~+uOwtifDmfXc5RBrdSaHrU( z;w~j`aY{gq!M17`Azy|}{X&yr3EGa?PAZc6Kxk^`Ar81~M zdAhSdo`VO@PD|IQZ0y>MpAmT$_KFWktpeJqm;=?YiVkwwT(B+U0;7 za0ggCrzOmBVY;xb{mQ$6U=pS9KzNYfSUrn%DbbuT>ZEm+Egz`lHyKRMZ*^7!BQ+bY zF}*BIoaGk_d~B&69fM{*e2hk$?$soZ-^H|PW&hGGC3~i)GG6&>yiBBjMfUP6(i@c@ zWPeVgrnOem)y!Gp^f<_xR?HMmB9NI>;|<;!M9;H2R6SH8x9r= z&YB(mRlVNC|GCGQE6=VqxvIZylv!?cIc%)Bj>U01Iexs`I$ji5?T42g`>oRXyTU-h zETRp(YvnXx%54M1ryuht_(Xfc=kn0BzE+ph7ndl}+1OUczNrwZ*N^LV{e`J=yl_?~ z-gi|O&c)dGJS8V2Yvwl^bT!SBY^Pzy;Bj6qr8(bL0fWe12l;p*EKRWdcMJ}KYyi9b z((`b0bpO%hbfpD6qNA;?u1>?uFiA*5X5XB`krCVOZ@_`Cq^L+({}`S(196Ko6t%RZ zv%&L~%zO8xZRA1bo**FXsUc8sIg0Cj<{>g8F0fp#yZ2O|;Zcb|^-q^Qs1+zg)b*#< zt|*g2Mcn94B2}cIY12aP&D-<6M9*IniHl$kjH_;ibHHoEd}cA@niX35cwE9AcF+SN z4OcB&?er6lY|JMT@=o&^!Bq5k*&9GQMIIO7ufD>!m6wyWdboJXPD*_j-{qiC%XTOu z(~at`qy!L9z4B;9eUH|@%u490tvgEcl)KX3YZBS^;uor~{-R=z9L|;0Mf52>YC0dI zaal|?Q$`ls(ieL37ugTL&*b`Mr~dl%;8qa{mSbF*dYlwrjP!UZwQ=+IO)H#}#S`Pt z;@aIqY=3DjO)imZxP|S5(kKP6I^T#B>YLhgBUS?~Y-fUG+lQ|RyWxt>$oM)P;Em9b zd_TQKEofX0CFn(&X(xuRc1l^xQ?u(J zV04FT>^#f=Gkn620?pztca?yw?Fi8t>H^YfcvoEt8NvKnKRw@N=9=e1t`tSzUo)X# z1`9b}r{>w8?Zq^tfUd5;!sfT5!y`cc5joroHKpY5YsKSwvVhkqd@}0!}U7!wIpce9fSS82K za=`fWUi=eRGqJky2hLyF+SBgKfo)Qw6gr4gfm`{cA|;naDvWR*1MPuCm^(j3c3Jbm zMU4vyGZkO$S_?HGqjtmSUw%=2Fz-wFm2B#^cCqoh$qduRPsH}LA*l_91;-QhK-86? z*$hYp>+v!IbX|R_a_e{73?GtfsQEv5#2UZ>U5ObZb9h48JQh8Q>*+yQJ9c4_Zk2vFk>j()N`z6yV{Mo zJ<>#;{^YFfZ1K3<;>-qPTYa&}9R%K+jsX+i8CiFJ_^b2UTC4K)TU^rzOOvV}W~HIP zz@5nDX{N;1&HjZrNuPzlq7!o}VEO6!*O|{g(2u$hB7`n(JV8&6Wfp;N1qy3j%A{D0 zojDSn_qrm$`dy)4OM765jesvvSh6YiWuD2W^(Z@3F0&A8j$kX!1KU4;h5{5Mn_ zw6XR36HLzYdbmWU=jKb-W+YpGnDh-jy%z8d?9$6myD^E@Wlqu4KXUxxeoURh#{DVg zp)OX2mNn;np8(;wSKcA+>5 z@eb&?%J*bR2r22tYepM)+Y&c8c=5Uta;;?Mm%^Igr z6?RwzfGZaeq*pcaI=`aAn0e1+LY4Z;VGkJ>u(#;wk8mqJec3$PF8V0f8m2N zj6c-IM&)d_DLB5t)tOz+;G%3>XD8=9(h=f=2F(I2bdVL0GXPM$ya0^a{L>3$0K*y9 z96m*!!tOe3Ep4XZ3o|>MlCQ6D&A@_7G~9zDGS{lgaIVE#lhFGt0Y*O8v?LSx-{W<; zgzq-S4zWT{yiz2mJ-eu z+}lWv`;K?``C$BSE!&hnc@mx%0y^2We-Y&76q;AshZTB#w_scb1YGhmMUn@x zFI5u2(aXMQ2?md{6|Z~Q6t0g2!FN`BC;|HPz~80rya-)c*+^mMZ3P)9EdUBuRbhEk zv7)*z`hX_cNsrwWJHqlDLy;ytfSEZ8^0zw8%a_J!lx8_2_Pu`@! zBO69JXCLIL4yN<9&?-3CROAf^F6|L`HwkENL)~vHOzy=F)G{$4O$N|m%_2*?~H5W3_boaTwr@gDA*-*Qp z-5-+@Bp-7J?VMMwMMs+as?g!w$=wofpyU9B6vPj-V2|>++AS(B_5-L3YYr{qjPIxb zf3>A5h=jf(WcK`Ua}2ePNkk-LwLQa7Cy_{1lPaR~B`=le6riaxw@o&HV*iW`eAj*Y z?Ve;O_9oQ+YV}J?cQ6&5PGWOC(awiO*0eT(yWwE3S38w5fR+2FyGTlSZz~T_u@3~Y-{~*+#}G;VO|kjp094Hm>LOR-0ev-=!2*0)F@o0baflKV6Bl2-(%(B8O}%GQEE zq82l#Xf35*5#UIBAJBU9Wl^iFwpG*+j%qn6=1Mbf&~+aOa0#EbFHMwI1P+sPpO`_@ zF~mtlp7uHu8GS^z zXP7x)z24z-wL6;0Y6R!CU=8$^Pii)Q0HVz3Zxn(bM8rhu4O*h*Xx{OeW9|q~TN%L+ z(OG{S-5tx4Qo7^j1CPilArN`J4b~dp%0n2Ewe>0mUV!pqU2e%bMe` zkDrGtAfFQX?BaH>1Oj5HhKY`bC&=rco06GzXLzF$lhgARueqU=UUrqRjs|(S={Pk9 zFDkvNMhD%)Bf#&!5xtGkyuSb`K*i?P*5Vr5t8zEk6Hg?wF>USgXuis9yu;vnfAX01 zT>Rj-?Q36OpEaF7YC`H8{4f+-;h0}4(8>}lyA{0WN;3(h|HOv!?RDiRs180-Mxxr` z9M?-jY1Nx|LUv4c>>NreR<~$e=Hy5mj9%{tIxM}HZ7@`;d=0Ls{(A!v5V0lS_nE44 z%N8@=ssdJnZ)G~n9s3OfhNq8Q9pfV^jLkfZ?#xNlbW%j|tL}Sw(h!+Lx3@TgB%{8@52Qn6J7_*@=n0y80;@8AHS%zhDsZ%U4&p4)+W4M_iiX-PjCD zy^j1*Q8)8c%U}^1iMx_nnKhZiO~YYgtdO4+tOkHoB}QY;wQwMGIRCrHtGA2(l_!JA z+5`oi<>6e&Ld#5)yNa-_?rF?s9?QHRtm+E1!ajb2h3g8$37;YyY5?lEJFo{80 znP!>xtdrIQVVnF=hv@UiHx0i?pUkuD*49>8Y3YL3f&!4PH1sj^@hu&=40AnNXu;j` z0bTJ0LuFjT8j)|&D<8QlK6-7yY5HCfu%(=KByC!|UQpJVj&5d)vI_&l8Zs?siITV? zExLXYnBy&6jno9lw5Lf9%{3ncvc`^Yp zbQ@X5X8NppJZ#6pkeB@x?0<{vRCuQHv9hRRx(oNzIN$!(Cbh`$TI_kH)OD?6bJ%6Wt%2nHMsXkz#wZZ`Bj|`EdK*s+_)m7@re zz3hs`E|5iUeZkM#ozkeC}W zvwu`JH$v()PhOrMH7b)g-$bc{sxz;ZYV93X%I+wwqV)2+0a>%`s+{YY6GzSHAHxo- zh3chAT3K6`lj?UxKOBlA)t0ZR1+bZu&%wLklXQ{qe)ynLI-rz74qB#Pq5ulha&)IT zd=#jcG?G~jm>|%(Y|l@5sLLH2r+-VD6i;u)CVP(LO-e|{I!~6jNNVh)JAZ(zMFHw* zS%AAB(Q(lrO;{BpD@Li`2z8-HI1&6y-wtG)F*aUVSY17FVg8rvg1vKaS4JeNevKi? zW5GzEeiPHZ9A*!g?Dh`ho)HviFE(D-RJRezy5#W2)GU9ETO%@NL}3JZmA-E;UpyK$ zk6%#ce-}P^fR1j0%JOnrz-Zk*{Ksh^o*9m@jsYzy%f^*a3wI<9D0hlp}7@>5pEVAC)Wtn^9= z^`)_2XMTS|9#_tf0Bsc@cs$#Ds8pZwU0Ldfk$JYpYC9{N%bnb@S`w!F{cKmDT9GX& zm9@Eek<)Uy1dZ;ANH;p9qJXape z@#btELKjK|*D(M91A_K~Bm7R_iizF5rHMrpET1^TS1#JsBCpU`_!lx`3RK_rR$zlv z-X~Z1(p2@W4FPyijV+L>#`O5R9`o5k)#ZBB;w&7dNKJ+t&_3`qLUPQ+TbM{;>_3R{Li`&(T$EH_5{e*2%--_CGr;Ij8*T`@u9uOQ+^9kIN~EyrQBT47(m-bjpY6U<1^Jbq(R$%4FGR# z^?=GPXZFK)h7a{|%$NLwYL$WNnDNRMPLl&2;Hm)sDbwFC;=?3xWZ3OEd4K9_Vlu37 zAkv#;H7?$w-U>atf=XP*|Dh8bp=(N>;a?N&#iVm4R7o875Kw3QibwfFsnm4K98 zGT91acL2o_!o(M@OCX55Gv#_|qpS+UOywy&uymWsb$^7Y!p zfY_)Hkb;KAi#we)$GNsY%&~^AcYMkug*%5Iba*aT>*uXc1C8WV6l#n7=}aMUDTLFP zba;xQHh<0(^y2dR9M1ox4lkXzLp9M6Q;ZX$%sw!haLUug0EDPV`Y+B;O2@`>4V!bY z1!$+udOtY5V8Z_j$tOSKUc#{0r~_QhOV6^@9cXRqt!}DCH6kG)0SJidU{*hL@Lqh( zLa=1zNg;@c)S_UUd2OoQX@qrqC0wr3p5!u+QgGk8JfFX4pJzPe0fbS-<-I(tsoe-xI;70`s67T51n^D|oacR`1)F1uq5S4So9v(rOguinD- z%l>LipDy^+vS^LaK!wo7l~_z)yqk^K_0|3ZwQz=}@2Y*=#h)$HJ_ka7-Y1@~$06Ln zc^Ux&>BOYh1$S!5sFmJoz5dftV)&%FGYeBw8jJ)aU`S77b8|qxdSFr649&lLZvuyN zxB*?K)j6E#$X21wd;K^J+J&b-&qYoFogmx766DQvGB*;E1?UiUN>Dj9O{j|^cC`&o z2drjpU)lbxaYpiuX)K!dWPp3wWTJCKYgKwLXJt;Y;WkX&R&T6jApmxX1YO!D6%Vrh z+nRKL&9{DXd`=B>XX${ zxb$wk4PG%+c8)WvD!+hK{kPcXTe#Q1ic8-)NV3RD^g`6PazrtPf&ul^JE#Rym=eHD zn|i}%@l1Bh-^5=%<|!rJw8d4WZgp^)7{!aH9h|npv}NPH7Kz}~lF#*g6gb zUZ6(Rk^d;(6<#-$q^?C(HWB_&@3Rm!0%#1h?~|ZrQfQUH)$;W5nYOXU4i8f`I8CVC z8|tT(A9sI22A4L1i%x_x)`J2y(uMx`EJl@~Us3*9@tW-H)OA05jkfDmq#ExkQ8GPU zAw&3e$^8DO5nT^UKSGnEq5 zXR^w(<>4iPM(`xdRYg>sS9^V}3hEB`>#t)Sh>uzm8HnEBZ`ZP}NXlMH4!*);6LI%I z5>@&|zWu9oP%$ZJd4%f;!g>p<|04L)*iPNIfSeI>M^L~`>!MI(@`La~A&w2pD>}U$ zr*#X25p+rICB=S3CEtfLqU+Qy_yqG;_kA^RFX_YT@ao@1O1`Nsghfd~L8$3G4x0fm z@amPxJwBqMTHYScX3DZo*I|&)4$&!?hy7I+KYwq>#O~elj3i{TnA7U+0Hrn_b>nXh zGR)T|eyNld&sS!>wHPR9Z2;g8+btMsW6t#Kxy_Run^cB&dNYH)Ta30>-1%5T0W5A! ztRi{0Yq}=2>kiE7&d8(0tQ8MHbRFhAT~UqZ+1@tu@vJn}oA>C}l3Q15Qwz;shmyyp zVV)o{XPSpYOj@f9X71{3np2d=l+?nJojoBV4Fn+&&*mKjHI}NdZ~-8!DS)pozB@8uexz;Fe}ePNK+Uv- zZ-4LCw8W2~!z&+tgEaJrJM_NGP!+9<9)nGH!j7J5oeD; zU_F;8yRS@QVUb&!ZI=;B?`fnfHO^Yoak}iy(R=2whcH%UNlDB=eSx z>b`Q=IE}Q|_}H!)HKiWPo@gfwOD2Hd)msvnrRQ&WZ9j(Op!mE85|lee7a(^n!jK&L z;%q2sI+`J-5&6h1v#sYjl((lutj}H>Vru(LhhoAw?4=QFEQPViP|lM^-Sh;AG_NlK z!PP`(%fU6%ai2ioH+>XtcunFA#OL1bG*PbQIfk?Eg^f`caz{k)`sC&z6e%vn_FwE| zO2P$ag+z>~;vK|l1Owrm;Q41Va&OWgf$i#*8&KbrnnU+_SIEBZ-xXs?$jB7=y>H}Y zOb!|>-UviwYN5WKTN&nk64miH9o}_h2N*cce{`3uh1B+_4nHBMyXSr%tD6ErZ;f4m zYOqv5#0ki>SGhUr`(7*ce%}6_{^tQ0c3P|^;(c!{u=|?pS3|)p)|M`XxKs$HOe)&1 z1ri3ap^f?)iPXkD!3X?}?+r^IhX7DeWxkPZGP)Cbp^RYu8uBVsdDa?2R1D^tHc4|u z`cj3O%%yg-{SX5$>(kva>HpSRz*%*OD+)6~v!15Ckf*Jt+J8%1=F@0mEtA*cs5#c1 zi~&SlHKntHrpl51-xjxyq#);B&Kw5UYzN??5p{dSFMQga2=!B-x_;)5GF@VKBN5-%yDhLE=kDyqIPs}2eqzr&*?UVyn0%38bA*s) zkD)^EypW)9y_0@xy?dj=+gziGo==^3r!LaZKFnd|iaVcR;`{&*@q(!!njaOqGygL0 zghGwJ(BBwfPQ9yZJZ&YD>qA*oCz_ws) zvF16_x&d%9WE!}=i}3W~oOH#1sYAJI?O3Y=LDo1~-s5ZqiJDH!=@~P|ovD-KnWNsH0NsdE-m;tF5v;RlhmA$g( z#JcKAqx;`1lF>5-Fe)!P233_$8ryl(>)~=k!?~gUl-o)(P=KSzhqbNJSEdSGeX!Q~ zPz@Ap_>j!Io#dlDBsIoX*brtL;EUtKXx!VIl#pNH+wfEe`#1#vOaUmW2&ZgIDi;d$ z*`aQGjrahV#k8W<1do}s@I3Ql>|YBYYK_Q``zB_P#-`=|V|Q`3Nio8UyJZ-_QKBDS zfS{|HN=D?ouJZDp?5z@OwUO;yCogZ3fV=sz|2r{4*Up3d5-Fe}0>anv?0Z2R2AkWZ zQq_+KV1uI2T%$TaWgxs@HeYSBo1amxV`ivEg~IJ}hN>>wD;+&u0f7MDIS_lhYf!_` zA)tAE_s~}VwxU)x&W{8$qNDNd#y>oP$m1BRiITyl$;)@#Zp)J->cowKYGlT3X+?EJ zF1hI9*>CFBFIUMZh2LXFCPSc=bh2VKFBz%pnxnLLw_GaxHuG*x`3T$P3Fx&WS7{+Y zE-EN6UGFf_b!3-Z1m15md_7*bVi~McN9d9-9?cfa^qZu5ULNNYh5_B7Rj9W4z4`($ zISnIYyYFfNwI85&Be*@y0+#ubUo9RV8@MhXWT_6;%*>0Cwc>K~I10v8Vp${cJL|Yx z!^DX_>K$Wr-{>Q2s@wOdlMR9svs=0Ys?P(DOTULBcWHMNvGr&CcvlvMSRnAKqrL7^ zkA!$@%5*GX=5eH^*5GZf!vee74Tt4+!cki(oXYzEKK44%yvgAXf5(dEpEri*chx+E z4TR+1J3*iZ+i9>2po4Qhn4*M)oYFqVo_acpQZpJ>qoz>eDoGYLf6sIH`oq)k+jKED z*9kOXb0(~Bd+Hg_mdXZtUrWPPP zPG76K;$gwE!_Cq-eM15x$^Y7TASW=jq;Hjn{`2vI4A`%0rrE{&21>acx)+|qO)L08NGtgYy}ve>p3BSERHY78A+)j$gzJ&zFNqKn^S0#N{R8vLPS2oYVY^k;>@fa!fZAzRW(m z+$$xs+mhF1+cyeO0bwfOY5zRL=n>NzuCr~t0s0`&xuRx;E6`6C_$10ev5u^(!0FJ9 z6n*D|m$9zBI~NlwgJBfrZz*{ZQ@KH#}c3bb2&-U*o4wr43Vsi*OGwc??yvcgmEdw2J+JV~cj#%L_ z-L4>z_8y%YCuFrz%TLy5ooEB_DuC@aV1QAv6lVz=K=xCnX7wtRo+|U4{|X*PncL0P zs~1k9Mcgz0R%qopj$(cDImok-8N(G3+FqxGfm3Wo=7XoJ>OnVhKnWQXk zYW^^a_?x2CAh9j02{{r_ki8~j@X!@YKyDG|%dB3-TU%kE(iFHrIXn)5z#}k@1K*nR zzyp8p4lG^$SMsmlzkdTM?sIyH4Ng^--19^9;7b3JHV49^iUVWsM-OoSzdVZ!A;0&( zot%4J3-C)bX3NA|nzLK}h=3r=LyF>mcFKWs;zI@#!im4e*;R7rYA_nbp}e@-@7%~hL|JBYq*A;cUX!Hk?IvP zIc~?0jPd5l-s!*6+jLl3i?qoIGnG}|XZgVT4*=qd5YVwL;8cKrpM*1eGnM-PDYSvj z06eKym`k?+3T5Fy47D9Y_r+kwWaHa_Aee zz!i!&8X*X*T3;NP-w61hfci^t*o zTI}7w`SxQB6kQOMI>V5ob*2PrR}u*IjZQj_0@Beq+vpI>cD|??P?axVSv2`fgq#l?4co=2f&Qj!Iwk#96(Nfog>S(lVh#@ z=~xXg@oRF?+%CLOTg$u|me%4P-fu*}Otmm9od$`4hCoTVY_U=7>SqJFxH#I#+5y{d z7irLRCVh8zcN(TC^#ZQP>JNIAA?c$#aGLr@+?0U^8;mIK_Gjel>=*So9O!oV~;#hv)8MB zaU+V$z#fO!Pn|UH^gAmU8Y(|OU-!4U;j&x3ocE(pb%}tmrM`i{BY)-m=X|1IX$WhJ zGg=nldHDD;)>$$W5_*W6HGl$OuOBV(a|ffL?@sEIl!>@!6>)c&;dYE6{#Y5PUQ;A~ z6K&NcfSooc^eh2KM)!8ZKJz`k-|q7jx|v;x?LWMnpgLX#3@r2mciu|6{Iew;v{1kunDDnwhdfrA;w- zHKqsA2eh1S0*iYV2JWh_|91<_NGdBR{L7*+T6B8)a$o!G7d>QSO3aV%rf?YzJnv*k zbz0WLCDrz|=5}!p&HDqe85G3>c7^r0;58JArzxqal?*Z2L0C07woX9l8T$&hzXjt$ z-ROd{)_yv`$2eBc0oFA9L`hjAPrnMxmS50gSa-Nsx_^RsPi=i#Iy~?k+}@7n?^A_r zX_HOIR_rixDiJ#7GcM$^QHSQ=mw@koPaFRt(=vwdRr>YGRc8!fOK(q>#i#eivW87< zvUy+A>z`JJVeiI2;`!fmA4kW=nkk(Wgcyu-87V;l{?q~}q#KWo2ddAs&zQYy5XYUSw_BqYKIg;aHqX8H<_BG$93YszR5 z%?dOYw2+_{$|9|fM{OUfVzZx4w~LSK-o5pTIOUz zvv@V)z5TU2ubM5U_vN+(WPW(S$ITHnYeL+ZJ3rCuI=*rh_&%*{<~>fzt=^;W&qAyp zJ#LDua25vOo&W+!{fTKbSjOc$%N>Tp#n?9hBQ^YyjE&)ce?-Z)P-m7Ij@T6#-@Y)D zIoY_m9v9BjZiNYKi|>^yGz;b&4}WA5zP17aVAP>YU4UoUdH4T%y7EA%+b90WODWxn zHqp)ItVD8G+g6AYS`m?>RdTh+wIv<4qJ(4}Da5iOr4@EjKSkD^lEUUFBvFnW`-Jo9`ezFhqZci4X&3M3r+#ct#W`<8XgQ?q$Zv$DT8 zqw!b5S?#;O6-#%yElIx$HdJuue3Y*>bk2P*Tuwam<;bniv^WS8C!TX03s z8g5Bi_0$Q#wXNA3+*KSe$B5m!Tnb`3LK24r>E!h zw?2)JozNzkpq0N}1w1LqzFt%Ppf*XbTCVhBgMJ_+UKp-p-ne0DWo2b&S2J^PB9UfY z8)_cQZ&h6r-s$NZO>xabw)~YD;V9cMzDR5CzOK1?C3&BUc!iO4wUb2MrjuX{4$G!J zaqUc*elIfkg|K2Co}3S-7t6lGF`44a)^`m0w{LEPv8KJfo;JLnw zW07TJrYML&_sLOe@OrH^H4!|$v$8glbNd&87qb4Z)2rP%zP+`{uAzR@Er0slCnHO8 z`MwQd+BN6J(yKSr@60}P`l-giQ-2SKy%&2r+cYJT z3DU4r3w*}6EnFP2N04Ad-L=KQAQ@H_ZX$y=CRTDH_{UXy1G5>&o)?#1u3vDe0>Aj7 zmrVD>Hn#%pEp`{lz8)j&LEN922XsIpajsOPZpSF`GmYOCzRBi0L?UwGM(LrxcKcE&D;1eug3E9h$yl5*}Z4mgFdM-%&a7c@nTCPL}Wm8 z`id}({46*NBUvW;0XT+1(wDf=n$^*TzpuYLz1NG7@NnPqtq1o3pIUWeRL%54oGJs7 zO+MJ={c3X#sxw?ABnhSG$&gZGn2#QH^))jF+UEO*l=yd5Ocy#&N27(aKAD0ThX57E}y-N9*<${X2dyGrzi*w%(0+S{K|} zS)H;dBRhfdUg~kdl@9!;az~0;5Z`<>Z$X+&+A8u=q5DpaQnD7aK6n#H z&MY`^>S4jT8SUN*Vp3~e%rKn(?2F5IU>NQ&aGqeKWt@|il8{^9&43%F^k+V&c&-+F zsNqN&yRhTJwlF^|{p?9uOrTgaRA7GkRKgm zn6Tl9bxW%VzN6dI_lLix#9^vyXkUe2-mhdmgRdn}hpJ;A>KAqoF**K|cn@KBViyJ_C3P@AO8vxCR zoE*~Qm_=bu%|-X`_wi56{Nd!<59ppcW zLwxl8PnGpHS_SV=n4BChPqr|~ZFA9`O!ndH1eD+smm-rTR9JP<-s=$&tuOu5j0+kb z5DVHFnG;`a{xlo6sM6WqJuNiiEjvXO{?D>I+uP;F|IqmK@veR+{><>3TeVvXgKhGh z$2xDy$DJF06jU)-kuZ96#h_k(aC^O7yDWcbGCFzM_b+3QE1NO(BQ9E6i97w%x~dCs zC78@im!BetiHTj51DCE1{JSJq4`GOTLU}R7O}zJAgs8&cf{9O6V{-`NV=DxHJ1C89cdO%r$1nrVAd0sfoaB%%nf zJmPOC3&3D_Rjfv6Rte1S^y{TY${TRGO|ZBe#;i+~PaaW2P+3C99-Q-VVHg3upwaYF zjSn7FwJUnXZAFOVjD76!sF_^o@wp0Uhk`aQoYWC@Jw{fWN81Z8D9`A8-6|H~U*3cI zZr_Pelo+NXdtA8m@4WD`46|ex1uulwuEFGs$nrm_t{pm~s}lpg<^G1W|Wl1U%cYWeZslI;gL5)WGH1vdRzj19_{2aRq9th8OP@kLMWc=8RWS zd94micfmp+k}ZAEJQ(F>^bdm;GeBBs85Iwgi!KUC^sWIchM90&QTpTk+9L~1J|^b ztBa_P>iZ(ZsYT)#GZi+0E34c;r%hb~^#P-`w$AnmWGb2D^}rK-84?Hyu%YU=OBUmDQKIW zwqH^ekI&4?a#V;!s1!5&oLc;{u(#j}f5dM@)N{LqX}*t_-;F3!I7D|)xC0+z^rkF= zA~HRKlcm`6Ww$pF)sJbQaanA}cDX`cHUuJIkSW>Ol3@f<>SBz>#}EH^b9Etr!^S$> zIcVV2>`UKqRYg#-jBtpCi4fca`0ZEu+3xBGSAvs@kt&nkOos9nq^R>X^$&?&0qV$K z0edsv$a_tL=cXjmN5M@!yaJ-a6=rZ95L%Zu7{50JuzV>z31t2WlMari;OQ-SgA*1O z6NfjiztnJ5vFM`O@v(Ga+6iF~OQ0~IP^&vuXkl-e0eOd8DPlEEB zBFX7g5l#ixxMBYFHw&Q%jP=O5c;;{a!Oxo4>AC^S7M7zFWo+c;4X}3Tk9Ua1 zI@*CVN$IYVqVz#$IPA424GP!9I>vbRHQ_097NE7W!+B8;Nw=VC)km_ctE#Fz!`0Cn zOgWH8Ml-pwq2XABWjT1tSs+|^mH$+UQ`^OZ#^#>0HhcgJ75+Dy= zwtVxwF~glq{=fot+lsNhNsx8o$z#?uCr|!bE2nB`loSc`!RQ=)+C}c@A zvq-32DCh<}zYR19B1}G~(2&J!TMS6wB!yTWA`o6bb8q?Zb{iU(#uz?y7Qkzuri3zk zOD~L9W+#qQJ4;_ORJ{v=iLcJBDpR?Oro=JH8c&Gd?mF1cPVTnumesrP8*=^zba5yM z%UDO_Ie>ve{5YxL6?Iu8XvOS5+BsGUNlDytMyjHOeaVHGM3N}A1v6IEB1edA48GWZ z59DmEgs8s(M%iPZHVxaAM$5#9Fuxp``?1s{;^N}$1!mY+^go61bXo?h4%D`Cc5O%I z42 zv>Xr4&9ygOPNFo7p-6G9zWxm7qNv~}Fg;9IFt|Js!j@cySnG0CAQ1mJ9U7s9iI;>_)CetNj0y!+09aitV z`#ao!ekp+#iKkD0XZiHj5pf(G_SR5k$ndE;UP(zuAjxBM{}ot7j-Pu!T%ugP>3rza aFa8`e6_KTs+N%QNae#1WFLSrUrT+sJm4WL3 literal 0 HcmV?d00001 diff --git a/package/appserver/static/img/escu/Slide2.PNG b/package/appserver/static/img/escu/Slide2.PNG new file mode 100644 index 0000000000000000000000000000000000000000..7f33c545ca64fdaf82e67ca8ddb19146ed71a738 GIT binary patch literal 75290 zcmeFa2UHZzwm&+61VKcQpkx6>vLul>Dgpumk~4hdFu;(845K0Hvi+^oz&AO!^wI|u|K0RD(T*g)tO5b?kw1K|K+EZ`4>MGe9|3xfzg zV$u8+&cNdRi~bW9-&vR($UEe31-kGD{qiy`2p>qh1jOw?AW}-&WgtWVoae_m0_O;v zBXEwuIRfVh{9lQHrj?y3)YXacsU_4I$|z-O&(_f+DeV&RZtoiu_N0B&(ltwmU;OrITC*fonpk3G(F5q0iKW!HlwkvSrkY2#O z!HY-sKpEf2;VKi~a{}^*ZxajZE;940Y*H9I_7YOE2u$BZo;K~QW&c^jUi^<*_E*FH z(XLU@B^)f^=HZZnz@Yu3+n}Upg#WL7VO=ETdyF%gsRz+9%VhFAc4p4tyVPgP)$S+U zIm$jSH5FPU>MWr!Jj$|KkW6|wOL5=r^NOr8q!oSKu5;PE>=twlO?EcFxN^QGInR>c#mPIY)->=-ScU^(NdEj#bJDW z{GC1xK|F1F-0SF(tl62%FQAme9SI%gqhMGQ%-fiTo~%8)ZH+7BCh~4ro6_i~`(1>j zX!hsGnhzpU!YKTMLB%5DM|T9xerQx2_@?VL%nRl=T$&ArhnVQ2q!c9EFdf@#DVHQK zQam=&YA1{NJieM7p)?z=K=xoZPWE1;sJl$X8@Qy#j{^in(SwEl55eCL9dS@iHv=Fu zQt}+ZaUWM9BM05`m8GH3$)vKDwuM8DBL&(woNcr1X5%y^;*cyp6-}9FT@n%QK2p|K z58lto&}V%ah|uJ<%I)y>Y@|G5VYc7qruBNeuq!e6Mc*w-t?EtTL_`xu=*!oo&Z-N!t_HCa_yhlU4+4m~P*CQ{7 zNVVUD3OHBDG%AQHA96E!TH#MJxRI>rJFCiw$+Pfrz8-(2`UX-FCnf0YR+huExmEbh zo5F%o`9AK`%E8su_bH)YAD{?Q5;jvNf?m>2yzN|`y28|d7v5OmNINb6={hQ#Nhv_6 z8Yx5;d;!c{mRyTFZ{~wYv~n4Zo^oaGS7V?elFcuZVj% z=wu8vzs@reMeko0kx7; zfuv~O6IoI&A-`I^-Dr^fV;$oqGFpWRYD$KW>2FeC!!q4C z7q+YGhZhkY2`f*h%1vM-lbP;(!~=erRK_`>8=jnq{n!sj1A8RLOA;>%m-QkNjZZ+) z+F=bsW0C4lo{g-i^~Q;EjF+&)f}M7=>CM#FpM))H)Yy!XuCx2S?_fpGD({6Dr4VQ9 z3hT;6?h1#pJ-oNm@*NYw5UmNhrY~FRd?SFGPI8U3WIXeN#{z0TXCtNL(_D60>v|+X zJAJi(u1vai@xYW#`St5y3Eg(j zvwj=w9I*0zc_^1kBx~aJyw{g6M;cLnlH%2UCm_NWf}^+HTNGC?Od^masrdA1A*a-; zCyvZ-{Pyr;Ci5SPGO)hJaJ~pMzwuOmEO#*FO)2s+N#ff5nbrP#t`9?78ZM<@&`hu{ zNf@c<=;a}mJ#IXrpL(7rvht`q^^5$J!}@C>HJ-8wj_`yioXs2-j{s|hisVpz>ex3LD%tU6_wETc=}U6OjhFOuk1#m~i#I`UuHSMWVD*yH@&JE9cr$m9%3syy zFO8go+~-+uf9x30HKnuR#s9G;7aYyVVRij5_IR?sD3Rtv*-=d!@t#QSRky&Y`Xd`F za_iyCck8Hr!*^QcXe%ZmvmTA*t*DNOsC}+Di1M@2u|sA2Xxn^izt^t`HR1Q>K3WjZ zzA~;z$;Yqh48AIr{$Nj|(4DBPhD_J#tCs6M2sg+a9ULGtN%Po8BgVtJ}EnXoF#cVIz0kYKR_rBcAv*H+`Z}$plFDU*_13h>Qo3>1xK^R#v z(1CXL^F0GOyhU1AteIbsqn>T(zjxbeR$Xw?=}MWs;GPha)+@MDTppz1#$CUvmB$3- zDp>sTnm(Wsf38C9+vvt{^QoN;1FrKwjXP;9g3gl6nA1zz`*taNJYcBF_0N6Oa2K+x@vmra^u*jM5y%L4H180nqC z$^$;kOf_DMkRY<^l?2ImT{|B<`BjGWktEgyF$+OG`$7ZCtvEv|<%Jwn?~~sxY;LFx z_I`*<2~7PQoskP42KN;zscIHL1>>?VjeXk9f~q~Lp){7E+MrtI$i@%sds6?RxY22A zm^TC7JnPMFf{b{5K%#xX=0HyElRJM$uPx5!Rk`PJxO>L zeIdXU_dg_*9p5UXeUj0}ev>&#ulYlLqs7OJTSf6V>qlnk1{|$1x#V%B!jur@PGOr0 zrk9_`rH0x}b|~UpT?K+lSA~F4Y?4~Pt9H#=!KR}h#(ocM6bm}iNZ&)3tw5c@YZ1am zb3HNIaW{QTdl;_hn4tB)oPbKC3%EB_ATN+jy!hxBY|<|W^4fBvpT6VF->0U&TkD!e z6?%ikp-uV(^lqrp!!IYn#f)LY3?8Shn9x~kYFpXunk@Y)a~3^)*@W-VDVKc}im9TI51VbwJ}>lo z4(I7CUwIvN?+d|4_UGR;^(oAp7Phq~mHmyE^|A-*p6B_tekyv(2x#>rOwSl2$6M|R zc0%GW6%Vx)_u-pf;ILyvw52JlXqXpewY@7(F7K$VcdP2`9e?cG&p70l(BSE&cRf0_ z*<8#g!hdkqGv0r%*v>#5s+#_J6J4By8+xq={`sT&#%c?18=|dL`SG@yii&G^*-#&s zZjQ-TM(o2vyMp{V#rkyUqEH?e-Gh20Rf?m zPlsO_u&r1z`u$reC!m)^vL~PfXCT=rL;|a?8&&Y&KuuwDU%~Em@@7(pa9f|3;3uC@ z%_X(5X@&UJplJWzPFC`L0YCSKX&2gBVxyq-ZnhK9^QV*8U%tFulxu5I$(lb*Emws4 z$6IJZyQ1+MBK$t*vx@te$foSG3#L+-uG(rJJRY09Ff>;Z){8Y1_xjz~cwb;ozN$uq zOTV;jXwv%^r(+8+7yS2MI5>UbIDOA3e|G(+8UM2jCnG1*A~u%J&h{caJa$gpMy60> zGj0>8EsvX#Jr6JU9UhPv*v;O^1Y+jQXl!O-Whc(GQCZ8xXk{wSq$#LyN5Njw%+l(y zhohOQhoYK^2gF3!lnE?BOep3i;$~}aYvydk=w@qU=Op4L&U99~2oOF^=3!zyBXNd^ zGifP2Wt4(*D=Y~33 z@bC%?3-jFJzVn9s`iy^u#{P9~04_RdyNJI2#Ojf|l%XK^Ng zi8Jm@P5vs_9_DCsR;;NBkC}~`t(l#(695J8DZ^*9_BJr5zo-GwU`}SINoRR%OwD_<1rZeOie}|6eC*}SEGLlexcSkD=OJ`{tBMWgRfE_a?#(%jx zA`hIL%$#K(i8Be_;k_$-`q1#d(wN#fngQbb$i+^ZL*bDVkE1KkQvt{$S6L4iHCJ)* z|C-^f2`WZ*KnLOfU6L<~nVN_=!HliVOq@@<2XLJAkcUPVe?)(e+gM3FaDrIbS%~qR z$~qAJo%pY-4}l(S;RuDULf!tAF6fP|RY+S?eN-kqNl!R(xYhpRs) zfH_*73Z47UN|181w}CqT+e&0j0g?Dwep!G^M@Oi|zb)Yj(4)*8e^!KoyAyErryMHT z+e00lVRrwf5lx zT7&67rpdq8^1$ZL@#fDV zL!E&k)cvWI$>}WpAJqJ}s(z>bo6>T|z}aB`x5Pgb5`cX3U0J~rCu`WB&UV>6b%$i+ z=e`5F_fS^hblWCi-zqy=EFBOI%}p8F(_O4U*tFQVpo@QbZqQ=i29f<&4?tS%ryznq zJzi+B?LgOl=Kn{F?F1tFn?E2ewi}4`KXh23#l8;0``xAPG)VL}|GCrn#lM{8PGiKU zzLS4>#{GUBaJ4&ggZn-9r_bAIjOcF;Zl`hFGjF!j5b-~`uAQdf{qCoB8pQv@DeW{& z^fwQ*(>TGO?q+9%fB2T2hKc{lk?b_(!l~ET*`UwpVuQ}KRx*g6g30Nz=r|1bXKigg+z_|xy|kI3&%R;Ll%Gmom% z5dI(TQ?%IXAfmrHsnTLwfr$U{+5TuaK%NV@7jbbfk`ogVlmGH@wm%y7JzQ2CET;4Q(Llxj zzuzAXt(p`FY>sw*o?~z>1LrbuE(7N>a4rMqGH@;f|I0EU2hw5Vmxg!U#2Yx@%m452 z_?P^i;u^d{9cfMoYBlLA53!i>_jATGs~WcHdoXnG$F?EnP%lOywLDiuoxM^u2->ci zl~iS+gU%2WHhF7e;p#Ir>HR5vUKX6{zE^&%0ihC&tmmK;_q=kc`!F6XSFgU*oVnWD zg4``hhZ-&~3=D>6yA?|H6rvNeMn*niuBWR*+lBLkVfn%Iw~&-`u}=qiNNeXl5G?y+ zu%8jm$8Q*x+l;xvRU%>!f^qo|N;vR?5F?u66=FQ%D+BUJ>nEU=~IbNY^ZVD4ln_Wi|pn(#2VB@r`I6qvmN-o7s4>AoJsp!GJaC*(cEfuax#_4%KwN z#*}6rg-nAFDFqNm+x{mYsa%ML(#sRj56wRCN*4o~vN+f9qs+9-HnHK1{J`y`z+}c> zSxBXo658`w4ZOpev-jzfAUQTIDQ$k*w|?Vo(p&Ca*>7!+8Q*b@Q!hE!2E|_*d`&sY z(%%Yh;H+mpl;BvH8im$b+(*9DnW%Cr9E{?#rR7`(L64X0r=9{^+BMiqOL^@+fq78S z3A3#F`1`lmYb{^Nms8PeZyniP8b=cs4R93`pxSj`=cyj|w9xt(=a|=u=C0EZHq2K&(5a!-Yc;&5q`Y8h zm_GV@1*0sr#kJ~dPS)k%K-;{01$54?Rtu)5hjSg@$yT%xev4S2w&(iu~y>pN|zMidfCMTpjh}+Xr}66sKryf9>47 zH}fn5!hn3!E9^e>a;Db@8VHD`ZpWgl_i$mf%C*t3nCCSN&$*9t&G~)dRwY70`QQW3 zBBb%r`!8Qow>j#v5&5bXW%|@M8_6h>YHO&S&K(pt6s!?I<1sGpZ_vuo47O=~wpHoHYbLUQZCn<(+^WY|u36vW0(6}g+pMvC->+S%QqqTr= zaC4cbO4slOeBL|Z`w3`tW!fS*{+Tz*!Jb}`Nx;%Sk~eJ9-2xkCLbjXh7)o73y(CP08`XmBTk)HTXmf40~AXB+o6YX3B02 z1SxetuuKXxH~OD+fd6@(=#RKbh51zv(yT&Cwv~&Dj7F^nNtPj$D>Df%b51}*Zm$|J zBW(<|$HJ){k*lKu)&mDjQ!UGj`QlXv$nV*TF@=iWH%i}}fL2duK7|9hZw%aA(!gCT z#LhSYHNRIAd84mbHutS{P0r9^rAYIcHN1E}z&JHZCczTJ5%hir*c9K^VsEd1O`a<+ z%9bNEFubZc|Ck+rMN6JSnt>c49YtaeODLDZFwA?a<{I9OPM$K5&f0+Dv}H|PRA<3K zq`Dd8A|;!s(;j(*SrwGx+N=$O_xsnu5pK``u-yrW9HQZRSA(9uAdqd=GU&-Q+B?lS z4r>M$tWDjoV+vor(Dl5AzEPw!f0#!Y9Y>rrwj)u=JuPN-uiV&({K!f01a#quU$rDPv!+;54U057OG0gacwPC(=3H_R$s zDq+}bVOY?ZEqTST zYv0Up{2G5Nk9j&hh+8lmW(K$KAJ5+~c3p1oL45g+5u6xKmUGCYxE)W=6elN0Clb1< z--)P#i^$#1RaBkJ9}U4qJ?g(kQk|B*#PXtQSZT>1^;n&IipElDqG+DsT`op&F2>tS z(J0lOA>TCbfZ8V^v)I_d6%V|SbOI7t)y@tsJ^>+K*G?HO==)N~=u*$rurR9%5o$>6 z(g<2Qrd*n^s?01-pPrDQQ`vgFFi~JKez!!ph2jR=ZK>AP;Ld^8*nK{D1w6u)Xj(x4 zrmeejBNf>#fyld)#!U@O^Ih%*M5sN`doq!rO2ROUJWF2c8P~Bfs8??%0 z+hatIPC#$>;-^=nr&kO~PeApH$XfKJ;o5_R6VTPCLQUP*3n?X72RInnJ^b|-R&8C zTm_C{{}c%$K>P2;<;9!DSbCTs`t8zP1csj6J?=>?Hj7BDXgPe4f6PHBT- zz$B;P1xtRR06|$Z$Rl(2yqJg01M6LI>Xn9h-p0G{Y~0-@iSvB}?LND1Sxh(=Z|UbZ zlUyGK;T0^9$mY&MhwUKd-Fu-(sdDrVHLT|ZWKAV`B9WgX4iBsksTchan^P!*y{N7$Ef+ES*5G}G3AfL;L2)Qb-Thh!)KFEK-?SKhV!0M zPSgpF`Gkx6SH~vZe3eSe{7Phrx+;6C30Cx~^VdkHX?z1%ssTaDD*?8PUSt{W0F%Nz zZ7rH(cF`YR>FNfRgt6A?W#Sb4(4^;~T4hQlwsV;)=X#V+V%K-SJ=E) zP>6gpbV?N|jV)D_BgqEWhxceH&8WSYO;b}`+lK}ssfpK6E%{+pZDMT+YwQ?9hotE$ zDtGS_&?ZUt4|Imtjcd5S4YEiC*(4uUOR}yhO`91`e6#MFc-M3d?K<2xX-03sydr-r zPdc|xg~|I(Q)WLN$-1`i-EHFCV#Oi5OTu`=7-n=p#b+uW7m*h*Lvp-Lasr~uf5lxp zI|Dshoaz{)$*=Hh30ddO ztSgsuQ4Tu+l_F|=n7v#MbdgG5N-Io#ZoTS%`X#=9ZKz+e#B9!;^GZHzk#0m&k%bb1ksTiso1Vhu^ z&1IAd$3@`G+S&qkX+?vix7j#k^;XjkCXo2D{oFK)NUrvACc6hPYQ@XK&0Q(moo1Fm zJ2V^V#2-$MSXO-Aw=?r-3?P$fZ>Q^R-UMw#;hoJ4}wrYJP+Ry zRhrhFE|fzp3+fLih8oq4=w%A`_y%o3cgv4z(^2Z1k!fEf^G9BIKEWshvnf)aA}tk? z!M&pU-cEDqIu4>|xM4w@nA4`GWU)1*w#wfM)#NRbca*#x^Fb7l`^(7&S-_IWyI0=u znwHy2qmBV?US-C^Ji*WV2Tne{c8C*sBMw#z1 zaE}uZ|8fOKlLRfwr5ec-z_}Br(=~)!-X`NH}|Q-K!5|g&Ja&Sz#uQz&f$yKBe$4sUpv%}iwokXG#6(15T>L8Y5Z!U z2UQFo&X(9_Zt?!Cm7}xo!Ht2oe_mOtUXxU-9L!IvsxAv#UN@g&>AySgw5*`H%}(4r z6w*9YOe5!Rng$mRdrT$hRfduA|r|$6sz(_Wg2MRJX^%Za3by<*}4tBKh#HgXXp=bxcx8Rf9~l zZ1%d9qEpJ@$JK7;VKIKEl-AG7JQ0X?_N|Z|aL*9_h($q}ZmeudX|#vzRSKhn;VL~D ziUBV2-ki6e8kmE9^@Ltmk=ZurS=FTmW#4xjm$&1Q5TWP7R}d}S5& zxD{eg*{rhkqu`L`1O&|atLX{3u$=1GE&0i*LALs$$=e^G#M8G%m7VA2N+&QHV5ud@ zjM4>^9n$bQs_eH~+lO^-$8?8$jP!w1?r6awiEq5K*fGWT*~c(Gaj9E<>sXxGKi;(bQli(xD7kYC5#egV9^%g7v@)f`j<7rRBz; zgkj^>^Keguze&%3z5|^twgRuDbis2?m(@MB>6uTht8g?rESMjuDs?4F0HjMX1`moZfGG3<3SyvY?Gu**{WSX>a4uc4#& z*!E-TwLlgGdJsExLU}zIrXMUc7-p*c_B1R?(BA_~?|}vBE^c{6wcp0v6uX0xhAcid z4_&@CAK=@>5CJ zO;nG1*qF=`+Q$MWMXveD>+QDYnn9wM!gTt&%{>0*J9vmYeZpilV()V>+}ch3_`Mw! zpgl{XAzybe#YlHx4!3-JH1u%exqtVzc_Zt7CT0@@8?JPOAP^fQxv<~~2)ifU`-m*k zSi$So*9)GQ#PrNRCeqmO)uj%e+HF4yT==%1TZ>lX(ue@zcSuN&;wZi1Ct{U_pa?lOAfc%Wx|8XSVV`b7-Cj(l(}I#iDK2k#2zd^_gKdTX73-l* z8Ec|xlB}EzncTr=yNkT<@OC%D)w73Yo_7DEuo6}I3CNJ=cn#I5TydPfq-h5pmd6~! z`PK4jmX0)WB{wp6c)4qq@_ZW@Pe7(Jz$KA|bs!#e8aHV^jgLk)iyOY~8-?gLcs%bf ze$?8if>{G@q5mehtMG2j9f(uBgKALFvPaZ=&p?3l_MTmw46A}l+O}F|v<$qRBC(=K z!uqL$9cPq%>bSTyXCVIr%3H~T#N4whQhvsIG5TMVCat`>tvNZ!4kOwQPC!b)yOStp z5b=1UQ|k#pEfuyi$rZ0e$Erjxa ze7u9JGYqR!WO_?vB{v4Hdfne4`^d@=xPUpN*bv;iW*t8iX0dQ>nL#uE_Ra(@xw5_t z7FX^-iO|#WvDzpx?$6Qgzfh5*88-o_ZoVrT#yhsal&YB?6jSzwv{c362L^u zLttP_#cQo`$>T6`dcfy)^P#3{8Va&0k)b9vBYJP7_SN_IN*D=TFUfgo*J!}jo6Xf{ z5v}^l-tmAosvCoKM3TPZ;gVJUxu&GbQ0tZ^MmleJLC=w3%+V_ZJ@*|0t4=#OZj6z} zje0G}VMa$`_aXm>EX5#guXlzIYm};=8L%*1Mz3Hl?iX`;nWbTR;zjzu;A@5=@i!;N zn0-Ft91W|d`wWim+&i`lNuRjAY~=bnp&RDh%$LZuj^Ilto=w~wH9(+Ny=A1_?#3Q# zTV3S~LK7Yh4}N@miy?1x*?DSI^vm!GXa&ZWLy|gCm?x2f4c1u><$hTbBi0tJC=t~p ziz-ItdHA`5o4bQAZq7b9rc7WeeGPpR?mnuUf z%lbA1w`EpnQ!3AvI6F0FSZxaP)P{T?C)r#BAI{y{X7j3hYDZp9jvKHa2n=Qd7L(5% zBZWwG_@9~w$6z-eS1&nQ6Mqevf9@E*E>Tn&@?f4?tl_?6_y(Y{W{9;J@&yroB?<82 zpii%u@6`~k$*HDP+7w(Uy_>3?{FYGU1BKBGlEi$YZQS47k{gz?8toYM3~mF%4Htgm z{*IuZoVDEI?xtI*LWY_Ly}Y|g=^GJ8f@O}XO>pDh^W^^G5m(lUz{3i}1HfoQadvI>6 z0JDRC@ogCK-DP>v7DW}yP=Y;)kNfz(`a3If)Z)rp+OK3Kue^bf0q7&Ntsy(W2w<_o}#2DKb+egr`w{;(V1D+`r zz5~8M|Fbg;cxMmfjylT+5>>s)0wi+-^<}B`QVW{Uf|M6Bz>-|^R=Aa&6`@nc8bJvv zG$wG1&SWoQb1ihPpr~qq7EY>6$k0@d=I|Y=wVJS=b^JD}ZPhvw`@3?cEmy=mu)Fx< z+vt?>WCgqqMUv(u<)xqL<%kq)FO;1TEn-=);VwY5-p|w2IOz1qQdoGMPdJO;S?!as zKj_p>MG)U4LDi(>&I8PGUnCAK)UKNpc_P*F#2%z+Bc_(`zPV(jUh%QH7kh8?yOqAl$K{8d zYb@`O2d???yCkEU^-)KD6OH!PtA$Uti1(h65s~pn?dOx0Y<7l}F))J%zWY2ZGAe#C zg;u+r@SuA^udjK=VuXH@>eW^U-63ttluOj2$BrT0jxJ(X$2@0txJ8N~dng`(G<-6+ z%K_oFg4y(!g%}vWzp&GFaie+GfUT@ArJE)@nF4m>-4SVvz-(|@2r#0#!9|jk z{HknO<7PLm%6?cMSQiG~CKe)~p4V~=HOMh&SI&iH_x*zB)HMEGGjv7E*WOy_$>-X zlf^Y)_YpA8gbY$H3q7S|nb0*LMq+JFz0S3ZeqGAi_Te(J6o2bGhT@sQd+TIY%9MaO zK^1PYkpz`ZcYKMNz#kG+2foKn4ZKavcIBTXBo{LEy!^LjH}h(0V#w5)QYsQ+HB#9H zZz}30FC>ii@mAI&ri3_7KuMi$kqHKC$2veSAOlQ(vg3Ms-0<%N@KiS`#AN>4juTKQ z#_;WtKS}N0HLnxUU7MRQ&JpDmy{w(Q_d;zoWqH=R{QZqwe%2;}m%e3am*-wKy);<- z9k471yc-8z`^B@&k??lKqRviNEdc{8mR9S-#$$TX1EEs_=1HB`b920Q1DvF-IeTL` zDQ|XO&nT3({G=5nsH*}-a#aF~FkpK87!&?4aZWwWD#T3;soI9bihB1nh2r*lv3t10 zB+dJ%Q@u6G3+L9C%A_Fmlf zUXF^}kcrzcXy)D4^P3WyLITs!x3vLibi{n1$k3!a15WBG;m^TZSj zqz7irMbFxhFY$HnAFQ7xCDj@0^^h>HD4RcXXVBrK6nim?cCOth-4>KvSx-pS2Y}FL zJ=JDaPPJJBnB=ADFYf!@QwIw!pQ^?Cf@KZqCr$`xx}+Cd*?l|XNb^0%4O zv9l2GIo?Jmuc{M}XX$~D;5R$Lg=Z0rp#(oPZPTZS#_r8wnC?t%TrPGH%h4BC>-FqN z_LixLf+;U(g?j_Wlpukpl(#12D-v6i9X@IRp%{Pn)T#S94n89NsMy8z0k6W4T+Ak* z0hny%Ni2)E8l=x~FsyOia(mVhD3pHOkT9IkRn;anPVAr&uv11@HL$ubO)C_>cob2* zTQKGTVQ))#>V#-cpEcC75_u;w6l(>ybHeSAXZI%P0$)z>^Gb(bzIH^t2Y%+mBosq8 z8N^|(dr_?AIbd^AgeO~IjwqJQigQ`<2e$dEzycKN{aY59y;2lAtY7_{C9sfen~0#I z2_+Uu+E~{8fErEI^X_TAT?W64BjbT@LLT3fw@BQ7WS95+-76J7f(5}X#2N|m%|X(U z67k~pf=scOzQXmH<@+8u6Xb}-;2rGPnQlasvKRlS%|YLmm`drP{U{S(T8?@@@TA!n z)=&85*EZK0HE)ShbyP=y6At0gGp5lriOMs)L~7_k!0ZW+n)(*ykUDA2!#^73mQUC` zp%v8utcpqr^?E38jD#8uK_a z*492NHS~r${bX7?(m&8ItJ*IXa}X@go=}cy*~h4Vk-gO$vydrj>G__PZZuoj1O9%* zl&G~%ygK`?x15&Np-Pq8da%q^N>xSIeZgKYp#wN;2oGk^C6_(~XL>9#&VQ3_XIH!e zmSd$FVU>cgtF|=CEPt|8L$;{XRm(UiNHg{}Ig{zOe&OD$rGYJSkI-~vzDjs~37-Wt z_WB9PY#X(VuHqeQeETSfTsh;>BM^JWH4us1r{Z0;Pn$2@b;=Ldy!7RYX@}xvz^uLx zPC)7|GRI2^bL!@s-doPJm_X4JdMn6Y@2{4d_Vj$Z+l30LI!Xm34~C z%lZR39AxX{tK`L}`&w}wYJLYq8j7v&?NgJA{%qk+I(b0VhCpT=|UJXnNu?Zyc# zMfFJzO6=G!r>7tIP_*kLsE*fZ+IkAxg{o`~XD~Akr+G0W8=j~(9KDQ=kU65waW`Yw z>PS!?8w;&3gJig}p9fq&EIShc_U5$tiY`o<&FZ6-WRi^AfAOe|Cr|L)z*aIsi^tB zc~A%FY~b&RuSi5CNIALUa4kwLIY;ip6%g<7cXMxzW<=5uhRGwo3@S+ zrSVM-O<5Yy+3{9B!jd-tZ?ewRA=P6RJ&MYQxWaj#G{ZIQ z<6Dm4lbf1yNrP}r!rMtXbHEqyZu$TGWUQ!q@%1WK2Xd@Yq$-C(W(M+RNP_o3NoF!P z6P>3H7}Z>q#TK@e5kom%Pc}D)QCt!&`{Tf~s1&JYR-AcYRf}u_rlYdi7Y<`FUmYEK z>GuquCkOb8jrAw>qq-jfebREXGD>#yYofEqMef(HeIy+)>J2LlG(L>Wm63g2;(T|n zHIi~~951zE)D;64>{O0r`uggPZleUkcPoX(4Yt2d-e8&1)0?n}D-}wHqPIVgv=zkG zOEABot2GWnFLm$e?C5Z?%8HMPYt76l=v7T9SYH>L+n^T}w3k*QgYo2?KWdO0Hf+ zhb#(0U2k{4(?;?}$lHPGcRw`Sr4?27cfr!{$W7KQoi{CAo|;_Q0I$&wew%&#iuvqU zWqgyRiJl0`?NM-mv-8lOa?JT zE3q>*eWrG5=p@ords>oae5Byg?zaC+SoeVpO3K9hgEXSV(5;*Jh!#V!1IK^kD9WI- ze+MRt-HDNqCzglaQ>Ld;^PEAA5U>}pCwtH7#XSQ{M}M~^c%3M?pQWSgBye8 zy@feUadAbph#|HZ@Jyxg&!%Mh`2*^f5R4{+=<GyA_i}{}0__OTMNGp&cKyF`fyH7T`1npL)y54?#JZ`= zF+!O&mOlhVO@@5%AE8b%ICHi=^t;bJgyD#On-5+*>?wc_NmxzKy_+B+=JtF zmeyB1?v^*pSHfEznVy%AX3p5o*vEUslJS5tUnXd z05pYr8N2!2I6N;L4a`Xq!xLb+N(W4Z(th`LmZqUInxiwrJ5}P<&EW~b{sT?S{Q_W_ zcLM4v4+0*=rf=q>o|~M2fM>~ZP#Ke$(nbiNTJ$;j*|@oEx0PAathctEfU3ZaaQ5bO z8RkdJ%l2)Kw;w5rAss|N^s48sQ_d62sWx1i?H^4Yhp09>l)Q`(t2F{$(uki~K#Q?PV%hf?AR2q$KTeWA+CWZ_$C8zScF zs}qp(31}C2IHb<(7FQ+`-<4az-@TDIo|c0GBk@s8H3Iz`bR}btr!2~Lwx)2v&+AaP zqk-v!V^Lz0*;h|(erZ5OrbiCiu#;JG%Fe8X6*9f zw_Ia1+5rq1HMyBe3-t;nVy736Wjgj~`>2dN8ViJ3c2g#v_Wc+R_87Va^e%ru7qTR} zY91KWkve&sBEU($Y(Teq$@M7*nft4#j=hY1<%%F&Kqwcy)Mp%0zuM-$r)j4B1dRJ8 z!z)WFZsCn=$z!X*{*?|}Y#37XEXF-wINm%)CQOEV)v=?QC8j=Qz*#2Kx874`?N$-$ zYwIn?4oBHmmMsY1)ypn-nmIhNU>J<{y;u=T5nvLH@P;lM3oC%e~U z{}CQvtn{eYRt%h0XJm3EaPr18kuc8!@z!;S0%ZBl4h6wj=BC!TUV&<@Q~}qM>MZIA zNHM+YO`Ql2H4gRSFfh+0`q1D*OF%$}oQpB-dGo#!-dd&tDTz<~2D}lJdHioz2uoXrd-r ziVKYsgSRdxN%$^%XsAsJyj5z2Qs*B(kcuB4JeMLynK@T)-jzdj-0Po!`RwBf4Jfu zVymcnEJNX;2DRkiU$mV86l94_3q<^p)~etwJeL^`->=)~q5U24m5ObSRMB`(zkq$u zzV-bqj2SobNxaI}Wg&I%ol5lL?@xpAHazq(rw<91n~>_SEBYJT_*wA5n^%WX5Y-L= z-pi?4W?H`?tO4V?zOaa+iav?pTUQ)y%{SkF5KdH=-Yr$B_xRcf_p{J%E?00@)vy>; zwU%$`KTw{59!OW|(~{MU(fuFV-aDYF?%Nhc?4a_YpaMcvn$mlRs0aZOks5jwq&ETS zkf?}s@*z!X5Tp|#C3J{@Ql&TPO?vMEl6V(>=XdTo_ucc}Ie)xAhpo4k+RLffK_q*d#X1WQvPzCeWbAUn@V#<$@iJL_!0zol)_jVY6U25 z@tfwkW^z~Re<)0myb#~*(!vfbtojZ}%V!F8kuCxLA2ygovg}eANo&Yeu83_ft(9$T zf_$nYsat89u+bK;GjS7H@dpzc>iF~`AF3h zc673d-cE>%U;N$puS=&EU;n21I6RT;HHVQjM_dfbT^8I>`J<=rFqMhYNd5}v7xkcnob2gxXLq_Kc zxs;d~*+8hdryq4YECdb0Pb!~kmuZE|R zm z>%?xg@UB0%ZBr+Wj&@muE!h0!#KHNzvDo0^$w?ds+P`G{x#9{m=9S)WDwhhfB>6Gw zJ}K{0*%AI=rB-xbYVl;+#yWimY8cWyP^at)lbNX^eCL ziE+8m7b^N-Y2i_2Qr@L+t_j&K^^a6K@Qj9uSpr#zBV`rt4c*|5N4DosV$P=5p6>^E zuYX@PaO-?O5U2QF@?|VSxq+IuIUl(-DDmtd%kAd~r+=1G-H!bbdJUc7@Nl9WJ!nnQ z4TS(!Z6KhS+K)FOr71_(*j4;KyL*m7Zb^7pf3Z{=6UVX<^1Q?FXAmEoz*#bORykk^ zr+`>Ge++s0bQ-1=zX^^uuK_BFb$rKhzo2(+MLj|E>Dqp}N6iT{`|gB48tMWFNvQy`b=y3o@sbKCJZee5!Jb$-npN@UgFcehxT5Z zlbf)#KA`M)QFfETzC!mpOvpzR*14bOT)NPAqz4(6U)CB|AJ|OV%Z{oPO_J8M6SMqB z)&0@>Z75y*k5~$_S-_2X_;go|zb=%p23tLOz6}Y~P4S(S(tn3MJS!8+!0O=%e5Dy~ z`x-sfxq*Yd3uY#ONBUE(asJxTI%zq!@+h;C0Iajkm!SI-2ZKti5r)7^i&atxSuFe^ z65_|8e^LF+GRvgXe%#?e=mwt3UG0R0naCGPZgN7+c`%G=a>kF!DBxosJ-*&m z;i8GraR8D1!y&0vjRSH+sWR?m>Uj_57n|50mmiQmhv-nm5^EO5*6-PS)$~^xsdEVK zM}}bPi^R|Q>=$%?AF!0oUb}Z-!D2+70$yl}Zrf;6h24)lHa$OOwycu3ajv;Q;1pcx zyz(!B^Vx5zPMuSfyhtL=zE`H2r>Vhp4qFlZ!Ir8UgEtnFP z%mYjt`l5bbnkyI2;bmVK3BSIr@NQTj)N2}RC`-#Z#_qBuITq|w>_a!0;YT~=ba99X zSBq$DN9rDYjtOk%^#D$TOAR3zlZ11_L`Ai$8`DO?LcOErXOt-+vNQ`HYU5}Fb<8~~ zHlV*PZ^123b4q`c25^8y)Bi&u(c~HbOPfI^0Fzs zDoZO7-cjLF741XpFz{dcM$p#>i_IuCD@9*)bqfmu$*hFbBR0v&faE!GlY@?lsJ>`t-8q z;$to3ED+AayiVJ@By>cr7^StWmUVj@$T0Yd$oG zyoTiWNWP&acB92Z)ASOntHU90$G=J$Zp(HKl}-BvY&G~zhT9IEKghb8so&=vi+-8U z{x0vL#o2wfcg0DU*vCGZ3R1>liHaBEL{5b>tFokJw-huf64h{a_l;VPWZ2e3>_+6S zZN&E0ZKNZNgld}F=RaxD)dCy2aBlAF*QZ&jcW_#<7x7*Tp1Z}@zYl*P#7{n@bb7ye zYPfB;J9#2xVXk-Wl}l_Kdd^rmv{GZ;d2kbFgp=R=72@`tYU@k3Q(yl;Lw%BT+7lK= zZF=okOEv)8#&?00k4gNScTz@pUsY}`ph8uQ|7;RI+W5AfjK;XJ)GX17#QjJ$&XS!D zdN7giPch_%YBmw|F0{oIV7|2ifoLrsHU~ZIZ*SRG_u5U*lm8)xQ@`#JNouUI+H>n~ zgXJ$?nsAO?6W%>Q?9v_##v%lNsDsSv)OtAjTb|U`1C#Ik6>OgirVg9nv8gce}-osXA#@P5<l;tq`g96}@Sm|GS zVBGzfl+LQSM2zn>;?7F%2SyCNmjMi#_rS(~?*~pO4%IA78L$|;&}{Cu$9^VX^Iosb z7(`&1`9-Bbj+?pUVVl>57l&`UDC}o9bKMrf1g(bt8aG_p#I*@+aW(C~=G2%Lfu1mZ zZtSAx4!u`DpdTWfLpBE5D(tDI62pmllI;eH#D${6(|V>)_*p9q*}du5ITZt07nmZ3 z5GnODvifWn{q~#ZY6Xe-DM8|W$}L+x&CE8I_eUmKH@qBGhoNH*ZA6*_QcrkKZVg@e zR5gMxBQP$P{79&Dma%(LlFcn!3u#S3G~iwIL>)ET9cRY` z+OMRh9g|RtDNmQ~0=W#-*@E3ZswIp@ZJc^-S=H-lYYqeLrAxM@fTXIr5@Op9(Xu%# zkx34y`NeTPEBpoG6I0VvPm#jS@gU!`(~_*p$$+s)`w3^=zyRzLDv+`o&kwl+R3W|* zOxOH2W5%Y!zEuO}^4~9!b$3XOP^?ewU`kY6$F~&{087KllEpzb-MIJ#0_Iut3#XGK{P$E4g#>dUOkHX-^s30K&u$H85e8j(f zg@3+JyLh-z!X4HC{>NhC;<*N@488{56B~hJ21(J9fBmR_b#s#P4yoJtlRSF}cXgvN z9%;Fdl%Ata9K6C4en1w4B+zFRz**_Z=G0nKiuJ`KWr zm7AyqbE^&CrHhBfo6L8*L^-AVDb8umJq1p!g^8yJ(O%IY1v`9u@SCcu0J@xrVpp5f z@i6!>Y@r$Z;@R0L6=%cr&d&QfIE7`sp{{izz|2lRP~o~28*3T2OGjYPAaGl5bDwut zNMN*?m_~TDjFBfAtCG+B5(qUD?cpqNpQ)E=$f0fol?c>`P3)MYQs1Y-vS6%%!Bc8l zK?v4Ov)Tj3X!Ag8j2UCgR^pfK-H%vFhEe=F$$QX7^#9(hl#UOq7{%{>T80e=Vs$Ak zeW-cxH7CqTHgH&<5k-GyX@+Dy_uSKikDTp2sPvp``HsesIADOxZ6Vt&sP)N$C=K}A z#&f@}yBP~Dt4nlvk79X6_6{Zc6fD>*M5Ce;{aBVDB50Aw-jr z%XI$EwY&4ZsC?8u`X6HI7^OkTGyld}ZRJAX8lQsQ_SM}|=pmczq2zsvTg$QZ=iv|B z{NcTiQL5{Az)F4yvH(Dx#*dY=6r+dVz;v`C^% z$@_fwggIpYZ~9#g?=9V<`r1XJ>tqn}7Nyl&BJieetj`%cuj{D1cnen+bRPGb5&@uMA=y8s%AG1#ZK=nMOR+(Dece{6W*e3BDAztC_2cKwsz--K3V>-tmZNBZ6ZP{sb z+vQDWZy$_zhwCqxF3qKq>i4z@pDQ!E6HH}!+%*>sB;nNJ-}%3P4OeM@VfzHrXcQujf>CS9R>XMf(W*j6;G zQ)+d>449mt+MO9zzOoxKL`S+(Q=Zy9k*TU6o!?YcfVU5Pv~~^ecjnrK9040g-<0QJ zZWA1ks)Hy_l^R=)oNHKbm5q3rot!Hf4{LbVVzP{vnFDIVllYxIUQSD;J;`q(?XEs< zR97;ItCmfj@Wkkq^}bqoyziRCGf#D*KX~P=mfbQgu=YeD5%me1T+3A%HD6K5eh~mV zCDuTv0z26$cmuCfU?sG@)X#A0ent7tdLeWOk~81SI_9logKbk=@XbLDhYD@;1f)J8|~tm4ttyxv*tX{-V71cDPzq z)2lk*CgeumqjE)@CZ=nb^~)(`j}FCOjOwT#Z3~~f`SRUNSPT_Ke2q{7Ta~>QW?vvD zJSFM;S#@jN7REEEHZIkq$+V`y-%I6o(BS5~CsM-IcdH0$Jym^4B!Jt9g}a?UYD^F+ zIr2#|UadA2keb^XMYDWP>8P6fe{8D$(S?=ayT{cCGxzktX8)OOSp2R8HbIRh@_3ZThv(LgbT3x19`M{Kk7lyG<5lvzJW2p2RP+&>ViKvL$rqy26d^K;0?0jO27ne%b{XAh^23rq5thr-3rkeEFNcloz-qE%9Iet8q^wfHyPjFuxq!BwA7)kxLK1j9E!&u5C7#kncB zSAGg(%A++d8F6N9Mb~VV?O-#-PyaBRz8dzM>aXc9Ic(M?ue9R$qC}n_rQzx)DjAi< zdFv+q{o%Kum5l9=7qc%5<$jRlPDn8y&TSsEX^A+86{RyA+)x9W+b|L}i>CbGy<~Y~ zpzJMz!W9KfkVLP|1S=U zIfC`RyB07Z|H%Cd6Tq11c+B)D)`lMw!~fI6Pe&tcFYcU8m40&DX%`I$cef|UHXY+c zvN@1}P|4bVTspdni~r`*A=Ckv&WS&vy7`!0LH#RKla@2zGzELC3Z32S1% zsTv7)A=1c!2|9FuFS2sB#K>O!yGW@Ff9q=w$i^*vZB<@_Br}{PuCl89X;`@%H+6-HtAS*}^I$@E z-!27!Mw(z%C6h$0w58T&w9$Z(R-EmuLmw$`dCl&s*E?IUEOj9z1$?-dSJDSh#<|uf z_J=et!=(-`R#%Q;y5LzP>5aQR^|qB^sKqr=hR4vpyKAUn_ASQvjpe#iC5DaZkoJ8n zcJ$SbJER$@5VM$V_p^SgPb&$X(lo;gTbU{}gVtzc;fNZ&t2Hltk2p>7{15SWS{kM0 zzwm?^SPnA@WJX*!x3P?T%VB-q()=scrMX%xQF0>|dSY?)QOcYqZ_3eipN#meW@eZQ{{O^_a#LkExf}^UX`y664Z(*MIKQJRbaR%0n)fQ_FTj z-|M!2<%u4PT}+rmG&^V>FmFK_eC;;}!^*AsBgbZUG!t%RUU18@#Yhqe*mA zsJd8J5nw0Ne&26>qjwXkSgp3nQcs~%cCbVA?(`70I(!1?h+H0!ukct;^j`DEC3FoR z%hN$lQ_PFfJAstbw-8;-M5w!d;cTbg8j4vG4#q`K=_zE<)p^Qz4<=<&W)BJ94(+}p z%FYmwMM|mG65fx#d`;O>biKJxLyenH*yz0O`*0J2UJGan5)Z|yN3W^O+ABeh3d49P z)D_7)P6f;{OFG0~ex`JH>z=ta^r-HSk=Kv!PRn#~7k=B#S5vkH^+c(994+Zw@qdE$ z+izf*d<@<-`$7h|Rlct(=X4m^_Hn-Inz}h46ioW&wgnPd865Ht5@}5xY)l{TEHrj2 zTP*wb_mD1skqP|nz;cq;X>PQv^k)ZDi#NJ5icb~yj2yco>YTS+*@kPmplSm+Vw;XV zG9yZ6ePBTRJHv46yJRb_u<$@bSf^=KUARA;KJ(*3p>dPO z#{1Eh%_}O63fkpS zosJghz9tYqO#CQ~Pm8~x{qQ?0OYRq`o8)us8@QMs3tKw#CK^5E9@kc_eVCjeZCMAb zH$<)vnRxq08ZF+8WQ`NL3@Ne;)pXzb~=qwu!cJ8oOqCO%z!+?lSO zDbq5n>*Sw(F)C6&ihfBMdTPo2v1hD`39_mYl{Kq1m$!8FEv3WGog)5qPaZw5y0XH} z$ZI^E5BouQG#a`V^1WEAh^pa2HT|NICb`>Ga9AEy6h6Yn&whw9#E6>?hFTNGa$HTn z!7I@MMui9IVn4bQiePhLy`sw2)V0|Y3t3|UvKp9<*VIUhNr3kJ^&Co<7XVbuGlxbA zwM>eXskD|FQX_vBj7R-3)8#BR8Lu zOl-O_V|~Q}yX-ZJki%-YIF{>`<9n5UfNgH&dR%a^yUX%0OVnIEZ!#8mb3wO}e}t59 zX{^)fGN9lA9fkWh)dPk_U+X#SMsWq0B7s2t!l`TluVQ%rr9YZjB5*3Rg0eFZdY2@1 zWP!cppFHc>TtfYABzx@XKN1sgY>S5t(|-m`<@@gpX9E62b2|kX z4#uG!IUpV0$@@Uw19+)l_P8YfmyZ0Q<*~KnCs7LZ?Y-c!j=>6YXm`^KOkH3h1ICUW zo~4E){qXkWwD7cKkT?%Jk2-cMcRv|X9;Tk=39lzSBv?i$obiNFYK#CkA&>OPC4qxb zOU%KoTKeBqIH0<9qfHA;Nbp4pY<|>+GNVDV+p@|W{E8}>XjmuStK~LnbGq6ts^7j_ zE5m!`sE>4Go-KlReRy+yICN@)#ErS&m{l73qhHL$3A-0o%!3}kd6@Y`Ue~U-QERUx zxy%rAz9BxaPk3_pRV`0VlPc$ymTFaI^ z&S^n}F4y_T=g8U452O}1>OwB-QLx%o<P>=gHN3{(*RUzb`dX&VZZzPvVdC0 zh=v22cyUH|Y`@0d3r#TKpb_mU!U=3grttpAk>v7; z&S^|iHZ^hVl!L2JLeBiAvQtUO{KRJ8H+N1Sg=HtAkJxt)b?MF!b%-I$tMEt4$yfX) z4pzo78rnp7!Gli>Jg;-lP-lOIJlc6#jw)ksX`Cj^j?xP6Y)(7LU58t3xw*+z zapu*+h+lFZdUu8HvJho*MHb^oP#^sC06h}9!8GS&Hzl-A(%3=ZM)^T%I$w910nWH- zG+i3Jfo>4Yv%4%R8^wxELM%JJXmrP=?wWsP^|7?zWNhaT&+g6%%3;7;dlh6ProROwh(z zQv`Hv@U5>l@%uC+G@-kCK;Y4^^0(o|Zs9Hd=tH_`dpFmXy&G`)+G=LvqUvx;5IO43 z6wP((-12p#UoD`YplxkAWz!m0?G%Ivl9h8g9(gA2AJ(*v{GwlJu2AJ;k5#DJ>dX-j zs|DdKW@pW}MGq5mJami}J-T#*0YFXzFz)rSM)jwt;8>ypZY0fw`)0-=z$NRI&h@cE z)x)PdO4Cuy@fdjnd$x%kjVsD@C!;i_UGieCZ_6?yhhEm; z*s_i3`>3t=!Xa1P!c;vfWQ${M#rto)zE2)p{bo;iS0Ha|>7CAzWPADN&=#{@l5r<* z1V)`Yxnq*PA-=ha9jmF$a^P$|DBWykO{eT#awZN|T2GWb+Te`F6~pnbV*t+e!Eh#P zV?#o+)Ep)j{4PAz@^YJ#fj6do;>xk zrrWJ`&fyBk*Ce_=ytjpB_p9;}d9I#%x?R1^pt{{A?Okr}&Ak30#@2kKTQGKY`B4^X z5wIOPuK#V;{y(t$Y|fjB4Zo@EyC?hE5#vLpLqal*O@}v-meppp8HA!xEkN$O0dl{) z9FY69mi;?Jul$}YH9GBS*K zNebx&b#Scd4`W)ymM{cu(eOv?VW?m&0kFp{M8-x7@)6@`B1K~1WR=$ zvD5!L^t!NPDVAW>&-AsvZ5xe4ZLe#?_F+A^r7vCs0GEV_Vj5~R(W!^h-R6eWa9{aa9Qi@QDI_VCr zcgOF<+3TfOxPyxJqC}T%Qws;cQ{uDC(@V>@pPwR6)nyI1g^h3wdrLB++&r}7#2j5( zX4{FpyPTeEPk*y0mYRo`QYoShuzbl1B47q%f=ks(>aH~MoDXT_B* z3v5`0e`bifeYYhF7v_TW&RB!;j+a>vi#T2CW&`Y3!GJ6euu+?Vv6{q>tfjk&gzQAn z(t$~5!Eie8&pt3^XjaB6op^o(U~1ZH08$+@HSg&ofxvMml@IF1k`w*(Dg>|(t#|&* z4_*WxENoZZPh7H1KK4acaF09X(o{oM44uC4?X*4klq%sBQV}6W2Mc%ROd4WMLTw2`xUTh~Jc^3bJHm25VaI%MUS=uwC~*BWG8Flvhi`(K zbaTlivmbnG4ktEQqgK75M4iNTyE_Y4(v4Gn`=&7!@pf=`m4ft>i+^_mGMA~cfE zIbS&UcJA%hj5^Ow{5+whspM@n2iojKp9q}MxW1TjVxyf>ldthh-=L|cdG_Ouj^^0M z$rGaqq&{NSrlKCPaC#)!RmUa7l@*&-c-QWdr_%nKhHGakTgDN>_XThWEH^?n!WQFL zcI2-r8!$^8I0{r;8lRHBzg~R^@5FC=j%t*|6-P9adjmw2-lP_~#jSG@HW(>R9{V2G z!0fq$6Pcd~t&F>!s3aTYZaucHo)-F=lpx7$!E`*m1eVZXnWFv%;%J`_n1Om6AjBR= zMe1)=iylBkU}B*CBlq0s<@l&9^J|YGQPm{yE>HskJdc_(EM=`YFj&41S2?0|3IyI> zu&f@&d!+>G%DA(5Ils2Mx;A4i*B9qu^2EiC$A(RLFFT8NsRe6r-+;b(WJGM(@X@l| z`}ORdm>Fr9g+db}a`2mBc#2$A&e^^J2ZnPiufVEk*dELj<;k|YH@~8oZd)r#f%L|N5n%nXL5m)#Y|z2{3d(&^JNx82<`m;VJM z6<`1Iy|cSU_q)Kjv{Dci&v%y3gQu^Xwz$juA+K#dREZ z%4~cYwnWHFW(=$1pxSZdRW3Al46LzJ;*Mu7!Zc|(qfE{y zW@m!lVGe#n+_w4{VdeNN7dX&6BR`&;9omF@1W-WakPP_T@CY zpISpd`B!R3fkekeTg96ngvO2r7?Y~{Tn*hnIGAO9%5LcBXj0dYlhi(+G4|Npq)A9P zdr>vB>`{B{JMk-JhLO441zw^$x*vCQ;TKDoE5xnF*zg@45dlmI_-clsf65H{^d2^a z^llh5Vu6HgjM{r{)IBl|P4T=ro-W8Ll?$HrG1u1ZTs-as{$ zv%+U2gY0*C6Fp}Ng_~~aj?rFu1Jq&cA|5^^<*fVsooe5bPlR>5Cxj$OcNx_w52cU* z$<7G-&$~uPciB*TDUi-J`E4=FY7XC5gI`3gvZ9v3`4DrVQ{HwH+p}3fA*TCH^<8UE z3$ho>QgwuOZ)d`t2fgkVaj4E%446JpFtlmSl%JuAQ$vE|Cz&*LSL)_vwg+!rd&Nck zBj(jF=<+E#XLbDq-aQc2Q&&KW)(!))`}BXfHpYEM*<<(gzecS~4&(wdc_+`sZ)P_) z?l@XEXM1n_iPjZ~>sQn=$HXhI;9sI-7D3Y!;Iz3$3IJVJ+)y#@&&@usbV5XOc$}*d z+S-&WHe^FIQ9WzdcFr27__Lu9pg2P;sY(4e)%g+%7DnRgJ;b|;X|6o~sem^+h)DLe zQ<&PX99#}uvGW`R-9!anTRBzl@oA7L9|+8F(7p!Qg#3ouvV+h;m+J^SuVNM_?>36F zsD0Y>)ium`%)x*eCNr&p1;M9jHp8b)%8gcf)zQoVJEt6?GHPL>|IB~oKCn)J-gd>l zlAC*lQwJ{Q_&B#J%*>lw>k-PqO~^~TopFK;pv_jTj?8D`g2$d{4Xa?Ujl6h7N0BqE z4r}C%R9$!7aXg=+X|~jZpbekMwVg$q!t^?dCIC2>e)a(ctLm6n(t1=AvQP zSyf4s#W=5<*Iu~LlhG=%wIFbB+2FFQ2G=*aeT8Us(RQxyvz?3D4d()cWcC&C(Qtu$ zH|{+%8L0t|;hMXBn)ibjkbfn*Rk{vW5|`g>7*AAbu7|9%%fYJxJ>JSa)+%Y^-OnQs z)iyvq%Cvhef7+N+rcsPt+mDx_Y8c`cZGO{661E1jupm zw@fvUR7twvcGuk)SX&w}Nf<~~Pf0m3`{J1^H|d1Sgh_ghH{SQ+kCl^?KNL>qioOB7;$}x z@x+Gej0m>8JWG4fZ@@+SLETb4kJ>$pyUWG4ihrz0Rzff@2^rIN_sOTMii<;z%TG_f zw&StOj0t+8fwL_U>rQI^-kEh@<48b?$}Hd%-cmbvJW?d#vUgH~ouZ+G!>T48Z{r%G zS)1Q(?U(bOe$i0f(c{Ee1l1ZcWp@b$bO8%g(8Lus?!qq4Ua|c;O4q=N(!jIjr<_nk z8VuI%iD>rfX?N#oUd{T3VR%Bww!55hgX#8>9Hkk_LF|{W&B^vkIP1S%fj@uc^4J|Y zY-LKtB4{t`KI)0fQ=p^NBk4AHN0t=0QAD-fpl0VAn=3`ZHEHumdE>|x-o>Ca6?2st z-G@&Zb(N`3rk=$65bg0KUCPY1{Ya=;R7Tv=Z>o4o=q}1RcoK8U8gq#xX_ZR!(Fj%V z<%iq9{3a9C|8dun`$N+QJ7fs&f|jNpY_=ylSGB`&6{!7>U#I>1V+Q_T9+&Wc|DBU{ zpj#g52=cAnm3g(Smd(29-b^5*8MMO43&!~p^F9H>iTGeizt`{k-;%cSaO>vf1s}_b ztRcH$`L%dYT`caFH3wwnOC#zMA;4GKCv(&jrC-ytR$fsY{|N>9fJ02_fKA+MbMKOS zbNdeC?6}aT9NV4E6MboVsvJrNE()7BP98i%GS1B8YU3DYDi!iL8wTpsb5?#+iS*|u zM(f2SCBqe_zu0pv@al07e??4$l729J!W2C?;s#B(=L5e4r%er_!asvq3K8x@7ius z;?)z!Y5KzEr}{R{VE7@uaeGn#i_KDI+3JgN{Jb3#+m`P}#TRUaqIZwZ)pZgyC?~Hs ztRmetK2P@IXIn#u$M63h$WE^83$wkpZrmdtY-q`dc?Ek^BW`6Z`NQsH`lm;~hLPBF{G1W}XBtE>s4>g@oK%lQ1l^+;`X!qgIyHiln_p5!Ob%jM7$6$H~-WRo)2gi>4^_uDy zaJhx{{-#nlta;3~a$vt|O1~>oT`5;tINLotnB)4Z;t|D!%|w4|VQZn>C5BXa2>U9H zIJMy4(+}D|t+3-j8`~!TR{$wLX(QV)SFw+@njZ~$BeU-RIlThyrT=|`*6osFmao68 z^vuO4NT>3dtL~%!AK|!O;gDJ#N%7Y$&ISH**Uwl%o zI&27PON89PJv}&{SttH)5tukl@bt6Wligzn7+Rm`1=>0Tt3>)|9PBg+w&07p0!C9L zA=2d=!8q2WE=5GFsoVfvkgxMJ>*FMHv1a*4h&j9Y&Ua+I=LDP$vf)^j6HB`%%d{qf z8VX16;9C1SzKY|{P!89cI=P@$@7H7az z99zB?@pbK4~tE|Q?OX-!fsaS)gd;!03GrY@SY%r^sc@@u?#%xYL z%W{9P!C3#bD&emXZNswmtwFk(7E;Y6x6TP3Onm1~!6V_lD3w7*_)pE~K_%C$B5Omr z?_#c3mzwJcG5U3^N}gg~%B>%=`k!31Fwe@ z(gzjmrr#$~=ax+62C-t{JP?UF^R_Rtx9|6l?rBn}Tv%AeH<&&6s-6vT1ZBv)~$u9+^A-qdw(YldD z6T@Pxq*i)$$_ilpEbl8Z#!L&+FH){_uZgQaK@|_(JF`Emzjcr5L<>jc*U!TtRXoDc zztS1q+YQ?XtD%{m>1r7D{uTaR-t+G{$|}NSBqx22b{W5Bt%`57WD2QHkH{JXo{|0h z;WBg`&sdd3ve;nDK08!xk=m+pPyG5DQm7u=a9GKl#$3eyo5n6%$LN`POLStbAo80a zBsqsjJ>#;~o;Kdn*>hKe^7c2?e!p)P*19q<&`o-0Rj<`ghH^5Pzrg&?^6uHP^2x!a zU3Ab6Rt;j_x3czT@z*H({FZp9?*k%YN+V=gzj*Tu=Hl9DkU+Yu)w|zRz0zmdQ^x3C z+O^~2>a%K;hA3ypER3HA*Nel1LX&*R85ESfZ)e*h-UYhQiNf^|IU1`zIoUbS^oPc! zKcmPZ^prmH^*2jNoBK+>l)7}Y{0#kXH*a15_Rz;{s-F-W14s!O$e`rKi7Ck!^`yX;;dSIa=Vp! zb_?HIsRq%)`n0epeIFb7+u_m-Zc&n^2k@Meo4HYT=ls_x#ySHEmuf0CIadglik-0p zQHp%vvXNfx^)JPBM$TYnBh9NR__QoNqpBNQxF^s{SwfZ3WiT?^c`g9_RmrxR7P%V0 zyc`RjuW{n=!r=2?&z@bNdlKFF+FN^%HV3NjWFF0Y`Wt4sfN*Z`Fd@WJ}_%OaOj zVtT|Fj^w%KwW~vVI);s^auV%d-e>Y~U0`rQ(PXIeM+y|gMM>`#sl5N${S;LstZwIY zAED-XWsh$Y6&%YO?qY|!U{HEqmEh;UDsOOrvsdVsJp3#eYW7)(h zkaC{5{5{d=(MAN$jpbGJaET_!#hglz_(Rmx#0gKQdgom0%1g-^0oU6za+N27PjYW! zSLm=F4R;ZaDCaHx2$|TQ-VkYMH!A*Mb_(|sKFx*4k_Vc z5RSi=f!e64*^<`56})h2NIwMsDHlba4XSMJ|3L zzzM{teCvN$iur#l(L8COc=yx`Z)Q>+IfGA}5CFNhyLy7tdZ+hhRqx2zL>rgpvjx2s z&`HKaECR@&b&9oDQT6vHYayF`3PJ4X@A? zP}oL`*2&uF>z(f<)mqhE@l4mj$gXoh6?J~~70ey&UzQ}D>$m0owbnV(Bo;PifbQ$H zPW$_`G>hFy^|UuwaY;VQqs+2YzgFI;!jJFk3f?!`XEPPtEihmklXm?&QWkaBe>k%_ zSEzOX5@U>e6kU<_oYPVk)L1$&=CBvtY0m7vcL|g$CMr?=Imke@5+ZW9(sWd8eMyO@L_&94Lm5L)hmX-qXT(3I?^0X!jek%+U`grwkpSbi^Si?uHkS*>xaBVYfjKij*0U-Cy+E}~L=jM2vg%5$*4UXYtEL2@azLhhNX$ z8d)_ZPrh$@C+7SQtf`kH*zP0FI8VuQpn59-QP7y#R2#ye;ADa56Hvz{{!UN!VCxM zGYfttFiQEMov97ED?TVafZn#-2DH9k!;z~U;yDqKvAFb2elLd&mfILHzdM4su!c+g z0TH)zhpqWugAL6V0L{Z`t%%Gd0Q!)Ft{L!;ezUKpwJA(l(v3S?gfO(QLj z*@trxn|mW=1jcCc@&jOUb5HLZu*bX_yy%hBuWD_9kd(s75rZWU`KuA*(S@Y50JT*e z4IG4f#i1>?#c4f{I4lUFp!hM%KYT9Y!nAR@jliC?n_(nejEADjgY{{uSH78NXlNS8 zxsrNftG6VXbNw?!kZ~~uva#bX%-c+mv=DFC$`S~5?XRCQfqB`3lH=me*E9XKyq*HB z`ulvt_(F@Ojl4kfgS)uF&E62wI5}KQGtU><{o=(0Yd}r=(B5s45R~+3)#qdsAjsNz>amI)H2({IKkgN3Z8#VdyZ`-b2^U*N)=o|W* z>V!5XkM7ao$tE^F{020@jo)$o2(nQ=$lvmFqJN*QiM!ryG=%Y z)gF5P;iq5eM9yj0M}p?W1}TrQZR5MXop2C*U(IzlOyPC`>k;}%Q$Tx0s+qYa3#v%S z4qgwXm($poLlC18<@oUzc6YZnWS@maCPh?ChDEk}E90lC_^n)v4kRJl!@@0x5uj~I zIloi=zKnr_J@N%>COU@X2W9@w6AclU@F~OwHo=AlBFIcT(AOyIi`N=y9US;)7QL(9 zY1_P+h5oGd(bjxXSl(|O?TYkDL(35E@&6MaWn)55F^MTA@>wd!1 zXO9N0CNbflAos1_cEt6C%=U5c}FzFI?)Emo)lahNeHc!`BG6IT@%YA z_kjeRWK&F#G|MQ*Cv;ebcz%AX`|ERvZs4SC6+Gsy{-M&kJ-eiFKW$!eI_r|xui?x> z$E<^3QeOD@lg6cPxS6P$+snTnVEK9^`jwVcaSt}u1I)T_T{^O;dA{AYNNEL4nlm<* z?<Or6B!H2vZ&5~kVB?w*BP1qOYSZj1Y*(&%?LQ>M}^^CLRrl}l3f zclPT$nI8j8gpagf_S-6vjo};-b-I69#0P(+@{anhao4yJ{RRnHBGAjJ*`--;1PfS7 z+dveIh0!(aDXmbgdp8n}W~QKZ2s&Smo&kQD6V5r!sm4oDceXR+zfz{>(<0633%G&_hXl&=j!O#qZzxMA(JuP?xTm;J_0M%VJ2}^puo=1g7@ej*Pw&fk z&SQ<^&>aDNn2{E;gAVzhbjkW}|8C1BEYRN9WU5``VPD#I3Hiaen!(I2Oe<@%jh8K{=bM(?x>EUuaq?$={tnu_o0v9;^#?jcAFMpI6E z9zkLn5Cg>^@zczXsjX61Zt~M&_M=>WQ;mq@!g;5K8IqX`&h9*cha0@Vlyb{)pf(Tn z4WuIT@=w9iK&^r>rx`0uj8VXM>ZM>LlzEv8D`hu|i)XELuYh2i=GQFmt)~RoM!k0z zJLGMi#+F)HsKmM|+myh)0s<|=daeIS{(%ralrA=WhxQU6K)L}DVBIbOoMvxXXT%6r zdwH>6*2)wk@Pb3+Jf*@}jcH2{uob__7+hSV_8RITdGWY|A!wjfb_B(1_3vO-`4z0G z4w^>;y8|^gNVYt%1PNAYDOJ(fFNvjgdJ=V~;F4Ct+HWO_l7Ovm0Kfv%2m74npCue!*#JCQ9JoVfm|h4iw38|q?D!v47If8eh1B-RJ%ijmc-PM%8nm1}=p^IbSNm>KLdrm;n zXfDn~4W6dpW7N@b0lgeSMI)eGfw~M|V5I;O+JAga=hps5o8TGQKkQdK_TtUz$V^on z7qEG)2N8bp3m)Z>^1A*Hg~H?6zMS01q-mxDgQn@H?PF+5jT?s;k|W5V4Di>00vl@3 zAGNT^yZIftaX7f*w4#EVxr+SP(e64F{UHSMZDQ@qZ>nnxoh~3BV_bzKKv*c_hXZ7* zdS(^qQfhhCbISH@I`ZkfS=RnFOzHa~H)#0a)sdn~zkr(Z`A@e#Ll1@E0q_>H*>=;% zl)tBj6&iRNnkosDQ|pI75*8cg{rm7%pSE?oY(U^#cw;<~F=C9VMLyQ!9hWeG z;Wa;!@Q#bcw+_v+N68cQ)vcX+ZrVoI2gCQny$~V4w(*PPzj%;}(199-&04*~!Kft> zzjUq2sH2`jvR&~hy#0o2j!z^yURMualFX*Ic(&DjE)LfHt2PFSh!bBNzU0q_xm=9v z{0Vn>lvK&zd5t!}4I);`luAU(UXK|=I@Xt2r&Z8>3e(Yz+(nSCtSd{hNo<oDSb zr%TVWUifeo`dN3M-xmieo`Hq&A`V!ME-!t4Hoj!`m!IC9xWnfDT_r!uGjb)jk>|hl z*Oc19Tie#ucEMs()fr23r@(dkY#3GnLWF4zI-L_9{${|=ea3+9od4LzH;=S5;XcgT zSvACH*@8biTv&j9@hvhpsjPEd7cc1{@uC=aN z6W38)6_b^q0XL5#{ifo<&cmDZvX^ySt=8j_XQXb332iPC5|>Q3Q5`nE6Ijjd9N(q- zCe$sTj{VeTCKV}Q24OmrbG~NLcio#$K$~4}BfMsOk)LLy73EK)Bf=STthWrC&C7!t z$u)Fc`?x3Dxw1jiRqvX_?D(vR`luAU^O{=n%-1WUOJcJ(E9@=sAJrXK8FKF%uuDDn zk31aABEn~O+f(>SFng+pT zZBmPQZ^3SWPTxFt`>_GY<*wBn*u{^qaYG7s57IJl#zcW>h<{g2?^{q)(hKL5nXnC8 zI^unj_;0FvMjA)Iep7|}4*jq8-ZQGHu4@~`ih_zLh}7JQN>w_Dlvr+vfEWP*0U;_# zRgfl~sEFL45D^e55~cTm^cv~XjMUIW51kNNLXz#b@Oj=d&U?oBalUtazs`8ZNJf&K zwO8M>tvRomx^N{nSf+dNcDXl4`SW*j)afah{D!)Xdryfk{!O6rfFtr~X$GeQ(T!Js zas7IS&YW+ikXwM$P|Dk{s3~2@uJe&R(}a&^=&X5b&bjs|&3VO4i1qESB?}v)7dcVC zj@BHob%e9|Yj`@HwXj58Q?q{ZL01?ds(Sy(S|qXNdHpsi-n)9f)01TtLKO{J^sYj4 ze<~$$Jt{7XIK5gZfKv8UU1Wc?O3OQN2n}F zSJH5>5cZ$LKs`7`3bN_5%Xg}z8G$@NzWCVnBcKaaqg*{yr47UjNWos@GIhBdwY02{ zpZPiSLK;2b9L{9rWXpb)`Q~q>obDO49b+fHjmlOhL8n_9EH_830ah7E?Z#U+jvqud z05oN-H>G9UJMT)7vrPwxu`{d9yb*oul0G8irX^h#(i-PhlD&<7t_wsyi?OrIKvGY9 z43qk@ws+T~;Q!cLcQ>i^EGFyAfz(v#Vv_809=07x8MW^C9+)}XWbI|9QphB!o^agz z(bZ(XD!2X*%5bk|As+fkq|5wU7w{ta7iWvgKaNdacs0pqpB7q~l65AU@#+v$YK!#q zr<>Ed%GNXuB>Ol7Yu4F(d#}1is_}3>?E|Cg23B;V z>h$L?nr4$$QIYEkNg`f%I9kB`)rDn4(=>i}sl=rKo;Jz+GaE+Y$>W+~k9qF1 zgJZh4FLorN4W3<5JB0oxV$+w?@$Iawh6H$5GM7=$ctOx@b4%oUchp z%rYWo`F5kbh~?z6?7S}_G3dDE(W$|ZG1w1Cv7Nu{h^g1)^6^E1b6v@{lQLsXi{;Om z+FCwouSp)n*ndK#Dwf9=)>~pe^E@@|yN7ZME3BHydYzx^(P|d%Tp|>5HmNzqIXYF* zxSUb)8E)PMJ`!BFbB?96IE?I`+IyQq*X2RXn#_Xa>ru(=V8EnAWp<$!E9VmxXc0Mp zLF!6nk6!}Z8;pu?_osL{XVlHcWko}kQN{cN+W$BGefHMEzw~!km9?M%Rp9wadb6`k| z#+N|S6yvhhe|s5pW_mQZpIBUpUng;+f0(1TP3fjzfhU5M-=qwkQx5`XgOV$CE8ae3 z-)n9S0rl_3?Cv9R09CD7!r)}^b{1_}(7ff@nR>&&*%0k0jNW!gKi&*)%`$!pYXNw!pVL`f?c=wYpB;4%QQwx9&;v`W1Ulz@n(G*u5xe|+HOh8QtDq3DcLHvZoe(JgqcmOFDq*{$zgW8tepzG#ptpS z@h({-F9)wlF)SKC)^ZocDp%TyRS$VPy@5$$x9^Y_puP=aBTmS|UzKt@XOc5lw)me< z$%LIjBzMMSBiB#7lBfQoMf2YLP0qo1zxFJ1pET#(B^_&eJk_0Jr0_1$XhV~`J)p+H z+O}rEz6M2?={!Mi{!BLJx)S?y8;332A)P`0Oj{4Wvz|5Pd5RD4aFOCwwXsZ}-day7 z&iAz!w$s+LLlPzYC$vJRW$1kgxQn?TWu(`F&b|{pCaCeo5vev-ptQKE>3T@@=FV@n z8na&i!rq}^<=I^8A7LZhW?ml)slF!Bc_mI4s80%U602V~xQC694OUlrt3@Sq-IQiN zo(_mWs9h6NHTroBePzoDeNwtWdv$-In)n6fI;o{+PEG13Q_)U~k9_!)`#-%We|4FF z5h=Jkgc`qc#~9J0X6yGV@1|*-%D4tZ_j9O`sErJCy*?jvJ!&K0{cL!Bl}2s^S5D88 zM^FaNz|@s$4rDSqsuO? zOmj==ORRsndf1MHiMzY^rpv8;z%!-uH(TLvwuZ0PDVDTas?5gQrQtzmpHPoqELukJI>YfWu_q6@Fl$0`4;>z%D()C46`&|$4|M`12O9o(fAEFea z^VK*jqZCJabiN!`@in^jCi$ZN#l@>96hE!%I~-g1r$jF4g-frli!ktv`Xo=VO; zn|sf}Q8_+a@w;pMD?NWrMq~v< z!VqoBx3j6YPV+uKmii#)$SaMbj}0YLh0gab))SLXR7*8@1M{X;#?(J&Kn8OWE#5h} z2uNlYjOSJAJa$ehgN}795c^sdB^?CqYeRpRBIHay<~w}3ri;a^T`b3wVv^9UqqGhr z+tl3*B5Y-kFZIt>3LdU9l@jEA;N;v4^5$~P=80rv1%D<=UAa8GU!d^r*MK(3k*6^^ zX_wv<-N;N1n^*X6YWPu}aA4tlp~ljbEmdyd7XhZ4Ge*lIG3Rq1nAfxKYe!8>TE40| zAk6hCy5#ZGlP)gk8C;DDl9z^^FeI%x`M`%XA?Q&}Y8ymHUGbT~<|!d4o!(19JDx!PriGiUQ!Msw%uM$HwDy>LTbGg?=g#+h)-mUp#D#u+lR>a@ltg3r^=%VJfOFj7v(0I@D65QvP{>_;RDim$H4Yca(r@K!)v;SHG15<+`ssyTbaS^tP#|epS`{kPj)^#s(|%fX(;;9A~lc(j`I7k7cdtp=@_x- zy#M+Y@nA;E$8$kMux(Bmw%O$LQ$5NmY63v_-6(`@{4jC%6{cNgbo~0mD%;3;58dor zQD0d&`n`M>RARUr3T_byEaQJ{+vOKrj&=aW*NNb-1(x0cJ&KyK3jXiv zFP^<(VwSXbQ^7ttY?JHL?*2KzsK?(#+roJ`VJ~Wrlu09EZ5y(H=X|%X>Fj2}LyBK> zYdTZ)*To}Y>8ClygCPbM<-1bHbooWMI&0dndy=o&jN%tXa|7Ox!#Bx?(QFu(Io=U* z<1N4O&2#=8RR}29N|dWn9Qf&H@8*Gtnj#3G?Y*sL2hSOizn$49tYWjhg}YufohIP} z6a6>=6^5tiY<^(&5v1-*zMOBm(?4gl*f7?_s4AH-Bh}?U;a6usM}_Av;`T z^OCuSn@L&-AKBzE$&UJBf2B0#nn``JTh~5TSHBtH+MYIsN=oY5A8s`P+}*ny(eA$<)`a_y zD!N$^&MAlj=zfE#NZoG*3y0K$mYik^t$K#alqy&U8deWdWYb>9$4U}wc1E2`K)@?< z){q`!8X&m%e&@DfKR^sL^}Mumpv@eBALPyYb__=>FiKHv7U&!EU=-KBjv&El0MFN2J>8eO9MQ=@xjh9W^9yxBZ+ z%Ay`)l>EN$Ah$|OwnF)ow>|~>@-G?6t4Sc0B%$jX^O+h^ z19d;}2Z~EO>dUD2H>&#m1yp(Qh^mFBIO_2z8zT^k9O?0Q8#xyi@Ph8hcQoQ8M}Uck?oI>KdryK`S`<1#kj`=i{voR=}l2>{rK zr}b1AvN? zZtbg24eMF_C+|M#6P3subU5{Q=es_ia~dH^k5e+OG|Rtm+-_ORJRM(l?q24(h)6Aj z(*AIhq$@9{X5Ygu29Dr?Z(o@@e+I3xUwU-zn-AZ4#D#uCStR4z1C|i6p=5_N3FjK} zPPozQ5q@3nd^oFW_;yC+m1X!pKN01;bb~1vrva~7nx_0_6Qiey0I#0E7{7q2l`UsW;dwUiIj(QljLv&n zI~vZ!{48yL+IGOcaX{(iLzNBnz-x+2q98U? zx%ut^^i z{;FbVz30AVTqZRGR^A2?06^x)(4D@V0OdZPxFqC*=a{t|n6>9*!uhJqDSCfFd%-WS z8GKf&MQD+3*Ys9(ZKzC(8|!mlO~@%qsu<(@QBsnE$#CNn)iL)?*u=df`8B>Q$Lg2c zc4F(e>vHdmlXEfgS%#iz1jF0Ns=m)s-tV)6%BL3K^+if~P7Li)(b3Pis?3eE1vVe_ zQ}?2;WE0)4>qy}TN~}XOB%>dn&NG{z;hlfzx{=fW{GAoPTW0oM|E>6mck74X6d9<* zB&zAU?BUXLXgoMm#C?JYjR0(B5;I_W^05qrLQjAD%_fRgw5^C!cNOyKOu#bi;q_ml zCeP;vJeh@4&S&jJh|%GqT8(B#fOEF5#L|VGflEGSO%I95``jN;3M^QF2XeaKG;SZZ zlGr!|eCBPlc9KNt{Mm$WEhU~Hgd%dp_8k!j51a{C?|8NNW49V%)4g45MGXkG_|40! zPl;3|xG|3TuFKBM2{f|C_&NGV0+>pe@_GZu`vLly!E`KXX~rDYJ!D$Ve2SqF&lPxw zl&EYAHmJ9sByz)Q1c_LWexcAf!9_DK7%vn4*LOc$GeCF?x7A-$L)?$n%LqH07?HLl(MMqnf#&HeM{XK%7o4`y|)=}tjr1K+W$3LsU3 z&9i%<0oW#ybL-4f7?lczfl(@eQ2y3D$UQTv6OeSf#jZCOKcVe~*0pOxPB%B)LnIO>KsyGdz6UF8|S z^8KApDooCH&o>K|npOqc&#!Ac!i#}XR|7=v;e(hC zbdi*GoHWBCqo5*1@#{S*Pvnv~b(oPyH*gJ&SI{fOSCV1`Z!R249tYtEJaNh6fA{^7 zY0Rxxjh+7)@>#wgrTk`gH=3SY3m&rf#rPE*6?eT7F7dA*gPA`;243U;mkD2`y>;BL z&qs;#9=iX2J=W}iZbG4HpXT9ni7n8uHSCO2Lq09n;bKH z{j?I@TP7Z^8KZpiEO8}3B(6kWyLQjztgFTy=>-|&SR zp^N-IQEnyxoNh`uq{;A|c-ykt<`TiaWUXO(pTv$0I@rZwXwh-4GFG~9d{g+gQ~mO0 zP)jFsu{TgiwY>Y1nAmD(F>L$lE(m7*{c<0l$OfK(d4M1ar>*-mB%afZafRL)a}&K+F0ky zhT%Y_+9bfXss$Uv7TP+@?mftA-7oSbY>o5}e7^_$I6XH0R43n^Cxx#i7>XGz(zxbg zONsYpfxeU83P{viUVE}cy3PzZLl4hZ`sS%euE*|*MaHD#-Y!OznziEIrRkDbnx0#P zhH<6rj*0UE)pByFYe!%8dhXr%;-100(CP*NW(4v$PA zDhiVh{5{i_f4O-nIH5nwva>|rET%Ni#!9~eljh^*|Fh+ZaZH<+;mPm(w&QzxiCNxu zHw8p6M=M~paP^Enf&uLroMY0TJM}l4qtn3!txYv`G|-|{vr ztMih3;F;KYA0x~|?zGD382XRv2;s?>n% zzohth!tVDyj-_VgMmHk0WL5GmjoTkzkdSbAVW6Y;{|&enguox(Nd6ecCZXJ=#dblW z%3;HhU!*NOWz|GhLiyJLZB%2Axq`{yfxp|(90yHoGKa2wYg66KjE~eZ6V3kCFmIZa z(>5ZY#bYTKX`E(Wq%fs)+rjl_vIJkAzdpl@smeH5l|mcpmc9{)AKY$2?6uk7*ut6y zND9LMv{(O`a#Z|yt(^BInNaL8PyDf3(v^i1{rRN2XLv<@Ah)t{6$wm%c(2|>-wlmi ztRM>;9&F1R#io!}NYjCq2FQ5+i?bj2Q|!~j!_=Sl-4i+<_?r6`4g(MTBW+qmN8dS^ z_Il)))7K&pSU8<`jyj$HYBwK~Yw!Jha$yKoUHYkZ-}!5T9!g3shwY6nx(RlaBY0*YQ;I0v^fOp;s z#!9S4Uvatcy_M>&)iN!}UJw@a_ZZ)B;<3OCrqlo-n6Rxt6L^I@@_AqYy&84X z|HoQ|y0Xs?7LsP{psrd{SOy1NlVi)4QZYY+WlZ-ToiKrbHeRbQw=N@FH^qdEbzP1XwC)36mb+;PIQ0kcBE4vQfr4hq!?)Xw zW?^y@>)yaYsuGQ&Wb=s#Mtw_!;1gDJ(9s2TJkv8fcZ?IhPWa6x?5G;j;Vs6%(i(}=lG*RO#?6{^PErqEkB8x+;Jfzs$d>-hcSoR zE)S3Zspr_yMD8uJ@j*azFxnSLcqQnFL5Et(tON6mxb>&uO;Cn_t)mLJw7U?QQuD2~ zux%=aMI}ucpQHH^x9zZ77EFiH16|amv7=Fm%_JPnn7^9u0=lnM6Le=mr&h>$sujN7 zfDSiIn5bx055jB9h32^cHNK!?)t`~`-_34|r%sEJQ- z>URunANV1#XMKOt$r#@=EOh-B7mg16chHn+&j)`Q=|Spk4P`j3&rFlAl(Z=Z(a>ut zS2gWij&u%kO<^h7RByKjq-PKUbl*YqG~9rDn+{_-R%1B_ra$4=TEJ@U_wODP!7@Uq z@QFL{kQH`HUTNZ(N0NXtMnAwjEreg+C*O5|l&;$YRxq1v}D!R}~6 z1)OpaRR0p<>8ye@5+J(ETG~Um6f!}|K#Su-Ih)5`1e;O+lxgtwwB-dE%N+F=Xpr=a zW}w1ksIVxcsXJx$KES{-iec`-H^)jo7CT>L_fJc%)7CiMH$COF#`BRjIB;VRQ`dKH zY{_%{=Vo0~FLufb?7YL|#Vw#s)Cw{kPtlCvOol9wY|Ci9jLV+dVR`mU1+<@f5?s)` z^3+Hrl*z^NSA{$!nSZZ+C=hMDl7vuiLvG-Za1J{-b*TYj1EU0UfYjvLQRAZRLx&>^ z)3?JI;isf{O7moxhe0scESgfN{s=t_&m^;cvq2?FwSRfn)o#^f!e}tS7iy%LlHfD} z`>!rJ;3?TFaPlC2^$nOEtNK`~Oa<5CCjuQ{(EO`5MDv(rU}fhTz!XGpW`FK4%0sF8 zyw9C0vc1~c&aGs7eYRY zZd;vI%inROu|cC$h1LU~FjcUYEk%zw&U`e|XUe0ABYukIJ-o2V?zbD2Ao0v#foo(B zv4nTpq;_Agv}##Jb(uzW)_K%)U(I8eNsHrbz0T+N(VUOBGU@p`kCpfu&JiAA1Rka_ z%?+)>;Z(I9so2s!r8&y^u*3M}w-T(Q4mWZ}#(nxPaj_H#n;$-{Ds8q_9xDx+H3qpgzFp>Ztd=5#;&&n>Y>$t}kC;|I zk=QXgu;`z$Xkpq(jc0oHtmK#;W!* zS?*Wm6J1apXGA!)RqIhUt}bhaiz2y$VVj~G`M%}$ zCRS99+$yD}8Mm6lelm+ZiEX{Ld9e@FWY6q)zPvCVYFXb}T(X!q+ zn3P(DFuCaDZF=41gj0XK_j&8cA}P$oJGU0<)Pj~>OU9^v_(y7Oz;R--zgmxlc3J#_ zCv_!V?Ru$vCcJT-#xa+oYkVQfT;!BPoMGKW#$|ogrI;N&b!0mLZt!O4(3jx9pEZ8v z=6ROQ#>Q1&oZR>J0eJ(bRMscB4?APNH54~)x5>MT4O1Mhn3G+I`!2ST(}jv?F89-$ z{O&)HXW^IJ5O#!qyHf3EjH6&KKpu2+Z_PX8%#|nq)cR}0^wdypi)%zo@R1SYf!WsV ziVGcHs2GcgaoOCP(@M6gSKM!zD4XcU*vy+1w8s}?;%#DiG1m-pV~ovH55^rm6=W1- z>|t$~l`(hLT=!N_CR_4{kDp%sZ+fHbPyYDf#qls}j`uwR?|+zqz-Z3x$y}wYi&wi0 zoz*5Yf41}&+uYu~Jt_UlQU6G5s;ClHy>>H0(I=PjHjtk6nBSD|fP1HnB}wJ-Ws%1I zroO_zBKpF89{C7obA+zJmIWy;=9oz(sPKz@neUspte0MAieCRX`zi5e>M`w`Bk(b$ zNz);bwDdy0c+Z)yu=TOg9(ou{y0*vc8^U~c^Wr7DBb+BR4ifEC}=eJ7J`~gqA zwQOn+WQKpBn7J__nnjBJ3dSY<`eUmPos5>ng+Z3ouZ-CK*ru=Jk7#(AhEanW#B^@$ z_RavbmQk;3f-eP{*6Y|V)vF@%pZ5XWaSFXRU zlyGRX<`XT1j47IS(B?UR-FIeoy~Ec^ac1xngmu+BF_=%i0R0$E*r+R(!!!jbpeci4aB1U6_8h!Ie$+Tqkuk=!CZ%J|Hw?GBu8SU z(WJ9A8pW>fmU$Xdf_?$b)DzB|!)K2tjUEIh%Xm80PX@CU6!DT3!!&;+#=vbOz0i7YD4jo0Vpr=xp zj)&EG@<6~J=oo&=s!dS|TBQPs#%a!pMVf(l?)j6$%3j@Fn+78M9@H8T#d+20*_nIL z%{Aq7lIYhEc0&K@9(WZKU;kEaJ?S*Wj-rplSA&5-63pZP6<-3e7XCPZ#s}ldY#olI zp@S75?oF|k-5z~WC9p?*cN*IRipbDR07<-G{=jlepmX5%6&-NNGciDeA-`fZmd5+Qdq<3?(De9jgv+D4Cyr3DO>* z)-nYr+PLVCGIpy*X_dV(%|wFI1e*3q253XP*U|2$q5qY4xSbdnY!cQr2)8NbT`x5+|g@$yC5(M1T6t=8A5v{h)dB z7ByuZHlgowC=2F}%>-bZ9e zBNk$1(7Ma&%eQ{BWx}?X;mx&QG&zwg)@!f{AlV+ezJ=;V2dfoqg|v%J7}~Lb(G%|g zDFUUeN5~@UH(RL#q_ipJebJN#|I?vjXcjI*Nqes8K7$3CI#7wCfvp4(OaUWG-d^km zP>#X&oUtKDxkEHA#eIOM0RH@@MbNu>J^>4NU?34}|S>0XoQv09XMC?U;UyL~U?|X#(WOf_N zZ}~}x{mnLUFAKJ|g5RzO`$&J;Wvh9e8PO7FL%mbwruY+@w7t$E?}GI^3P6 zaF7q4hlK$RMblQ(dUlHflof)ACZHkh%ckk~LDVC=E>*Dt zWzlW3=SEbI#_u?ygNE@lkzfyk2@lPdXY!gXa{v2R+9fl8-Pw)BpHVfcN^?v81hIEX zrx=luD}7u{>2ul*4g5Q*uilJ0Sw7@FJ6ay7XE<4s$@x3xsH__@e-xHnI+KJs3yt&tmIzh%8jEEKCNHsp#% zucqw|zn*!Xd*dDC1QHVTm;0+fTP|L82N_GUW+PwQ9ka4n?%z_+Cf!ZCEstK!{`H1x zD~x1qS|#w+Z=1A$X~1wn7t&$J%r%vT(ADtzDxb*pGDM=5yO>ZEz?{nARK!jbzqX8@ zz<)=teua1?X~I#TLjWn!`gMQ3$;q*U9q!Tk+CoU`& zK-Nsj>ZIc?E4v#~>lYn!uJVm7`+iJwAx?UQ;sdv=uSs_~Smas+{x(jfsHq74+32S7 z>St$#uLVwjlh}%a^%vO)bUjHM`Hm*uahl_!h@gZ1Jb89ZDG0ej2Q(^ohQp2a!A@V@ z(h=2=U=^N11_DGGf5A^G*H)>iL9$c)R)X!tFZaIQ`gn0B>k-n;9YFocG_3z-Q(vQD zC^-f+F8fJ1AQUzQ8z(DYF(L@dPdxLMXMp(tzOKH|W75BJc->jZPuzf+W81oVnoHh6 zh*9EohX!+&-JL`8=g_g?m%D>7cQdlk5-MtW-QY z!;_g|+K=_TZ~v0lcN$FbFL^YqBbw)AK5ubz@|CleW5(Iir(UjlF6q&t5mLHiKc>?5 z@BeEhPs)Eg^%cRzyyj@xmoIN4-fCnositc=U(JbZ2)Y|8EaKP^Ad$s;FG8V7UgzP@ zg(_jw@I!Nwy^ei^PnEl7I60_;X^EY!0#hc`B@Dv-|y7oT}4%Z1Y z7vB@CaLe8cSe4JS8T+}<-_dctId85Qd~HGEo|l~Mw-K&3$9F?M8u-s1org4go6FdL zbpxzozl1YXY7!B-=5hVL&E(3FH1yxDP^R;$x zRbdwKa?TZiR5isFx@7fa^x-!@jqz&>Ke2U=o!b__*+g*GPY+&z1cIy8V7PhRCikTC zDldqPaPTx4+tC7Z-Ah2}?F*ElGFL$Nfzg5=wS|^6vEB*+hNt=})Jhqop^HEE3(bk1 z>RSe|o$ml5oFpjro6SZ*8g5TGjrlHtEho`7twO%feWDBQHfaV>Aw6Efy$mnCgz8|y znkF*#J~8;9K7{t};h64lgP`0C1le+D?k_agykUMAU)elDyyB;%@V-9eqWST;nX9KS zGo5nuCH(Ty95Ei#(6XkXPlU7Zxs4&TsOh5~U0}UqhP#~qWYu?ei1FxiaEFanhIJ-9 z&my8jMh*ShK9|j?QM1oP^iyi-Xd%+VfWYgaEpZ*A`<%C}{R#W+=r!j9`o+GFVxR7D zlMz!4NW9x?#LXV1Gwo*_rhCl|AGwT(TsDzg)so}w#FwZn)%H1u-Kan=)%KE#{EQcL zrPZPX+cYFJn`^OIISfRaAR=vV#f>GWdFH%kGyJF14f~DM;pMBAab%>?Fumtkl7Gt;t@#*A z8gL{1D}Y^naB>G1F>O(8sB3h?0{7GCK`BTlg>fDfum}Vb5{dW#|B(#jbm84gI;;=) zQOL7q8bcMQBIrE#RNrweMb0zlpw=zO6aVM3)~RFG`xxgy%RT5qkaSLTJwK>zE2V8K z?ZK?->e92(yHGKHV3F0cL%cTQXE2S?1zk$Ia%IbCryFg(Z<$WK0j{Y7!MR1#!(fv+ zj~__s0oiM(4W>E3H8oaP0Q|E=R{-9~k}DDssTK5zj4niEtfxXvTP%H#KrNA*pug^R zS{tye6vjz)>rJI@pMBk!zkCfI%-YF&aI;9gU95jVB_7btjg(fA=zFShZKWYlE6V|1 zfXP_T$F+*Q0-*^U(m|i5F(KQ}Og9yKCMMMa(<`SAK`RdGFMRWaGF2l~t2K7-$(vwR zKg63aYyQMf8w%dt3FL7LQEh^8?Y*M1Xiyfy?qLlQTW=}-W;+|Z^cK<*N}0W^Old1c zd?e**`%80CRA&1~tZ+ZHB=TDZou}eP;`%J*3vj}EN-vS6>H9UetT}EVzlo)Z4aD|r zq(u9Z6UtsAwguN6U6^Oar?#JKdunRG+90f5*<~G*Ed-1Rf$&omS}{y>Mzr;N6CF zV4PPcQq$Um$T8^pV?o(=bDaidFMGbh81p%O33?bt5H(#n7Pid;hKot0zMFMbDQ*d%Z;8UyYA>E_~YUa=Pwb-;vcgX5_)%;K$b122-02wkXo9$Z&Pr+r(8z{e5 z)SdkF z=(CK)brnbh=wm(%pblY73zXkrM_@6351qh_w@h5^CBR$`iUgW4Zw~wVF4OeYhGjH?I+B(Yf4;Q;vU_@gzs#ytIp_6T<79` z9~f@(h=O~L>dNUMUK5^z#i-khLOvKEKI3lQC&wcuo*kmYwR4_BfK=LTIBqEYYGJOk z;5(a=AkolEnh~FBJz`=MUl+BZnhtu?A|Esg6hxHMxFP^>p!lswus1 zp!h@i5Ab(}{zZhr&fUcf%u3fIp9nW$>0{3mAth%um@(v8U5REW$q!(4pYzFu3P-4+ zuM`Oftc`lwU@f zUk=ip=5Jb~bOU(U2oeF}RMT#(78_zZPv%4Mj`*G=!ySVeT$*MWo6E=A=qkjQwB#2j zd3J9H#Pj96o)+8ri#&J!7@z;AEc<_QpAKkvH#Fgr!{xpOto3~{DC=M>crWWlOp#fO{MU$yo zBD&o($E*{fcGxIO9BSWUNu}&E03T6inCgvBWtRx`} zs2nFcgdD(_3&{xq05!45FNXh;B05NFIs*V`J^wbS0sCST0N}k)N>oV2L+|9({TsIC z{Cn(q_VcsA#>BzW!Sl)Z_?f&zKf!=hOu{G<9r<^*6d_gvxcHxuP~TYtMZdF|iNOl7 zkWv54$ukmH{5I4a2>0Y(dS1v-21Ioc;mlfSE8@Ff)o!#~s8B8{Z8?04LO5L5gt>Qi z2zut`>Ut&0*z`k_cMyc9Y03`9TAk=ZJUe)S75X5`w8r&)_uxQT21-d;xnxfFLS=JUmnJ9v`E(-00lG{BJL^5_LF98t}dfp?C=-9gKixi z8ZwN6scsg-UH?)oxt4B&zPcX1b#NdNc>-f?ZH*NS&fF|6rZtj`NeJP;l4M-T(*BKJ z6}?SgO0hcCqeS*0e2tXs7Bm!LFzxquGPeMsnqSh53gpbBM5BQQ*=lLwOX!`V-zN0m zpVX~fWdl^+?ixG4%RuX;xFN2$P>BD`NkZ|eW!yF1qCnDz5o&?XAd2&o<)raAT?T!2 zl9H1vRMU6f9mKF2+IKUbbVG7}x;fk#hz)~$91&1a3)S40>dY04jL0*AeShCz{O{M? z8BtXY-WT4VH;nX;bA&dZ&#or~c%5z*&#EVdMBXmYqxoG}-lWaMd)Fo3*S<@{5N}`* zVG!fJ?hD6~f90j7E3!*XCipwxk%rY>hzF^7EZic zi=NN*^91nUORQyY_VeWO&E=_3@xVt;y&_f?7nc{88zmK=mA1FHgMx>L>8utrGj+<{0eOtUM1t{DfUoPuYD*n zIH<@sH$OkF-}JJbIbfios@hXqTk5nn{;>8v49vt(6=v%9Mz4W6sO5r&oo|j&o|3h{ zcgaVa_k4dY_!kg4yB(LFj*O*%yv;%O-zUe!L|S1*oau3y6?4L7FfxucTxTknuGY9a zj4(6skbu0GYE{wB2=PW!kjLhmD_t)2Hdd#vUR2-udjH;xTF=>E8&W#LbhUPSvTxeD{A&R)V-ZszB93K&;rNJyz zZrE8`dR`wL-jj!hgNd-xV={zgvQ#Xa~wy3tQX_dV2@?KV5onmv}!DC7ELi zGZ7&`_w;+wF^oj%v$|Tr*^?r!i1jI)*`V^vj*w5)?`6&Y%4wGStv!t(zI-atJClCX z1!GOV8lODhb=ufJxq@|q{TN1F+MJttFok`42XnpNKaKr$uJMvDEzggwE9(-gV0rkL zG|eKn7tBPy=xrFHd@~l(D^|KqRE1KK3TGFK)-1Yix=e%109OxrQ>h&qF6tg2%qx6W*1&Qb2Y<4a z!c>j1r#zMP4o%A6`MMb;TT>}lER=kz?Z?DINN!4#N}a2ZeqfcyIRx>B$yVR{5zArA zvP|TEJ~~DG11l$zFR{LY<#T;`JTP%BmN&o6w$F?jxZRD{tEk=dT->a=+4PzG{BT6g zv8F=K1_g z#=oMeGvV!>NN@rzH2W;3Vdy0d4L^Z?hha(x_?b0zyb63^ zEK7M~=~8gl5M0f9w(8+J29G>xvlpwEY{Iz5&{2D+?aHQTk+XG`TOdNjs!iyH>nLdEC$Rp1xbprs|# zgNHdUo-X3Lk?{Yd`~E$?fHuO3Cgsb;Vv_U-|2GPnCf(Wb^vz^K>P{^|II~8sTZJyw zc8jOo6UKGaYx^}f-H-o~yX*Q-*tHp+%e?sW*b+wD66}=ga)?9>Ng185^UXzWTN|Il z?rMATFTYD^ah{T7bb`mUm?#D(3>b2;fPW8&2*c%au?+ImwzRa|^W+hupuyi9JL5jC zVd)}UKf%p-iLabw9~>+i&yt8Vfo@6=jfCVyPbS46t4R5aQ&5QTCwDhn^WL~6*uqqW zU3nJW+<^;m`8zgui3D<47S^MWX%RwYTWWff!h9z%b$N_jA38G-=WEt_%6^4tDLAMM zq7|v?#Yyw6slz^a!rL#2(u?NJ&vUpzYJ$ouljql{ozV1$<(7fLGz0RA7|+u!n1t;n z%iP|-?^q1kOG%@J^Hj$eZHRCYG#Zu)+yPm#7Z&Ls;xZ8T5osRyqoc>#N~l^|j4*9; zDZSXbdjD?0VC7d-Wa5*Kz||*^xhTSgpB|znWj5Lspbs&fmDm3xPub$4o?9jSmj(-EaHEJ{w2(sm zvlV}r^=r_XfX8mj@bxmNEGoI2_VXxK1MB&LOkqw=K;<9k-)vobV$2ES8QQ1KuqVg| z%;TUGCy(=S&k_DH}_YeObB~ zQRm>heM$9YGK~w(tvfekH~jJD+iU73LFtVSZ5^(ffurzGlAM2o5yic*Aiyo=qg-`F zM1-rkhNfnGzjMVHuWHA`j_2Lej=Dy=3*GdomGzE1Xd>(}DZFCd>y6_nGt!07j=fnq zM3YrvoRNJvO%ad>>%l{v0jDX_Wg6%Jln zUuWXZy!0#ckoRuCoUGlvq&Rc&N|SAKyQEtX5p4;vT(`=fIJ!$!-aPR7*6~NSaT7gQ z^W=j^P*EBlpI?`25DaM49gxlXx(UVW0jLa%2jO0hNSspR2R!DpTiUi;Tw;bTDO+xd zNbYc}nTaYO$t*nD8b|3oHdR>J+O8cP)vsD1VT{Vlh!AM+M!tNEZcN08Pfv|VpYmuJ zoRjutwD7!Ld}EyV5-^a- z7ZZy?t+hHq(Dh^vaeTaaVR6ypGdpsUjsbZiXBwU2M8+3ElF%ylnKKx4f-+OH8ZG=3z z>NFa(*bVhx8ozKZaIoBO%3ZX;LbFH$dAyw*U0p+xkj)n3W|&8rMzxUNMd^1Suw*ZmzzBc( zBF{#eU{#oCS231uTsb}3dLeIdF2|Dh`Tv6;{4bXem=S`=hRqJfGiQ|mUj;Ez)6)EY z7D;=IEiW(ElR=ey3s*u`dcV zm-!c9y&M*0*K%lL0s|2Dxiy2qJW}ywc311?J3AC^>~VZ zx#}@68OQObL1rsTkubDEwSnU;#t5jzrKK7U)wMfGGK8y3unvIiHQ7$yK{}S(c^?Jj1&+X?DV_tyknnr8vRf!G5%GD%X&L=W zNT8sg==m+@;^N}t!}kw&?Zf!f!2Kj77`hu@H?XA!Yp4Byi{G^zH3?4I-g>Rb+UKpwGi5-@se} zo%P-O6M;YPy2r94V^4`VR-UoZRwpw&3K>XEnL6Yo0(E5%kC2ex0G!kG{{`tjbXNaLiwODC{QB|u^WLc;K z>O}1g71EQxy~cR2>TUPy=)L79KB;~zRsG&WlrQc<^Vfq$mciD7&(rZSV=dd3>kvWJ z8f~J=-crEFF!$PT#+22IhFv|V?w(pBW^pS2ccot1|1gNcTBm(&S)8JDEZH~A=07c= z_{C?4l_?02ai*`2svewMTN|lWQNhj4T`ld&eVx7&IRoJvrKME)5UVqsybIqxx2U5rPa>a6Kuf+d?#<4(@t~Tg|^oj_Gl=ue`r8w#P^zYWZm1cH_9! zaV^)`U7x?LX41~f)%7%x-F^Pa4sH3b?iIs;;K}CB!rbA|z+jYwR3eW!i*&@%90a-+ zG%6k=Rvt{!T3A_F6u_dny1JrR9v{6&dRF}0Al)EoYv*q=9Ytx5I!#k~+wA8n^yr!HY9YSZKNeEG3hn$|ZSJ*Sgz57` zAryjqVR7o!Fo++Ex~*|%W92_Yg39d6KO&KU7&=Zd(OS)Mto|Pwu^jFqp-~x0GE}A% z`P2g=G9lIImVii2xIIrNRw^LYlafjPzRR7M2LZ>0b5+0WV9$6vkB0Lp&KyV2RU9T3 zrQ@Y(JZ_=(?+O1)Efx>r3}r(HqKk^A&(EU9E?@{bU}W^_NTgk{PVgUjQBn?6@}8v7 z*4@WF)!ANib}P(_G&^exS`b60FirX8cU3=&nFNgtfAI-YWmG*dm_ww|__PH>50h$e z{>t-_=HTxZ!Xd*Tu+!hdVa%8_wLhpmwp+tZ&dW>C@fwH}fiiLQ|X>QtF4U7DRN;zgqBm zaD{tGid8K^SgWvE4=lur4bE&Z>B*o@sf#~D$4-ljXolTcc59v(64J3S?t0%n&c|zXBfay$zMoMY{G`^JJ5J2j|vY#fIW^1iabj&CXGkeC_>i0!pcCp zR^A;)>cL#4li&ddh%zo?GkD1TKa9Z?t)Q@$x~Z);u-?WN4^$tam41|cfY$&*Na6g} zdy{}DpKS}F4C$P$WGz7{N&RVg>JwO43S8Wt2rFU(u_UEsw0~T6f4E~%a(5*hoFsmg z>a7}tIUZf_S^4lerXDHJ6!stJtwZ+0tztG0@|M(dDNGbs=wZW9XMnY;R8H?0Lr^E{`dmGnj19l+x`9w8?vIs1o&q)*b!!qXu=8GG$M4 zF_&?Mv^gHxbMn_+S(Z^+i{D>wWikznAcQfH6I5;i8vZ|*;@4O2ujPI+$+0MqPQhR~ zakLhtMoTw-^tM}uIZ~oJy`j*YZjQs3`H5#5-8<-i9fQC1tbi4aJd<8MJmrkMc&z^X z!Q8NLbfSb&^GNh(b@1o{l8ZD%6%a*(0Dr=^%=7*B#jPEl0lTghbx&AR)vsT_hOp%v z7gJ4~>$qsQdajsFq%W}3%UlubE(BfA&ONW(lfd?P&F7W$!>P~QMXk^gfU*n<4sPyX zI4Rm?>=jrT$=by>WF0QzqpIs&m*f0TZxWxGyBgdt%ji7?mcX;%e!W$g?`Xd4U6NIS z5MB0rK4ODffctq$7~D+s?SWRhI|SY%StrQ5a>O_5I&!AgFE2MK$J@Qy-tejxTnk%x z_V#^RHFGK=U%Mh1lA0q(*ea+YFP?${(yNu{uz%i{L%nw6XLKNo_MBN_!e+=c>vkUh z^3}@TUV+~!fHxCue;<|cR0kd71`(11F)QhaJZomogZzPBCbD7qZ{0HMz}5EZ^3m{&QyUWVOv5N0)=rk0`34BcpAr_?Pmfw8SC8TNGs(ftwz@JLE=g;! z4rdmn1DPR(b|4_XJcp`ra9F}0yPjd(`-4@547NcYu|SW8#(mOlKzDCYKGc&T4cnU2 zm%4gCK~VX4N=!h~)nPj#E&>c9JbF*f<5v9LviLUD%3^HOyxN98Tti$w( zHq^5e=`=mVwL&Bs3_VX|F8&uT~$%Ws)0a>^4CU?NMq|LHB5@a@2XRA;}m-fW_p>L zkI7~gedz{SgYt@T>*)rf%3z4f|NjE<1~5|wECCpz!Ce6H52$cJe4#J+DF4gJluj}T z&j0tF?wo=MpCcn9gM$Ht0F9*IzXR%IIDy;VVfUvv`kZuh!w_=-_jlwjey?#sHHk<2 zZU`1SStXvSsVNmT^)K=hQYF}L#wEZ|GeuQZRap93;$MZ^-@Kt2>BZGofWOKHuUzt- z3nn(laTf!!vq^i|k7?kDy2``8MYfsg05^GjeS9FsL|16#;sqHh8Jy$~$;#u+O@I*W z>Cop;SgYo;Z$K7=Z7-xMgn)y8tb;K;-XN%3JkRpd^N7xIEz|Z_VjYDr8y0 z67qnsubb67xDikv(vP7Q0dRuIheRljSa9>W3sL{Pi+FMX2JB>a7-K{i`Jv$_Rm!V~ zFj#VUG)1k45q&baChY?#3Q`sW0HaS+-{hpCMo?HtD|+rAzuX6~6yrF;65h!CRa(v9 zax{yuQ^!uXtvDIU&|EVdpb9w>X4?=IFfLsU+$y}3{~a#9dFEBZf$tClA56#&Xk-Q3 zqK9E1qEuq3(KsU4$+QF^QoliXS)8>x0?x&^`s!pr9Eu?#NdrAJw$!4-Ya0i^BgY>Q zDvD-@nM%nUkv=(|i;L3qL?&NLj?Y5*3o`+TpJVg3V=gMiS`CXo}ZuJqCblK zSFeGHLsKv+3GJ_BlqK{^0q_TOeQAJ*_g^fVp|>S7fIH3^7t}@Ec&ctsgpbCr_@1xO zD8ZJ)hwx+^?xarEP_)0$Fkq(mJT8C!r!kV_G?{(-AS&{o*84{t_|M$gkgB!~h6i;# zkM{)Ez@w5=iJm^(t=Oj)8nNFvEP>lhf&NcfxUBngDd-ejjh1I9GwgMvNUB^(NnI_Ukt}*UO#3#fLy(XYOgovt7^p zX+xB*k@1dk-kse_^T^VO`<+Tc4zYH}tKnZ1_VyItt@o#e&U;bP@Q8@lmpcCeA}%(U z#p33f(e3SRbdtqRc1oi`dy4y$C^Up6ps(NU?Lxh>C~L>7*`}c2Yx3<06%Q7wuTJuq z_R-5wC)}dekta8!i-S{4OmtmVtIzw}tDc=q?&X3$I;Ay6<%+M8=XqZCW#fLs^%zZb zt!|sus7LT85kJ-}7V0mwWPIdmvP49?ZJwzd?n~Js9opwLM%%qZxS>0ocI!mAB*cV- zK-IP+GNe^iM6cQGxC9UoZI7ej>wTfWz?SMSx&)gssbCp*Q ztyE$6Bm2|YNK_fQKeNX@LL|v^^f@1Qx9#RoYR=fepKi9N(Tq8GTaAOmGP~-Vb-~nI zhdIR=bfCtuL;t==Y9MdSG7~CEJMWV9Kuz^k`p zSuHiZTR}2^Q^f*5M@gZV3oGrn_Wrz!By2rRk@8rcPT+)&)!hJXHQ9a}-e#1D-eIzL zRY*B;USy;7yes`%L)gbYkm!Aq5@)hfKqwTU`NoS`p`f?1Pb?UN*YhFUdj^+k4Mo6@ z-#~qMST$Z`fi#0Cb88QSlWB9e{#N3T9iLH+-8&3Ei#wx={V?~@L<({lXQoE|>#R=l zqN8V_SR?Y;7o?D}F`RVF{;c+9vlZ5|i{GAM=Op^RCT}Y(JQ`w)%QuxBe=6GL7FFDC z?KT6Q@4C!&)J_{OxC}a&d+rZMjEk5mOrFn^p;n1&ykSD7$!^O4)PlC*!oGZT%;(Dr z)2Rds;{MEl#Qw7k3&4~r1z`}Y-xovpIrQmgHf(o(<6 zZK|64lcgC&{f)&%$;hvBqgtq_WDe}#c3xi8d-ty%E{)x^U)clNUwTS6a5{WFJ1Z() zh5Rg4b!TuF#0JRS<2c8%a5`*pk?^z#pIf-Uv4{XTIXM>=<`xisa9$xvyzrPzd*}+; za+jyarFmX=9Y;o5(YNl|9MJyu5dyGxLTl^lDl3abFKZda0jN1j_#L0fxrBZ}_T4;H z<#ct4Ye@OMdhN4{|so<3O6Ty&XY8S!jpmLY!|1-ziO;J_lL`oz3BtpRjFAPNB2v-iwX>NcU4?>Mb z9Yv2_m}kX6$Z`tz4+J#8+2$bG{DtR0!aH>cswgiFT;J3g`C{;bIwyBJiI`zpT1s|g zz4-&cp^~e(rug3WLp)ai^L7H@cXzS`oV!r;q;2HfH3q~GIMvsMc?qIyrln~e9f7A@ z*O=@F+Pamzi%_Zi&EAgJ&T!g5X{RhR!(Yz(J&oDZ!{y{#@3OK4dd8Q!nC_)ZC1?G1 zUP=g;n)k(V>!Z*hik-?zV8rcczIWrs&`^wAiwC&?CHGg?n%0fB65PVa`#($EElgR? zM@n~#@jV-f*guG+b=g+-`*+A&{-hKsWGf*HVTTfhy>bT#%@%%?mR|2ZEmQKiEe+rc z6wSrP=0;c&A^r!d(C-un0ODRqXBX>X{Ik!_0PEP7+jJ=X;}vf8&S8?5Yi2p}sYZQ& zV*KO`cM8w)hQq{}Fh63RUD3@WpF1-sV9E!rO2qV>jis1*pGc4Bu%Pna`giy4?(f4fav{<(Yti%g!ZbZrnWSKh4c zHd>dFVgu0&xhprAN$`>HCw}(@#hXtu=Jn!QB3BVtw0(J2J zDG>C{D9-b2DLxA;F3;3-(u_thyXg~K#pS3yUdNCWuOr=|&y}O2NWpV8@9JRhjg%z? z{#%wzzrrlM$OhO&MkP{mmZ{R*Lw&=I1$?c$Ubx7vj;8PB^s+dW^mNoz5QP^Ty00hA z#*zwWORde+ZCt4wJx1 zao$66g#UlnHxC@kv@)f;NB7(7>WG=>VRaY}oI^5eR?DW^Sw6_xhc0Wa!{fLsBFbI9 z7rv9hr_Sy=2CGKst1GH2qcpGE3N}#7&Pn&Fw#D`|bWXL8IbjF5F<*8Ow&Gdr73Lm$ z$=-8&dSAoiefzoMFW!G{u77n?(v~kxi>)Nn{(XWt25QxrCBSrYJ*(AgwFk9Dr+t}a zoacf~0WF^MFP)Vvy8FXQZ40vIgl1-YUWQ~3;EWp|?6WVrG8P5OCJ~IqYbPs#k~P8d zXx`rvUk-WdTH8WCJy4V}WUK7l6i>VR$)YvI4yk1{I2I9I;%oRP_B*+-$-Sc~o=kM0 z2LrQR1PMftlP4CNT`uTeI^sA%^Y=KP4?)HYui(N5uLVHLEx;S7_qTR<#fY3Hz&uRP zR3v#Wz23228I&8wtCI;_G#qoZqaj&QvJ}(*PubFi;nnjou5^aOT|C`G*|g9{;Wg^0 z?w#i8mcgH(ZS3x)KDR_JMg~KzqAo&48V%4x(epLAnv%28K_t)vC1QQ}=2KgEBKD~+ z|K{06fG)3rruNmgVsAq$vrL4t!2je*b%f!16PBH#Db2jj{c<#=a2!g0>g*bAae06> z7WD0WK1P;%s~cHGGq1f2ewCO6pG1r?eUVF4#V)etX6;<;S6(c2x& zgO10B!X>WO+Ui+;hZxKI5#;UMJI>f!h26yKV=l=B!WNGQWbv6ZH=^DSi;V%B>ht`5 zyRy(;??<&i8|81K6`7fd^^(LQt~RYRlTkb()N^Ng9joJe8tcS%uL-7ssgtxBsx;)W8^9TOBbL+R>t{HE4`*zP` zxAq)@Go#IS;&_SDk;vTAQcRBJEN6=2)7HkqZC@>|r#Fo87lM~2s^RL7L&&;nRm!d& zjxw_k9Kmj-9D^HMtN8@I*A`<42`HOW99=pJy1~Mb2eT|wi?RhYi+#{d=mDLmufpy8 z38AA3aJ9L2;FrQn(as|2{@0(|d&SRpRwpyreIfQZm8)SxSJ)J9+Fha9zZ)Cl^iK9^Z#r|NIfJq@ycq?%V&<51H4q;CpYe@veD4duofL zG?<#=bZYC-sLp*|B`?mY4nK$|k}@_1T0_FEYJXvCw)@n_uw#CoR&ri3{0RPho zbS>-`W;+AaO~RP<8-8mMmurdnCx>4gT~>6vf2}7A{#que0qfxEn4g5=_Ecf|rj-_a z-j6zqS!X+w){xY%e!dPr_p5Lu0o^wa;<(u8p4P?Sisn6)Hlph#@-~L+N`ee@TVoiv-4C<{wyRa8GL=DDr zt31$1+2*DD%aOY*FZ9txRA}pX;Qm}Ca>W|vBsT`?=MDDiRy+ECCLCOH$<9#zS-~I_ z6wYMg#$?;mHkyyvntm|f6&6L>v*8^)b!B`8TficC%W2kh8#rl4M?Xn9J31Qva2=H2 zw&7F~_WW?I%1zzsy~L__0sC)V*i{II>J0jQJUxFMU>5u(|3P#O(uvyO#XpP%|7*Df zYULVRC6sRGW`2&@)yqqc`9ZgiNZEBlQ-Gh&~w+@13>BSjY`D8sxfknUa1 znuXVhEQ`pecFIRC_2e)0V))fF;IE@3euNH3idNwaW1gx|Vsdb--e?stOv$SPyo-$i z{@`dr&T<@s$cU1T4k*S!Fc=&Fc?Q4tl}9DWv#6G15;ULP>wNWPEd0@wLs-W7nhiN0 zXP)}%tG<7?PcR}Mje-p0Pc3eJky9%^M-ZsSr!C?o9cG|@wszn#o){QhPZxK zx$6SqPwH)T-(tL_^G*j&uz^X_mP$U(&=|+>cHW(B$ z%dx7&QkDFTKHWR)JH>N#D4hkNy6(wDstbr6-bDj78~X4(i>TFDt|z7I#LB@z?F${B z+qK#R0&1pV+Ad*ye|hoKj0T%uGR%LLP)nc@4r4T`tJHlyb+iPWe& z+>6G}QcmJXJw}i!Vq~23513l~K(8w$G*|g~`FWun3&|?Rei=zj4_GN&L6F$tfn*MI z^(Iz&qJjc4mrYeXcr-2Hli=Q%-4Fye6($ae*{!eVVvG(buIc#VF{NZXeStD_e+%l9 zK=0LQ*5(@PJ{ku_2^=>b=m~Bt(!PDbffo@G`RK;K|MvP^uN)uV&a&TM!8q7$!ZGL* zxjoG1U#a)A8Z;-b?p@OyuT<~;j62PEf@M#Ll2o`B(k229WSOKK{F^YGPs{EL>_G(-=`>O+!ONa4?Y3B{VW7_T|OL%GJQ!9DcELGroX;K!GHgyc-Q*RVzT95-bCeoGGlkY6}WrGL*E3g~&d{&9%1VDJ@@T*wmC| zQux9V@c`jaa$uL(?;%pJQWWsMI#_-)fZDC7`0qp932rD1t1Pk+4Kn+yG&$6O#tUEw(3D!6=;<9ukx=iz!k%c=b;SKZM^;luTH~h#CL^asn z>UNc`9D$~Qq6uu_VItaGPQ-3jW#B8Cr-6I_J$ z5CATA_E_WB0iw->0aoyBoKEi(;wpIttVsyZ&ma81J*x?noEX22?^ABgOD|WO#6t!V z4-%zao(R;c?r~9Gky`Iz-z-U zXicUNDOFR(qsPIWd`=Cyt+R{^u|)*#tdj~in()Ecg_V!3AOXVIbjGHGU<&w6Sh#!0 zB=1H;wCOEH4s4Y6pin*T!JCGJJ$fO>8rzg40idP!PfMLySy|G+6zc?Q+DiBUU$lgg zb*WEuFw_BZDF9xq>ieNj(19@WT+}(Kv!c>~bnnTyK|{g-D6nHcFL?y%S^gsHHw-rR z)yp6u4v90rr7to8l{rxOEG$NV@-ArpZ$8~%z^_cne!ylE4d*VP9080EXmWr>e>REo zzKiF>!f2BJr`T7a!L>$d=yRT(@w;6E|T&-MT7c*vm({h{jN#r3o z-F>P;irn2&OpcrJzmMaIKnjBTNtTABBS-sc6GSFy54fj3@kRQd4i9mIj^H7lY7ki( zA{j3TE-r&~F z;S7yJ7N5iBH&Id16dPd?k&-!JgYAlVg&hV7Nr(ISI)y|GB@NBMz`)FZ$G8nC1B0*5 zAHH@HKHRDU;r-;0hc{R3I}35AMc``c3TX9xpLN%30~M0c3rzP|B~fJ0;3d7V`+IwP zb(Z3Upx@u_JIhK-Eda#<9f$_OB~fhh#2#-askcEm_41U%d>;k=9(>n-dZUs zrKIewS|PdVQRrF29V5D!Q-6Ovi85u6?j&K^?0i3echqb(t&PZxKl_0QXU6lyF*8== z^SWnVJu?3Q@AvqaeCh4pFCNOAEjVUdqN`(K@z7B`wKHZ}6mIl#AebFZ!o%hFp4;wy ze;T{aKI1ocq3<6P6EW82!cFd=4Nh{!svr2MKvcoM-DnT*(=cy}p?lhTzW%)6d_WqdN z+1EQ@uGi88_A|4w`MIXlnC<^!m|L+&T}7qs7CPf*MAqDQF6h8|y&XEnOGHE@++cro zg}hj2pFK}WxEy3SN%Q_N5Zlv_PRhwm=d_Wm@Auf34D2A~3Q+UAC+?PdLp@6di^}oEO%F^fw*Ak!i<_Ip=#fB$(9H^sBTWSctJu!Hh}! zx{p&(E1hu0ZS?SNMM2>4ASs7m5RIVSCgxUM-xmkJiIm(n zf5_qw?tC!}beVQ14F%lT$5--odUC?7@!? zdGNk(j|UsCY|`E@1u5+qikG+Qq$UW+$jH7T&dLd&r9OY2DOxtk;+LwmQ22WQh2kUN zFxmNb&CN*miWW}R>KHsKVF4y^o-UC3Vo!&@>?(--AG2k|`uzt;!c~!W?AJl=_g9*L z%e`{6WVi z5Y;XXq%Mw15#8(*P2980#Cp#AiE(WQq#3K?_zdsa8x65G`Kb8F>?TMuZD9+oOgoz# znBS)piw-zQIWD9pKhyedWAY|d-11xXEbAd+@nKOn^(#Poudo_#yTnY<^ryYP08wTI zfe&Y|_?;9Zr2GO(8mc&+Mnax_`9?~n`(;6YZCFm zp7z--q}BBFV_v$t@wzuR+wDIZsW?m1euUXmHT7F_b|Ryglw)8D`OY-y@F zxxFMLOBK$U(&r0?H>ytc#OPe}X5qN(>51Bo&D1F{OB6BrsC(^*i5=EOHhQ!5%oB4= zc=&9+WLBrOywtBMYc^l5&I#GmlVtfjQC(%2FW-K>*Ax8NvZGHhMPKIQSgx7ltP z6&X1pKs65BwOR)74r0OvbJ#tyYedgg!&-ua`WdQ0{K z#!6ezjh4{Zc<^!uV*Xtbqg(hx!fBg7T(xyUga~*NN2s%EMUeig-WdFS<*Vb&eTD;q zoZB6*iT@Ypq62}yE~{M*Xccvg^OhfU1~u}@wv*zIbzN&c4pbrDb)K#^gOt~ ztLWfzS=9Wgr9Va+ho79%)lgpOY>4m^iQ{tDP{U<%W53B$e}?lNw}r>alij*j@w$qb zs-8~&GOs7%m>f>lrIwIX-9kUwJ+B$)wLDh2{wy=^AX$IC<#jvAdiLCK2-is6&f-s28ctPL@tE<-^w$PoE+q4!{a=@99Th`5G#%3 zvJJ0ju~hnWx}Z;$LHk=42QT^C+wa}mV@^eH$g(P}BpD&0 zPhUD*Wu%SW{#D-j#>i(zb4)W^T@lkTteY?QxYk%*zV`jM-Ub`O4k;3OO~ClfC@|-6E71gf zgG|{s_~%aiWl3YL{Q3RbUqb)=qyEXB*0zjP61uWzl<0N7wi6a}yQv;)>-p!gO!lId zKX!*fA@D}|>)1H9tG*5quWbbdSkCGmL`WNc6t9CZnY?G6bPdi9wicM7;#4Y$xHuhU zEne@5BYBV34H8_VHU6my&C|X+!(zxQA!7vYSs8LtX^kGLv*Xdn3myZREo}z#DjO9m zOY!-Nx=QaToBiTKA|g9I<#lm>pI*MX-i}_Icz|5vey0w2+`8VPs?LF;QKQF#y!KPS z+3G4|UAugwBMTAs`jNgXE~G3H49J+oe=@Zq{76q%R!T>oE9dJAq@3fCyo!@KKB6C{ zH)x%klT`|d{vD;vR6e-+s-h+YWXVZ!zlN?4b0s_?+{}P317oTQ<+kKPij#I$f*i#F zTRM175SWsLQIOp&Kyca!B}>{!9~_2Gs&w2H?0tVG^!+n!4gKy;ZgVpM+PNPI7!nsa zTWC|7YOa26iHT5573za2zc@|Ka3nkPd`LBbALA;?)qs3*w``bX)_^otk@(esC zUXc5B{=wtODo4Qk{#w{`OlBP$t6ZzgoY@`p^WpyHDh_TTr(^e!F}yBE$l^rCr?XA| z58k^wHnz5mu=eZyVxg2o0zA?({`#U#_6Ef{CEPnlW9FuEp*tYq?j96ITi^DKJaiHQ zR;|XG8v@Pv!d#)@qTLUoXry9*87KIvECCyPOTf-#Ah7xV%#@#Q+*{LwgBybn9-UM$ z)raF?3b{IaZ=K2en&{`Nqoab8ePPxZm)}Y6+{%4d4{T*gU$$vkWkrPozdsd&kAll; zpf`GUNQi{W{FeZKdlMU3lifLb&D&el`)fUw#6;1)Uh@tAlfQLQ<%7`bQ?tS!`X2Cs z8iy*MBhu1ZN=vP9;MjJeB%ir1c#`~%^qz& z_ShKxoHo1bq_odAjaojAXdjDy6b{+RC6sa;1W%+NA6BWOKiqeQLutseVn-}P0$&hL zl%F|#A*-}|{qK79jBdOIDpB}u!n&^Uygin*gZcHWS93mf>QDHw9Nm-Jb(C{tb-;A1 z=pV;M4wnXiHx&e5g(s(74o#Zw??e`=HdbrXRDhC2x^5-*ANnK{FJo=^99n>*17AI~0j8WdD)rx5Zz4vMq?XX`=&W>&L-i_zE5WwfegHS!2y*b@;- zB}dkO8=DLO`CfD=o9lRREYg@}UcVrDk8N~q;ugFbm5 zV*b5IyvIfl=q8)56Jk#{#U`c^qX9!5y{IP@)`Ow^So9M2gXEyOXk9O|YFrpDOJGQyb$$k6?Ho2$XK-+%&D*Vr!UPPHlK|v>H z^I+j1%IfAhZ*Kv}bG5mZ`ua`w0_^O~J60~Grckr=|1Z|wGAxdzYa7K~5?q2M1b26W z6Ep;OcX#&y!7aGEyZaE_-QC^YPqX*)e&_w{{5sb)KW4h8tE#J(RIR$#UGl%cOGQ8X z?{QubsyHIZXbRtQVvjru!?OEWuQZEj`y+tBPBj|R(_k)AFOo_+54`p8#wr3Q8^KnS zIpU7(%a^xmT}Gx=m%)H6?kw<32nL_04whSzco;-rf1c&v{dqYFbU@|)w+kg1u$Au1 z96(+{;p#`I^T9%X*LN8hgKTVVg_tq_3+#96q22%nwKnV;!G=c;@ql(7r}rHJ@vj1( z2Xtl8+tGzACT3_Cnp?PCW>>c5Rkh369631wa}#%WcSlu5`LFx;wxqf0Hjpkez2l2q zyFn3l)z(DIEx2Km&R?ZO@a>~qIaG*{mvq?77mk$2Iu+GahZKT^o$XFLtE-!{^NX{~ z0$v>RZYj6KTsWkl5sk#h7qzq$`E7@7vMO1hMxRho>5}t1`sS*>Kch=P_v9h_?Z(g6 z8;>DoL(Hk((xy-csMbHP2vWR@lYNU?Fkj@PIu-R2YVA zmRy)~zr2#)BpCJCE}z}=$#uZKNC=sM5pgBqRdWBr`d|p`Q+v)@tP;fbd+1^&WRnkb z$ELI@DaW^yr1O1y=9O)WoCZ^Z1#-=8McQ5G8Dn12UK6W(S zS%c_$^MQF!#6FUYvGZ0#%AWaZuK(9B{0mYy0RRGUnT<`#40$%_n#OhLcqqOYo!p7M zo`$b%J>Tk&g&`^uou6$r0}hPh*1=RkWvO|weolgk{qpBvu=XxQ&8Uk}{D7jI9&nyw z22+Xy`LcDG^SUs5Rp-+wzrTePlM2&iTt48-OT&?AeTX{ak{Q95kn>dMmnqX5q;A23 zR^^$z#mLKGx2hW-Y|lw)DZ)ZNOH-~KE{fQQw0R=K*i=++j@toUGZON&E|`oBV)IQH zn)2EZrT=)MV0lmMGxzjlVbIQ)BT4afl2lHjLE=F8KnLuOseM43iG0Cb1`ZaZ%4?;TUOXC5su>k!#>5gOTA^BW(0 z5RD=0Uq|z~aY5rk3h_UaWk0#(xBwY~rPs)#V%DL;2gSEoU;I`4na7@Jt)_qujGToX z7F+N@$m??zp$LeG|64;lhkv88e9>!n+@5@R`qc11Cu5W744T#YG*g3)wGSPGYT;1s zm#b}ZW(LOYljGO?42AeZE{Y;gJh$(`5d%;KLXL zF95fpds*QC`Tksmp{93C#WNC8-(%L)ok|ZG)7r)=Wtvk7955tQ0ONv1hJNi0BBIvn zNILq1QuDp7~VL7VAQging|=?>%ERNjPJjF)g1~c|n zn@Pbi4d{fpkck(sec*Ljo!4?Z2AP z!fl$ulxgCIjXhQ_B**5Ir6!jv>j`$gNePg!s6k>x^Oatn=SpkH_=yFNj2i+=FKZp0 z0IJCS973^pclh_Oedx3d&ZPH&ad~uJbcekev3#glnX>suB6Nt4oKWhzg$dhw zkbNi-b4;LNtsp<#*!?I0Ko@xt2Ajvc%WTsn3IJXyGRdg3)n>=^#&5;q+HbO~)@6f= zauG;eMqUp;x<7l-1Cy`#`K~C3X3&7xo2`bySzV)Ps+)F)s+1$hqUHc#BLEJU;|^ZR z${RLAaYQTv;qpiEgEQ^9jWW0hQAdwuCa+Ld362)|3Zl-blR&PjEHL%pwX?U!9$xRG zEs>n+yU0!`y#Fh%wOnmRp~pv=#aH+lK%x*V@rFQEMhMT_gl7JdUs%rWY!$E0_Gm2e zX~qUEf4;c>fV6%(uAphRx9g~<{3lL(%mCtGV@g@N>}0{2s2&b)6=Rnu9Dx+s2cX8# zTW-3D!EO+iJl1!y9ikes_(X5To$KU1yEX$hoBXl&<{Q41+~icsI|L`@S_iD;gCcBY zVOx*)&~8BkeZ0cVSn5&htRv@reZbdGl2Qvb^iBhi6&bvZe+fK1 zCY7E*YF$Yy_8EhZA~*~~#=|D8+Fohzxt?NtIuT3YKJ6$&-cbpWCmJZn!mla4-~oUp z7K1^mAUvHMyUI~%TaJXhYHDSiN5h`yk0WY~l`6slFr(mnCPCZT#5gUxw3qT ze_0DeAyDz9qpKx4?eAd3owomFxM_b2hsRkH zwz|{|+hWpoF|d_-rX@I%-XPF+1?wNgIP#gB3WSCB1^HW}=V}h!*f{5jM4M<=b`)wh z(u%{+jRC%#Ycdj;JiYf0958tz2C#SrJxs=LH>>1#(4WHf%1@V-XoftmKfm;DaWC9u zthA*j+TBhMpqsxWHDDpMM7SU(2XR3$TwT=WS6_W+bVrLJG|rn*P+X-h1z-D_z{;26 zuT+tk;l;v4%J$MZ^_+Bz*kjJnNN-P3VqTrG73H`GIC4E$cXzd{TOBax*xP!x%g9Dy zAb^paoRl{ILwiX@8}Y-Nm>(C^c}jw;@JZPWW*#=a< zCfDVD@CTdE?CjE}I!vuX}SGsiSnWs-s` zCb8CGVAFU3mkdDW2MgCvm33y^REoP-bKYNBrLm?oSp=rF6}GvyrYEf|LmP-d$+5o| zg16IQwQvmYCiMqm3JU;K{q^vg@qW0@fO+{L+xmH;34fR#A1vilsn@4#c@d$j68Al8 zt+wUy?C6Y8K|Yvs!v8fh?$zh;(2Sm*UiPa1H>S6!8vuE#7Uss>I@_&%hdY^}wZ5e< zf{6v$$QtME??CQO_5Avcc?-atBqnmGhu0R+QOXlz_v-{H2jLb(xiN#wIhR%ds1wG@ z&EDHeM>Pm6-Y+F3r7nhnoxK3SO>whXCYoE8V@R{lzW>CQ%}~>|%*Gg*B9a9jUd7t3 zsAp3OSgDJX>D7)A82?*UB??8ZBn6ETn{sgc`4!s6AZ}<_- zC5z9-wemZ@;56uvkdSx*)r`!nRh5+hjN*8qCJ2C5Ni$DwiR56YCM~EYU#6igo^&Ju zSDTik_e63OXlq!stXKo~wg;xX$N;!j$jWwCsA!QL`;rq6>6T;YVs$_DszKEFGx)qfenAG=<(Zl7*M_h8-y_!Dq5Z?a4%|Y(sv~}6IY8-ua2D)+-kC2EJx97dq`aC zz|Ov|_?^mY2&P`0|0-DB^4gG+oAv-;wfS3rtHb?8D=v4lmEe2Bxbqt=jQv0cZa& zm8Blu(NTgLjzDspg1S04O;(G~~0bs9{ zBd};e7bE_1o6L|xAz9a-)L+WE^y^2%(^4dvQO=7E4&>&QCXE5tuJjv7yP5d#`~hw~ z07WtroR-?Bs)~^lPv@aL_ZM~uF`LiQk{TwG&UhFl46u<=rl;emMS(U0mv|xw2@Q!; zJN$QFa{|9!UDn<+*u(&0e#F2oR=l>?<8y^XgdLq><;tU~)S_M)IVDbcRxq zq_-6ZCZx}La>uOR_hZT-FUgfdh%pcj2GPFtPpm(E&=(>TP*q_hI?pa2b$NYmYLtY* z7t&;VKJI33EB*C1-cKVN^xW$x50EvhNw9-J5Fn)O{m)1D*fekv>DHcGLqpN!2@${HWDV;ZBB z1izhS2sQu}ur&s$97vcYBx#xJW8yF@ei#a_TsGy1U-F?w>-Fu`*R2q|hG-HsxoN0BSe4e zR?}glqod=wGBGePXw(?hCAsd6Re5-Lm=tUt54IVR3BV1^&i?&n(mY|XHbXcijiee$ z1El^TRRpXb)jAXfRDBv@A741#In>buT}hfn7lC)<9I#QEMFs_AeR5U9gKjQ!n4H>t z_*y5J01q>HQimQy!m(o>8cs6yMbVs$nY|%*DP~XBpN4!u?sqsL4Wx8kM7dUzrZ-eW zNQq9#_m;4vK7E^?J|1)w?kQGfadaPpGz^Dp8X3&d#wd$emNjK$dd@~FS~ zIiI2~?4CC5^uH!9m)88KGvAAt#UfK;w>)2I)g{2;!*}`{gAMZa^<}wq3-k2_2h0)| z4th_^fuWG|Kgc|$jNFykRW176)iV6hk?=p+oNmM1-*cA^2PKr{d7bV3(}xU0$}@|C z9hSx^=5@F_=L8$}7IpIF)#as|0}y>JAHM*gwLjSjoDKMRcMK%+Tq|5gJmeB4J&u{!E%1WymK=m{j^%~HfldJCgW1rLX9_H%1gq)fJ$3cC0mTu5RBiL22gq+_MME%m# z>|z0JU!Gbxw|-eqF9SUp=5$=1{6SWx!lN-*g-BE+8Xg!`rZSMN^kL^6_k)M@|AKme zK+bO%|Nqa6KtAp@c%sioD1i^Ts353+@^d}G$aH|;PzR6<;9mf^kT{VKJWxE8z$2Ix z09XW)$zgRMM1kK?d|>Dd@3^A>UyAU4uj2poImiGgKT!#J60zRzjzG)oU!z-Blh8KR z+mZ05BqvWY!E$qR7hYamWEp;qPE0Heu~O^<62f&sa&mIDG{`QT!(M-2EJ=0&vZ$1A z#F>}`9*+kFwU0socF8mp#YCj9v=eILGRVNdpucD*3k8-0@%RvcHdd2B95brTd6QK9 z!O9iDtHk!s6}NyA_yfslje^7A6VF*lx1G5JEMcm1%TYwbaKOEw$F@R*>@ZXBOjS>O zCm;aOdXapAApXM>0-pG(!FK>`m}RJ_h)FByZ$PQ~^r0M+iy(~Vahn)QeD8eGRP_e5 ztHVC&XZFJeeKTP-fM99n7S7KBh0}WSZ%`$P^3R`w7Jl25E&yv+txVYS6$hB*`X_L9 z-CW+A5Z@XGm&TMRNAs^*ar|~M;wk{r{x^|Q&}Zvy@0TO(@61@MO21>VxT1!IVw|&U z1z{Md7G;o@(phdgEdvzEFM ztt(iU<+l)v;p%T6Ca}C8LILck3mQ85cMSCY4e}dPWDS8BOmNks>Xv}|qi@CN0xV%N zW1g*7Oq{58W5qvy{V0HDBsC)5Hc^GhUyBGw!~YwJ@%`R*?6TTQtLLbVh|{&7=EzEv z30x?Bt6WCMZJWbY1cI}o>dT)+Q7nTqTWx}<%lPzCelp^d_ic?Wo;m5l9C7vf8K zWry@KDICSu6Zl`#t^I`u4xpdiqZCj~K5k5%JpeZ_rPz-;>kpL4@WTNfc=QNBgnEv_J2c z1?A`G>jVV`#$=PWLh-nq>rli@i-^$#E+fXUfz2;}22Zw4BSnO;St3bVZH!WY#m@uS zW?)a%BfEtVnTS)Ao>_!NWirb7V$@`Ei*IY?vOSX$~1`QtI{Iy%GMq3$?^wa}ag)`EzSFsm%nK@{$d2r@Jp$MZX9W z17?$f@CV1BU%s1re0GPrM4jI)rzm60Z7X(kiwX+Fp20Y4hPW(0rtlqfE%pzTp6kZ~YQ8t?~v5 z`!D`cJdQrxrfTuNrRlB>>D6R@OEAO>RZ~Vk4>rh1H_9mBE5IxI|6W~%&}`#{I-mOo zJ*|ti77vqD)oq)Q$Use4^iK@8Z5ezdI)8>t%f-E=p?T1X{@kwyZT0y(Ci_Z^biW&t zI3fZ3Hzkz7Sk~!k)MoID#m|io`G%%ZY^_gf)qRZ#a6Fkxvu%xy{9ZxZx0;vBP~(0` z{fYslVHB_fqrpLU?Kz~mN!t^jo7};fzJwrE$f5|wpn<8RHIouY!gBH6_6t+QsAf?t zq{Tfy;ma@d9C{qu#tZ1jMxv z+ek#zeUr^vY0R(IZ*)J;y2LSQ`@wp@C4Ywoj1aqD>BpG1Zhv;{?bFzx)Fn5UwpyAL zK2A9J?a`lTYP5kG-)%OKUKR1AT z@1L}9tEOV_kL9v={@>isxHbCuVx4)%51+A~aR>mo3R-)6=~?45yncHLb(_Yr3w)3| zdARF%d!erjil~FEwtjo+cuPsYW{rAH_34P!Id}Gdy@>SoxP8EWd)_N}d)|)qetF`z zS9aUe5P$9?e|vs?I^%!Xjs+luHyLjpFqV7|Pj7SLpMX9C`Iea$7WvT%l%Q?7)UJO` zB-DY=VzLghhCzOGS_f6YBI8}}opp3IYkQ8&1KR%#FkQUezp(G?=AZb1L&6Me*Sdg| zwPRoTpT;@_{p(SGA$we%pz^;w(>`EpNVxXL_}_l%UmsP#hD6Q?bi7=^ek!q1 z5t6mR5Q5Ci(KkDu*r$XEwOxKTg$$~N$!V@AfjPl$uc}FB_)+m zp|Y{x_*usp^oNoRu%qj#dKR@S-pm-FQ*{~|n)Q9Ovz|Lpo{+gY01JT~NYbvkZ$vvk z(B@qrnX)twBR&EJJ}a{#VH{|tK91DZ1a86d(G&0F~H2hPmWNGZr9!(KA#MmcFYWQ=I021z|1taYVizRTh-)) zMa%Xk@< ze?uqyXnQa`HPT~#qBSYj_2o^U-|_x=%}xISM>d4F2lIwG9YSl z4ABMu4ddZY8&1^AJf0q1g8u$amNF7Dmuu}WV;^($_4K@-H=fSh+;7OkBIeP(82HG@ zn2rlR${!~*TP{}WKD4SXLHZ>uj_Gi{7;YcPlaJhpGAkdTeS5^?Hv8pUG@>S3k$Li( z;=z-xr%$_Ac7Ny1m!WT2Ij;9}f3=Nq!X5U7?cpwq|5xBiT@n*6K)F7^^Pn)SU44t=t;e#AX8yV|dFIZxCP#%*H)Qikln zeYUr=t1e4wpN{i>z7XrTjPk!h9*L3tgs|9jqcB(`KQLf4mB8WZrn+xhkeANH$m$Q{ z8Jd^(wdvD_AliABP*69y1@hLG1c?9b(HK;&sg3%qHcjWC-ext)!O<^{MUfk9bG4z0K>x$C# ze!WHS1A?7RaL|zZ9ASyn@+wSN%N-%s>I+|x@X%4eS)pLjXjOvNnM4%bXXB6au5!1Wy#gDDGwt-TZ8igr4&0N=gp=`W45)`2v)J*a5Sm#bR^e zg7(Eha}u8YPd}O!DTzd>(a4=<2i~cE(Um%$dB}KG$i3q4GxG&-e_b}q(|ly}j>kvy zNhw>Ml{@$RE}<~`_Itg(TUyBW-L`SuSY-vkR7i| zBVTW(AID^01K?Foe4vgo*ve(Mv3OU36BiHy1hW)q0sJ*G>qw%{45Ac>0s|qhlFZ?E z74IfLN3g4xib8WMI$3j{=~XHM0(vFa=cIR_wqaX8WwFZ^8rvYrdBYA#4mJ#uBi#K6 zwO9PssdlHzCl(J~F#Xb{4hy;U3V?NW$UE%-hwJe?ju%y8ZTOOC8-ooCj|P!&_rv*7 z$cOycuL57NU|-vrG(uZQ2B2CW&xfa}3ANz206>j%FhL8I8wbu_h7mpd+bXxNpLy#+ z@_n>v17vDWAh%e!&u!M8=hYe?M|u;}PGE=ovdX!TIEbnwTdb)k;#Oju(}A4t?Ib6+ zq=a{~SK#DvtENp)^c!U5n86usVX0jRVGjYAEQ3#AezV_X0Y2*C?}kFiBSEmzu;(q+ zoh9>tJA%LMkvw z5rOZ_v0*252(jQ)L&ba8RRpwO;{5jobrGwhCCz5%epH?t5E2N^d&i5ofR?~rOzc$(50jdQ zy=ik@@F3|SydzXiZZt35zQL6a4Nu!UQ6~y(p;kcLIZK=C*KIE#J94g^K26b5wP~)Y zc)g8mZ8^&;ckjam2sS|4d!U95(+_)`bC7Y2bg?=)%wB~uJA10BzicbYxhd+OOqvk% zcl(OnL@aY^XxQO0NlbQ4g$lKoTNiuEt7AshGTc9_MS6Ddy4tqppE~NAzUIUzQ|FM# zb`U|zeo*Min=XWb?#+rrTD@P*MCB3UQaZ^`$UmfTF=AaYAY-{UfiD*sZB`d<=j*%_aUlvU);%0 z>^h^B_Oh1NFz#rT$WG#tC;{tOLhXY$Ez4&^Tce1#xTO>-e6x6why~{fXUl8)iqHyI z@zSBVF}bJTq(_NIi~O;;K*u^yDay*fRY2ucpBmUtVq*6bt4#_Dvn z*v#8=jx->z2z$0Stkv4g+X;vhFg;_8HKck;F$;I;NU`cl=0xu|CU0p-5 z_2JxL-?-F6#dp_GBIjssfZA3kQl-ZGvKYthBPx5*>eCHim;{&;5J1M{p7Z_VX%Y79MV>(iOK760xo0%)-V?!lBD%?lSyQY zx|KD^Yt?Fh4HwBltHLxkwn;8PK01-ZyV?D~?e@nwwSM|YA80vTJ8YO>){hr0z?ycVu#Dc>tY63+Ulw- zpscL>yv9{O z-4b0FLP?Ai-9}OI1S#ix*~mz)ipr091#Mggp?`MX)201R;5y3RZjsOuN3aSc%%c(KhjE-x&Uz3+r8JswIBrbWT=rcAuoc}AKGG%0>B95!J(b6v^XDenV6!}s&0^&S-U64 zHknj)g~QTsMUtc9md{XOOkz1YE<@3LfGcb$r!!kp+vQnONO8OAOdjd1uQ3`+KDs~b zRBTzOImACIkV!evF}Jwn-yVxvkE7d3~>R@oOF)z=tEye$vxV4Qd{C$7=2`j|LVP1{; zFF^`2D9d835VG(&OqN-8R@RrxB_i4MHVTgT()c{$%6Cm{ptSfbX!rsQM?${?2V@^UPMfJ#yk zh?GSVpiAheJXGa00V=>W;K-pCR6@CmL?GZP1xogv78~EejH}4tUv0GAitc9KR39!j zMz#0w^t2~zD=jQ^iAsYG#!X%sZvCMt4?ERinTDa=#RUGd24Q$f%ETEGGPIT(b3WJLxiZx@5vqy zmtRxSij;9HiwMvv{dfT${txJtMw!7xf8FHoo3lPzbv}4uAO!r3Cq5CF{3%Q-Q0@0T zVm@x^m}6X&0fG>~B-5!AVghG}OWvcu^DS-@Xh9@ebG^MMSzgCdWTR6%jP=@#dOQ8? zu8RHq?0kZ_==JzFJW#Z=e=X3!F!f?-^KSp)XbV1C4mNh3!PF8H<;l|}MI57v{%@DN zr>0`lmBikzk-(4XS7VVK+leZnpvWe#3q2v}rl~>2nL1=?#~sG+bEBVD8}wGgj$5B+ zPOa{=G0u?Txl(MKvX$0%>Zv+%_2!J$a_w!dG(8XZi}Zu;D%5rsmnSz*t1qQh9lv!4 z=U%bP5b~?tJ|>MVvO1?@lwCQEdEP#XYy5gSKA@%j+bzUst<76*Y9Ybv{4jb`QWNhw zmTbCLH;ZjGtG(Q!G0}aD@P(Q?I`jGP<#{*oaO9&{MgDO`VVSd?+5*6^`sq_6Kci*+ zLhjSU8INXK=wPv+pR*VNk6||R>BSJc1yL- zh>lQ8H)xc`_OdR6Z|3jvrpf)RQ*{4eZ?EA^;9|1c9yD8$DLKCI=e;^#<^okZXFp-; zT80dmw6SzP^LGEMrkrTyu}|7ZTb{%RcKaKDP6!d9Pd<0SbAcZ%pJ{(rZJK0!I!Fmz zq#81HVvCQ*?bEMVY2u&qns{8Xz1pRxZuEY*X$ffxO})+FvS#gCwTiaa)bxKrYWaG# z8^<^1rKHlTb8#8pG0S@kwbg~W0^4d}t;HC9=Lvi`aLzTJc)@r)?hI%eGR`5mQ?iUyV@8|v( zsx-pk6|T94pYgD`nBSvtvLg4`6IcuVkoZWZ<0y>21}O?yCxwJx@G1n+$v&n8K!7jX z_fLZI`RL)hpZ#a^=mqKBc$7kEC@2WynIJSZH37i!aI@YVvB>0<6jN~EEJMTEhK8vc z5;7fW0VZ%|B_)By%o(P}cns>-p)}M=)(nZTxk!8A?D}WtnOryv?Y(x;DoRAeqtYQs z>cDWm60Bm+SOTp&q4%ZW?nBM=S2SMwqO5q0bbfCwdS8Ir!|ApZxBj-QY`FgD@K9&r zhxQl^KAw*1{kfV*O(8&FnN?-maFz^xTaW1|jeO&HVp(>)fh3|*-_Xz*b3Hx}x+bQZ z6+|W6zU)_XjXin3f6Fe$MvpcoU;n}W|JnFw_ zbs2*{M>7~$3(EQTJ7tx;dtUra<*l`}QP1YF>e^1m)Yb23gq_+87tj{&a~NKhBC&R~3YcJSqhC9~-J zx3WYu>|(!L<$G zI3_O$@51^SUd4U8qB7N#!)hS=!8ba{8`wTnS4~1xYD9T-&2348e(={RSjbOlOYpzw z$ar27)P6G69pG4@^lyK>6g|w^zDBfPc1C&Fy~?YP_wtR-c)l8nx*1BK)jV#bLt3P- zope_1dghFM$en2Ug5q&Aa@Q4v=8{xX`>3HOh|Ao`wyrE#z*&J`7sw0)nyt|*^VAo!eHq`$PT1b z7>s-CY6cq8+gG;ElCP?tcl=9LQDk~W^Lr{Td&3A)60{*oG{&To7<2_yJoK!T9(l;E z6GZH#XpHOU;*P^)n&Oks@1;koA8H&OkVCb3(>dhGZ+@aM6GI))#lX-15QB~HyR)=U z9C`lwcxbQx|6KTy(fcSS`-1D_)D55h8Zxb+uH#GJ_w_cdByZ1$QJVJEEwAtAdcMPb|; zGMK#=yy>s5A5vuXoUJL!Oyaybgu2g5GKENA^ldS_xr492{05O4Fp;tb@ zR*HA@OZvuACffVF_(!4F7vNNw8&>I7bZ)>wL7_7oZULTZx{p{2ga`Tl<%<-kFj4?0 z9p?RuSfY;{kv~v3QlgK$G;kngbvh|lJTEB%XHDXq4|Sx=$#H_I#a7yPr&gFkD>!tU z3it@8vzJ&xEUkQUylC~+6h=OFe-Wvr zP4e_0AdqkT{3}GqT^n1r&sL@v39XA9v46|bf_ok`Q+NegL$AVK@)7o@mtC>^^)JE3V&%ZB6O?LD>Tdb9>0$D=j-}R9>&0T5a70Q(R1VgPz)t7^iN8F_z1MfV~yu1(M2U{ z>i3<`icpGFquHpcCjFquMbCWyXBG<(djQ038!+MVSZ;@N6b#@wKk(@PuM#Oo6bbx; z4@MUVUcY}K)P)fBMEbYAqMkf|p~4<!(Y4!VPi$pig@m@3U(F?L&l_=o1|Y{;$`&-`RqV)W#SW zRGvTH5u}BZLj~sFx3@}w>0VqhRM` zh90%D!w~m+-s)#r5!N$?lCbePjYmron2(axOtYG9mkA!f5FI(4et}8A$0c7XqHOlM z`KhRhPTSw(_#$KG*`M-Ees`5V;Rms;A$5pDG3owp#JQwFSH_9*lB9M^A5<=wo(6$% zc_>97wl833l-rf!Kn6cW)StMd(EK14`KXX_dt5MYxc!*7Y(kvd#^{uzq-B7m zWxb4ffb@*5@mVBp?=wf|^$z~)^8qY_2P7)!Qtjt-UJHG~2#X1Ydz{@>Ufd~#4MYvW z9JJ1)&wy~8b z2^m3Op&kTc`2)kh^M8^`UTbp`U7LRF4Aqm9th>9NuYK{wWM!4%BWajK*~V6eBI2FW zkhj@;XvqkQD6}+5X3`%hYSg4HvlQ~iB{QQ4mTZFOb)jqcq6sb(h-7VPT3LIST+E)| zUUksGFE*FJ)A+i7^V2+M54yq_H!>)Je|wL=f(UV@U%oxiA6|ud{~4vR&Nl3}J6LV_ z>MN=$t8ugP zoTxFP+4!LY5#8qOeV9OZfUYAH zIfLLP#{egT3s@ySs&^v*`9J(EnGQhU4n#=+0N_L64+d}|ncvAy2>SC z+@yrWot~jhr59u=kfxx!XyfX#XSKsE)m4G&Z#=*E-r&|DG+)su%HtvAJ3e3@2J!^V zC_|k#nwEy=$kTY-O>^ENDu1EBn)70f)zDJ9RQEVbD=wsfqRtnMRJBp_I&~mU(YA~O zfn?R#uTmg0L^7QbFrcTw?xv;>xgv@9^RXuN8Ni+4fyoELf9{JgAA5hS zy5Hy>Xe#Mjy~BB(yh^B2uQ;-7VlaFXNm)tIyfr3jlKY|b^t$B6_(X*byaNP!W#B*U zhAQP+R7)nFTfO^qVdGy;^G=`5a9;1YZm7yMpS)qqAU5u&ZBp^+f2zB3l9I2Ddd{4M zeq!)v0em8LjwQDLWXAXi@k;g>x=rs5b}LJ79KfBuD8mcLM%KS$NgcXWVI{l9Z3!Ip zygc7jv|;ZOtQ4OJ)v7)LH9XkQ|AqOCc7#cS{U32%6Qf-sC?UpnKFXdG;So zNAE18JAC-9*DnFOv(~o445ri2^>UES1BBM?-CuQz#rSLqHV`1MDahaK{#?9JpJUek zqxjWmHI2ba znYIK7YlzbWGahD;*tlk1S=kA|FRCLInm9Pr7*h>k@oTz55*(V)$k(}BX{Z%Nmp54Egl2E|%0SK~@qFF&%@vEMWXrF9GKnCw#kWuTn)5|ChSSj1qMSgFOi=CPn1 z9p{5zEHPWAPHs^kGUE&12zcRBw13TmreW{uLF;yLrcw6-{}t;t`T7kLdga8ZI`qL~ zg}m5Rb*Tp?DY7BIe4zMeR&e&&IRq$aXKMy+zcMpGK2ZM^VZgF9N;+(ouGlKpnFN=(D)nbC%TQgz2;A@tBaB=<#P1MLlD$5@4up! z3{Ixg)0E`xpYWrF{LUq)kH9;NG|311gj3sTS6NHuBwLg%UL(_Aluy_U0;c{E_V1*% z`UlGTxi;!@tCh`xXTtNWY4z@fd?Y#p-o3A=<;36(KoBb56FE%S3qq#j@)vNZ;3axx zi#LL00Zdd*o^|Ix22&{&8g_3qyrw2{=WW26z56u)jU62Sc({n?DMgs=Bz`n3|KB>j zT;4`+hHw+;G@FxNd|Z-ye89=+Hs!EfV3&E%Q5q%xqhF&^HJJdR`|n-Z$V7g}GmoRf zfT?UHnh=Lu1l4xKtx4XJctVZV_4U*y_?nX~?(Z{BRrY5V4aD&C275QKMQj1Bq>GT4 zsgFr0cn=?Nok6tBMhi`)b}~&aL0k$jWb3EE5dK$P;_m7#WrlDmKA70Khpuey*z*iU zZWpa^L zq$WTm;0qm88`m0pw3KvyC++gYm_*$K6bP7Hnoq^kG1(mr9{pBbfd zHG69d*_+FFIocdg*qc%YeuoBGCO z9bNd9`2>l>|E`y_xf~^gbNg^}a+2(;qy9hcj(XH#YNZuv5q+c~w9SNd6X2oW4=Yld zSU~O2sWztKSa`tJUsxKuQr~iWo5iebu!=;uT*Gm_zixGvv|b+M!^4FbE!mUNY)QZ- z^xpn9=-5H~x^C;F^N8!G_fIZ1x+whfF<#e84ce^^BGJf0r;Z!fV z7`Gbje5AD0+&Cg_v{8C!ve4RuuBEzd-YTfBpy~S!4grD%x8MYKCs?rH?(XjH?jGFT-CcsaySuyVw|JiST%4Oz^F!?-wZA-MqPGDdv7b51oELV?20Gs@$N&qpmOBIfx^Lky@gOQD zcGA1#=6q6v#TegAHwXP`>XW=t3!7Dpjc|v>@-^b$!rMjd3O%D;*@xA&FGT@!lU(d?4<&Df> z#$EMcYP{T2W~>`fXZ;f-j&^_&9~^Vzr#AV2e^%kNFz{x&#Md^X^Pz3dShFR*glWX) zDJ0ItL;-N;diU@duCP-D1d;<5mcqoC)W(WAOKcZa`zG%2hLxy$mapu6D1E#RX zMX~~JUoh6<4(Cp^iw=T|M@bYNFQ(!d4H(sYUVpkG;NfStC+C-!Z=xO+=H~YH_iF|$ zm3ShUy@Y<>@*8O;oXI!NOCB9J%Aln^hlC@>1eBm$!X1F!a7Brr%JTuonz8ykRNH5i z6$PAUK`g+71P4Sy7C!MNrO`JOBEm@?(*+JX$vh2ihr5obm1hOZ(&Mn3Bw8lq5J~(n zPMh;%hJ(4V1ZNtxmhW7ek>^siGrx1@Tc7p_)ZS!wk`cK*_RhEJu(g564IkdFvY!zF zwT~)_38w|Z2BRsxVijM-8V}oYya?5k7<|8di-{;fshSU`%gFqnwyBSJ_Nm2`+RX50 z!;@~(`25$p`uhx|925RC%7pb8SPd>vpD!DmwC`Hk4M)bjIj?%iZYwZ z{_)itCMkabxoT+}BO|l)(rYz!r^I+S=!+9(&DQP|Kr3>$Z zI@pjUSiS8NGl)02gDm-x<4JH=pp9>Wo&co}be`Xh3azteMPSGZTzXB|ff0mBJ>L&^ z6=iluRr1QvIokfwMDKUP);OCPfz16xR_4aYny>o`)mR)PUpO!=fw(lgc*iFb@on6U zILfnRw=9(Q=Fz?&DhM+5R@Vd6iJ`fRf>9~vm1g{{r)JfoMD^Q>f*Fr(6z9l;gJDz5 z8@|w(nunoE($QZ&KR2J6Ic&}e>W=LGJ3kd9j?PNa50djR-V-d#`$med^~)hj)$3Sk z+KbP5tg=+>IYH1nsq+((8s-yr2Bao^lYn|~rVdp+EEG5U9;%3Ps)~Hn^bV*b+1Wa6 z_}1uO0{~LjYY>l(jNDB(D{^B!6CRiIrl1Tab(o3q<0jZ^y@8dlK(d<|nom}Us_t^i zG0HtYTk>tU6qdZgg0$FZ>%zpt?>>ODFt7L?H4zj9zQF3W>8_+INgZ=|UmsR4A%1qw zOB#nXJX~4?f!hEbnJxmEOa3wRW@HtNLQdl%47_i?UhHnHyr+LTIvVlb3EK2z-3!Ud zOiXS&gqSXpxR7vd~+KNd0U_-8~hVx%7I1*zQXc6)?^C5oLEm1qv*VpEgU^21F%6tj*+RVkYLN%(v$L~UC&}Pr zX~3S|Mz|z2tsm)`+Qh=q}qUsod1sO^AztAI59`e%k**jkJ0`T>IIaZpfsz1g~~V8?BN z8txWI2g;>1wNg1c<+AN9igi0U5hPqOINyA@GD427|wqL+p=FBjl&4EFu(-AisD8}h%s_@8t~ z5gxGro{0RXn?F0_A9z}HbXH}hRk`8e(UC^mpnGq)@beKdC3kxB{Jtp(hU{_3Z;s#J z`T`)r#7QfwSY#;K#gp6A`lA-DG>lJ7Dms^!l|6P1OqwhU1m$x7W_}5ER5>+bnF4B> zc+}0QT9wZ2E?>(6S5T?m0tqDgXF*yT4+d29`(E+?l4ybKHk?Xq084GkM~A#NyXxBy3c!s1w6E#1~$Pe*)tz>uvQ=XEJF zR}V|MnsM34NPtI0K!4m9U=d?O82E4q}=KVicS zq(#MEgL%O##Ba^F=*+jYsV_EurN{Pi-g5`qTkhKr+wgp(sOQpLWfgBpzdsGiD8u2`lgPe+%A2Bqqk!9%&E_$y-ZRQF z>})h5ZiaT|{C5r!(#l!cqeTk^rAK=BE#ssbClq;yJ5ZQSIw%pkmEr?_bRz)8mL^Tr z+;GrrQh|>&a&h?80vopogB*x8V_lZGtD)Q6>!BH%8%=s^^HdYdUHJ>s2C0D>ZWQ-+ ztC)?*k*9aYh8{#)f5W)2^p!PtO}0zdXc{5WL#*6otR;_HF|JX96?t}!U&+2qH_Msc zT-bZ+kS=vdL$+uxPvCsyyda~ZGVs?5m_&crTbv}+DOyxwwt_UaIY&Zk!uD4>425Wq zILF?tC7<@6klZcQl8qQo$2~8+Za6K03t8B{E8DE-Ntv>W0-sOP^aby-)#(DraA|c_ zGuJW1g6-`~P7<$fsA)+UctxF2tjw=#8AwV>YHDtdL9#8b1fsImmdB_6Cc^HSMdlwx zKy4#&Ow>14FXB4#&eF74o8woiG%~M@E*f0%Gw{0}qk{EmtXr-*3*n->AvH(NZKYnoCEr8l?$;+FsB4~mj(w05&QD-Hf#4j z%4S1SB5b}{iDuSSQn~AP`jRZR@i6hG2dsHzzhK&(6O>!x6h^@x;;(e`uAPbtsQM)i zt9I;1p<-eZcg-d!Gv)nPwmM`rSTE-=cIs=&^bnyBx%Yl=$CHr=%eTBH`?-}=nWT7G zEuW_|lfei&K(*l!pm6s-F9aRS4}(t$OV7kKI%d$3=|Av(IH+RSPYf|$ z%@9YV2D?L6Iiihf#EDH_akD}L#3H&9jm=O0T@n9TGo6~`@Puq$8Ugkle{WUAxU6;6 zG?egK1HQ53Orri`|IqYowF!58v!~w{3dKXSHp8r=yLYh*H#XOztnwz=a^J!rFBm8W zq#ZwB@Kq^p$Wmx$Xrs20K6B7)-p(aS;@(L+VMWn++GjQ^KSmF{fKHDJU)g5M=c`3lcq+jI5^&CEJ0g8lE-ln7M9i;DrtQ&j14 z-XBk=ypwiRYk@xJbQy{ol;p3aE?9Nb1UKrahb^0!(lWBevD*4geW(6xAn`N$|z;Vy`g!<@i z<*wcd=`|{!IEZ%0QERUyEN@2?aI{h68@Eq2?X1k-2(2v7&r>0u)-uC4Bw?7AuM|6m zpjfA7QFQ&r4xRdD7x$)kp~VtcJdF*h!0X)&-QdCcd)hj<&)?Xsl*I($m6kR=#gINF z@m2rlnyq+Ws;%|TWxA`B`aA^lZ7iy6D<#`fUxoe*X6~3^mw#4wp+mdK0+sk zDh*Jz2B^WqwB`Vxnonb9OsgBJ#ht>?_gC>A&cowPZy<8YlYOa-*w z347J+Uhy>tbG@U9XF?=#p}6Yj@`6P*aI{gN=350~SIn84)uy>|y+9#dNnBfhD@1`Of(lLm zM9M5MRIuE!Uk>`M>z4pKLStI8cBraCM7h&06zw}$xG*|uLe~^5Q4lUDGgP9A-3ny| zP!ekLTlZUC1b4_hV+3z(*f$t zndt3HW7phgJQ0X!7vRp49MQ;T^9p$x+TFbo74~R6A8fX@T*JCpHp~ti>Hl{n^UmqF zt*g5n5FvFPrsm%>hV6kIH_rMM>td~Wt9F@_hT_%!8Nl?`DpsyZYrLA??2k=sv~k;? z-i8S;Sx+kg`Q-KGetv$WxGLEv14?8 zGFEakXkENSMatPBB?R6em zU{7oYi3`)@a6Wr9l0f77Rxxb$CS-+Ps6bOuxZ}&cwuaY1b-jd9WqTCM&S)g?Qf#Nh z1cL=2Qxd5(wyH)&7pL8?4?!-C)?Lm|YJcfiMbBKLLLgZA7`+9iS44{KuS`H-vw$E$ z1QI7FC$F_HDG*rKVxyxA2Mum@w*wwQ4VI&tZKDkYV12VO1s{`*pt>c6v{?CCxUBjO z0FW;qV>PI2%QqUdAG? z*5SHp^pI{4#+tnA>I;;G01(UET6EaIhvF(ASKgnmYLZ?({|6;(e>0M4R4TMYsbuN` zK_Hou?hXoA6~Dk>M7n2a$NrTxqkMVzLD=+Ft4iAk2&j%p(b3bB1FA?1FM+5BRysN| zElgz?=8-AL!IRb2fM6c_mhnBumGQcABs_B@xS~*ZPtH_-kwBw$qrxU?FOSq6p*bfB0IJ49@ zO#3)qay?`Ojni4R%d9_}64SQJY>j`57{fnR%WA7*vTsPv9LHC?6E2Adr6Oymq$w#b z&j&-rhv{0%pZO;BxYg8c6$06rPWSkh*L_h4=OxAP%Dr?LHKUu4@isL0*epkIEe2pAk05=yZ`^8g#6#ZD*3;w6_2q0Nu~en^#8?=H71?5cS8dU_2;MX z!JeL;2xA7v$0HM%aUx!F>O0@>D)mQsB_+SzdFtQR`bpPb0)Q38f#25L0F(sk>Zb-C zfLED31&XX`0}z(j`oGZr^h=1;UcqT48Cf}&3Q(AIc{-{IkS0W;nwoeP1csm75?`?L zmuMh)HCB##WaIswRdr$M*I%s>Kc)n~5(Ivl?Cfm)T&lX94}M)bA|k&85^V%9S^os> zop?lGTp=qV%770MHjk4SktlF|_|u_T$$^LXw6H}}s7m8e94k6>8Na>08uLN!3W|c> zh^X1u`P}@>V{#15Uzddi2c5?FG4@53OlbO_peHrLbW%7}G*!v-4`N4E1zz(`kqL@>C^12ye#qB=Sc_&m<_}vD3onPS*RWUttiV^ zk@YPk9%^y~REJW+P08;h}gC&Bl7C;X}b;@QyG0zl@o)l`T6swkD+b90HT$Iq1Cn79+8>G9Iijz zP7MnM)YApDJrHSK2!Tn?=BYwn1LLg@9yb6N%KJ?ORRe}#Z~(R!l@}IgF?wcZhR6as zR*JS6ADwWpQ#P;-)S}Bf6@kts2>+HSL4uh$kSx7<jqHvS^0IHmyxDWCIHMg}Pa| z^7V?+07bnEVQiOJ+h*fpCoDbq^T`Nqwu|wnXSA{)2$AF}VpCA_6ANEpG*?2r3T3Byt1vNssL6rJoq)c8oeJ zJv|cK;BX$Mk2;4y(hP&IF}XDkSY4M-+KY2z;i&@$wNqM$Nj8`!Hr^`u>E>pa*(fC_ z&_(Vm zIM|O**y}O-X`~_AnFqzkgsc+8!2U2K#q(vcO<43xB|L&9DCA&0i(3Gt=AEAd3HKLT zkhq+*-{j{z9%QmoE??NPLl>=GeRBw5lx-120?g%Yqj&WO+OYt54jsr%G!ETGHtR#j z*B_GqY50F96e_O2{=+q1<{v>tGAo;^WX>5 z1Wn-jF+?z?xfoOb{k4|fc5%jc)nUj1lGQq^s0E>vNaO+}hyj>%-`OAF(K?wSV!p({ zJ^2N2c@kR?`|$dzp2OqM=nd>J=%VoOO@nnQ0+j?Unl7=T3E{9IrTWExcuohV73^Jr zczet*AHk$E#1A1+3Eju)| zF^}K!Z+^yMH$s(FMI2#uvv=*xY0>6mU#X)VN^GP&oSbri&iIr>)NAv&dP$_KL#d zbS)i`5)-)b9*Yr0FN}8pjb}j10(m4b6pd*_L%)vz!>enl)yr7HfE#+SLHtd$g}0@+CU5G(UuX1FrYdg$g=pQ%_v7vZ?}_Gmw6vuRdgP2bs6LBZ&`+T(Bh z(_jzu;l%oAyQ?5GzTsE@ZhhijI$CE9zeZ{uw|uqak3A>R9t!!fV0T(ge9#2J)73ss zL?8~Ej(ejou)Ai-K8E=FpLZ^17VwyR)Zd$<(i~e|ng5KJ#462fM<$;_h#eyfyw**E znDoEHL%L{^9n^Mg|5|tAUl#i%yTji<^cGFVw;K1CTPRvitb~~Lk7W1i3^_Zd=s6+Y z_Pc)M?{8ITFN&wvoIPrOSgZaYwOIZY4(F?6rbT9YZ15dV7!X`Hi5dvP-_U>uq5 zOMO+M2x$QgfH>MTPH^RobB^{p2NQ{D2Ui3~9*tcJNRxn`B?)wPKJbY3UK%u7h`(d4 z%u7Jq%}`Sj!5(7FeMJRAU=*oE$wKW##w95Jbm?o^@J#(-ff}61s&RzoRRmyRyBQ$| ze*?-AN;siGYS3OD&tXmWS)PNgj?{J7Sgv1t7wH?5>fm4}jpk33OBvn@YI^#vWgNQT% ztTnmwInlxexUvC|LkiFko8oVnWEDXnMeae3Rp3H2zaV4mDzTYGtI>ONay4LLScm#2 zROw5Z=7lbT+m?W4!He$F5j(@I{t^W4CxOnXq-Wa1kSZ`?OT42y>^z!*#iE2mjeDb&- z{sn?JN&kR{);IctH}S#cPfC$PZ|>oGpq|7iDH&|N<6|0r_kY0hAL9=-p97T0|}GS}s+X`6q4qOyL& zM4zr4;Y0kdPL;D-7q&JlV#74Y8y*ZJSz8$S_TADQhR-k~`vFYQ~k^A8nP+-B)F zX-*e*_Z<%&*hBki(lL1=<1#XE-oC#2A%CR##L52vzlw%>C)uGf>hh8V@2350Q<7@5 zYm~6|=EG?7Jh@QT_=@Qi85HAWegWD}3ElnKNEYHU@n;#6M0TigYoCpyAj8x6d&7GZ{ zjg5^(L_{vL*z6Axfh+m?`W8(>gP>xdp`l@7!oU#e5}z?m-YwVmre3lEvcj3B{@BMF11WxO-(j#$>g`QJBAob~xGH1;_n`b$O`! z6fR2We!MQT%MZ?faGfVA>{#yLKgl30ML@?JaNKBKHdN_)Lo{R!0^ZG!-sE} zvWWFHF-SMh`=j2fme>1L<_AX7%CDwaCYNnz5I&!`pf?DA{~{_^0bXelEde}GYtODe zB0>tnUP*+)py)w)DJiK74>u!fWyjq~J|sSn;Cao~A-l%f=;*5GtRL0!MMYIrgLRmU zf;w(Z=8N?FJv}ozL*UPmLp4a`)1LOf>h>9c@c+Fz8&GRAP0W`{eX=EvhJfIbbisYfqeJ-8bjS{i!v4>5DU|^M98L5`Sw*KLFYlM0-T*F# z<6W2?g!2{neo8u%oX(G}CA)*TKBAHnPH8>)Lt$|6fciNl*f0q#>U!{R>LS{xp zaRhpYgkMZcHCcm1fWnehtX;;r)%EpvinSKl^T#ptU8=d%t{n2t`aV9O-;*?Aymt2Y zA=lV|QRi!lgB3>_Zgy_C*Z$)C;Nq#|B+MG-&^v}B`^!VAq>xmvnv<(<0~HM@;kYH| zv@?Hl(6jDgww^=kaQQnaw5J3pWyI+w?3OFY?|#}e)N^G+57q9N0UaqSDu#lTT3)3) zM4X*ma5Co)PMWVi_Fw?RLzB#E7V|e_+7`p&w_qS_bt@P+Cg~^+*G|sAehEYo33fXU z4mvK5cX?fR@z>(MTB9V4<4nnLiQum_4mU9~bm3B5^>f2VSwa7f{@QbEfUzkl)X(P; z`?I^?{^7tZEomj8Cw-mh?0VyzVLd35GP^oB`xVGk5uX1Y7uz5d{Gv2g-m?zoO_1402u zWvo0d6r#UHcsF_t0}u1Ac1ZCrSC>k`q|%A14cZIBV-so`bolvwtNX_Pb#y4%F{E=p zthk&<@gy@TDASRUkTC29$LB5p^?gXCQp^u*q_wx%K)NyK3(ShtJ;Bvke*N-n-=|D@46kkPMB^wTa4|V0 zC9+ouF(QJaRof8M6b{G}xCmcgfiw&1(K1KU46fRJD^5JoF7IOg8D22F2l|Jm5!orX`cr*nkrW~>Cr6yr21C@511R6l{QJB<9zI4XPplnmyf5?fP;zwT zbS&GHb?1_S+rHcH)~-lStPJc+OQTn?Z{MyV@NY=$ zI+93Xa@eYBnL^GsH!Lr#Y+uq`fAI0-^8RmTpARq9}X_LvS-Zf2_y5z=yB3VmC5vlyNKjkA#%owilG zp(JT4C~rR+`&6qPsncL*+nsI7mn5vh82GP?;(Ii;Sk2lw&KZD7fpeh|YuY z0D$j)C|ga|uD49BnVj%_KsUaD*d0^ zd*?SFl?{Ec()>~#m}Fz1g5FO@8Hf^N&rEh_(AC8UdpNowCiIIkDkKXW$ar1o{HPUI zwCR{^nndZ?l96%48AI900sXi0&S-LcwF5FE2(H~@ade!T9uHp&ZTf-_0`}|pq#!HD zB(EG19m##tNJ`n*__zISCO<5y5={WnEkaall7r4_lO|9>Lpup1&dDVgdHOXfbFrmw z)jceK$aQS=W@st-;EqKZ6RT<=is|M6#pwkj3nWUYs6U&4{D*cCsn*Ky^X=KmUL3)E zh9^W+&5ykZ;U^Hc^z%*{5w26{Ft68>%qM@4i?%czxUfGX`{s>yH=OR;B}pQ*Z{2@? z63Q8tDa5@2$Vyy`Mv}fhR}RZ4u|HxW;{KSI$9rKA{sn^mL4g5*#^ubBp^*v7Y)bOK z7cDNfk`9AyP{{Zg1cw6fEay`j&eAyCs#DkIH!q9YD;zcPBA-(oM^&iK+ARF4swRE( ze5&bX;{1P0_5Z$bT(mSiLBm3B(Qnq*cP`p1U`DbLMK1lTtE-zxlNcHrimXM4{fC5< zlw$G1!VVmhgK?i)rQLl!bB8pgVvZ}`{yMAh=9d+1y~93Af7D7=aorHFTTt?rWFxnA z|FB6#Sa^66A!72`ckK5I9s9*WKt4h8<^PQ57$I-Nd zNat;BvFqO_`mSIm?Ig<96{`mhYyFV$!00S(bMsYF-1y1CLyuNmN7u)|z%=Q(weR0C ze$bM9YxwI<(K9+v!a>1rw3aX!42^XEW_qu2^Q#h_Pe%r084~9zMseB~RzlwV875O> z3P!X+@_e4=98`BkDQp537G8`KrS{(x5f>E(97Y47?di#TTvAe8;RL?dYqmk1MR6XL zc!1Gpnul{`?E;N3``Dda04dI5r&Unc1J@MH5;`LpY|TYn*u9gWR0>twn6j4fusCkO zUXYYO9#7N2%nT#NPt^Sre$ZZMUhv3h50nlvdoW2h4^0_Smoe8F3pJ|7WQ<+?LgCCm zQWK*prG-P1bUj%hH}LX1lZdFOOQr@!CM^UfL!7X+5_D6qHxr$3aB$!O{y=;@;ZFi; z+IBd!t>1H#^I8q^>Vh(s)WO~8%r{KNlOuamga92$*clqC`kV%p_1T2?8bunp#9NVBd>A6cgoqT?DBC_GK zYbnGQ(!fx8MCD0JZi^dM7N$4$sz_~=;FE@lyEI5VW+zYnE9bv_@(j8Jzt8Vqg8lJF zQ?WNPc&(O^jE07fAO@(aHB6<|t4aJI=^^(bx7bH|y@dmDOSY@2gY=BJ;RmHC8X8x+ zc~cmT9Xn|n7^-hXMOs=$)@n|Gc_YWR)Q$A7VG>D2RTa9bQ}7&L?_@juk zLlr0&i-mPeK~ZuVPlT}UyN_Mee*}`2gz%Mu1(RHQ1lso!6_ikpMKsjn@Anld7)8eX zhhzo@!~&^IfCOMRo0FF}d$I`$@61F<0jjuCTJU-|km(Cb$i3}CrUL}QZR3Xo!@!0_ z+J?{#ziL#_7)8-WPKXg$Go{m8ZV+f)eS`{ejAgL8?(UC3#G?0{ah#(R$Y(DIJH<~9AXqa{)jJ;-Cn%RL`C+| z*08=zkWaC04U+K9pU7X7s-q~jk_{vII46gbg+ynIwe8*|7P{I?PiK~PEd8c_>mYCC zS?b!msOLfYZy#mhc9)Kn{AzdcT3_|@S*mtX^bs429NX}8?|xbV(XKXpzbW@k;0sUw zXtQhlrUoSjX$YkPK~)1C%Wf}w@hV7pvlBM@cAy51sMdWjuV<%&vVvHAM%H`ec4X2u zZZl$*f^DADdluZ`33GerD6^e_1Pl8s!v|%G#ny9trsxfm#nNVkV4Van&E%-DrIIp`X3 zH0-3DPvSRE8n?Um5!91G!RTzgQ`^A-63t;kU7O{(vj@D3#xTvV=y)=!i+X>XEW*w2 zsohq{ZJJo7Z6`d7$=MQeU{X)RH% z5Pa>fHQicxXn(PvVwT)iPFUMp)lMzy>rOUY&?IRh6CvS=bh%_mz#thAJBatJ4$=IY zuH#}6qIBIdIZ}a+hhrTcXCo=yd{05sdHWW5`4s)s?6y80@<+l#0^}g#R4=cxU3?Lh zww_V(cv);Qk)wSSCmXQThXo?Xvg_0{L^EqSOq8iu8K~_r<6qgFRzCXuh#cTaR4OY9 zRyi@_P@+9pH;+aRm!BsTLBxD*d%C>GK=)#6o!qHC7ME3@%B#8Q)}EKaKBOQptHPl0 zGg9#rhnrgBIubJ=&Cw|nZ9b$I*(2s@=F<@nzGW~T0&ZSX!DDS(Lza zVq&@77%%(nD4n}`$IP-Sr424xGXtfc1IqEkXyz6?j8An94hmd)X=oqQbWxh=E(B^6 zMoVgy8oX$Ri;KofO&%S$41|Vr**b6bbud%qDlK!-vkLhuAk&(69GDbZJF>Gnny>Zd z7L59=#<|5>FNqll+~h3ARvIGr)$q?XJ>9Mbn{nBtKr`AUL^_Y2wk`g8+~y1qucp(F zJfv%U91ECUEu2Ur;8Tdr*vauTHhPke{-k#6(sjUPEALq((%8JE?d*{1Y}_C{Tx;}oLSH5W^iTdfIg;ZGfW66|wQT^SxZ z`HJu1;`;K>Z>w#lemv61STj zixrV=2K!(nsd4T`PQ_Jv8P1ym31Op?hG-M5lM)GEBlRYovlM;j`_Q9;uHvYSr+TKu z6euYZ^NN}frEgrNyy0eEOq1Ur9hF;It9WN1fmvKjrYC zw7khKmeLGNNZ|fZS8M(FYh&yf-Mn$Ta3LB0cO42JzTY4W`Lj)5BeHCdqZ7$uEojJ(rx=Ko%T|gi&Ca%le)s)E>O$QD$s4T+z&}* z#fpa$NUM_PQ&@URWl?bG8>mcgdbv8E&-%Hwq?U&Ky=VL=aQz#%8|(B{o}oyIt>{|g zMEnI+&q2LYLu(&ReT4es{@PLd5s;BK&zkX^$!7IhPQmkV@)AAr5@~b>{j2k+5E93R zXqHAdQZVVUut$uHp@FG!9(Q6@Q(8qAnd@WJpcblGI0LQ2Q%N()nTO)dCe7h+c5vj| z#KysIb>$NbqV;J-Gc2x?qk+@WR?UHNOpnr0?l*Gg!)uu!=RUKjZ}?)Y&+_)=A1lI< z)gu`mgUjFPb`;)=gJ}OnrZZZa(|Fz8z0Dywnd{BvFfRPoa-c3Bj%vZ*$7)Zirq&p@ zLB1=8?+59LM{O2my`Qh2{l1`7z%2^X=`j0C{#Nd)ez@d-Pi21GMz)cMXBqj&?5w)# z%=E68j@oHE@5?0#f+qOFY#R;r#D}a5hTFdb!7Jj> z2zkaULe$sXR`Iq0he8!?tvV?5_@D%dP8+nYhA8!eq`Fh35A+))>l}Szdme91)b29l zxagfYji*opG+f`<6H0F0XCMmMVCYl}cimQ!g}21sNp zIku9SkgD4)I|+@P{GEPhe3Rhia~rSlY3JQEE>KuSg<6O^E_Om->lMjgP`{rswFb?H`a>%UP00jl!W1ht?2R-z^PrT0sagAJO zThCI;>7E}&a;w9GI5)Kqk&uQ+5y;U7Tb`;PrxsFVcw8pF{8yRV7eT_iiv#Lw4zF!8 z8e%gc;S!0OMo@WXJtgTje@HgY@qQVp%e_s%r0tEVe~c<62T4|zmD7TP(G)#4Fzc_s z_d=Z#NvqIG4Cp z#JaQ%m!y@Ix=lAkqB_H%4MS9OKz-P;i$i;o3RlS1xWRcYDQgpPao0^bi(ng)c*ohf z$gQ! zjZr&GZG#$aOfc#h3fkYxu)CAr%ShSVH|Pl+7F{L~o+p;}9WHnWPiQe<%wCs=4~G5p zk2-vu)xEJA9)k}KAhEj@0O9Peltb8S4Z2bL%m)Z{q)(x4WA%w)zr!Bpbnr8~;Mv9q zpY#?cg4236;Q!^hamrPMc21ZRmX<>JN-_gNAhB8px z!@~oh;3eP86iPJ@0T{(*B?KYh@Qn^D1TjryBNT|bnfn_Lx+809YMKONTvA-@@x)Qt zBFv=`EwJ7imDX1T){2#~GGuLMc49g4FTGqs%?WRh7}x?8A$=d^?C#fwoQ?zBG5ZN< zrdymqij|;XUzLu9g@&i+FVqp(<>loL_n-c0*@a^xBe}XS5G+rRR~PRIM4z3U8^c?E zmVSdK=IG=wJI9a@n#{OHHOEWq_~pCE+&FquQE zWqOPS^HNz7DEBPaO{QA|%%=C9!i0T8$L*BmlHp3N&hBOrb7eWTaXg0{;JF|`K*CAR zKc?68AaoOC(}x%>udEjRCd5m@4!M7C>k%;JCpI8*obL9#zq8VL(gzEki!fG)5SfXb|v+nB^K`;g;w7d zvY-J(lQU*_=Jy#ZPr@@{8ghR&9!gY!DW9 z40q&T=~SaMWWwrWf0#E~p6mqUj{5If@1NXS*&iYN#mZ#Q4~>I*tA!sBUk;7`h%^gX ze)F!MflmrOLtg}kPqNZxLN2PPVIxjv(3Tb!4!S2@!RiS!b1GZ#mSBP}*B)M3S~Apa zEX{2f5Hw;;^C=}s=y1Nj9ba>U#QGZDKYa#nzA`PpgBv@!w61H|m}r-pV%cSZi+jSN z>;tmm8rXx=Qd=u$6(@0Z;>L;D24jy_5s5Wl!NFR}+y)2+tg{^jctDIT{)^DwUSE4l+XWrq5e4m{FI9I)}v z@qTiWy#6mm@_!TwNV_v zMpBMbA|n;$+?=Mpv9Z;5iSw~fj)zAmDJe@=)KVJRas9?pu}j?fQJU$sOEr9|piy+o z9STUS&b699DoRTB^`kFB4rjDFzMoLULY9F;!VT%Zt){N5P&=WtejawLe}%(HD?8`J z&seKo)j2z|n;mt2Lt`wRjq5gmsMH(R%u`%IdWbfGd<_gOFZEj*X}J^H-(OM3In7WP zm5hX6($RTuF6$m%T^!&UUKj~Wvc))bs%wlnN>x)$P0hl8!yZhw?2A`HptbfsGV8A5A}fx5|9W6rJ? zB=%sQZ_lW}N`DCXdc7w`(V#Wy{RAUK6yd3$q+m!aSfEY>hX)uvXBz9)fv8Mxz3#j? zY&;%MxYXzswD0aYx-KA`M#p_HnLJ*Q2nC9_V}Qe62Zz`4|FL@R**)8`+u2okSD#;s zg2ZE2R=y(}ozy}763M_gw#gKnhM8*Z56Ok411uP)YDa!A2zYxP-geO_PuJaJ%Yj0! zGoD&%GmDGgQ>_aE+e72LlZq7S$Nf@njHFmtn0T8C8i3oqdd+`Hs|UR12aF6`wZ$0+c_?r^?kD7rZ(9SC25h-SH(ia4G7<(5rv z@B4-Zgvt!XSwv3XqJ>J$o~s0<1+C^J4Y>_@7`6I3O}5Ob)zzLQM0phzL9`4sxix7m zgn_%QHO?lw>zfU)N|gI8b<*<*Kdh7#9W@al8o&_ER{oFq&r-vLLEM;8IWMPSirxr%QeNxaEw;BqTn*U0<6o+}1sz_;b&`M3$%3@o*@S^s)8$_cZ0W z#R1E-YNmZXh&cY1r_J?ryQA`SL`|xaTjii;gRAAN`D3uL2jQMG{RA7Uv?JdAS=N2^ zLu7ug6`{h&<(v~|ckgv~{SJ@^oD;vC-I|V!5C68gZ5?l|tuODkjI6EEHe^@qcb6gn zhxmyMGnJa1B^0gOu8t{Dl@q0}698o6gjKbxqLM7Ap;oy;aei}ep7a^9c72qF{?++* z$PS%R78m!lbhv~32&3J@abjfQV}Fk-G5wq1g_fDc>eS+5o5xN|!+m6gnS>s2G{NPu zoN}_Z%Kc3+?+Jf3F~LDiO7z%5CO)@a!$$B8#A;%s5r4)E`%}sJ{EvO+Zu*PtbUfN_ zTkow~b?g3HP;<;Vq(_f_dOY3jn)tP{ zYO0tDPk>Sq3v|Z`PIi2l+RqZeykPcR#mpc>Qybhvn})Ht3+%8GBRNMw)C0(0xRRmvC-hr zFds&;4ncEfCv#)tdEIJYlcZ;ZSl{m}?b#3#vXNmFoG&Df4$IGs_GMLBsBP|U!*XnL z_XmsC$SP`9wK+p$9mR%X#9}z6rb4C|WJ5)p$^VEs6{1op^N2D^K0~gNCkaXf5jq*F8K_-B$Hf^*pw3v*g7p_NmRPh}Cdr zM@L5kE@#>Z6p?5e>pig&eqdvzW@dv5(wovj>BrLqm@+b#<9#Rw1`6Q-vMnE68o2LM zq@gBmE8-2~+OsH>fhDwes(6%Bf`bKWS4`|HlkA4}YZiq}ZJT`CTfE zS|bxP$2${vTq1D;bICiVW`tTihkH9XG46`W5&|Mt$+`E)N)qc3HtqFsdyn}-pg&=# z7;{OdM@3OLH=X|e{q4UX2M1&;qv*=wJEr8A^{&R7TX@ct>R$Vu=#212pFC3P`{xV| z;#{v|mxY-S0(in`>w3Cso{-MeO91J#0;Yz8l%}1XguFZx1H-;PunuMxCLmA|xUkUF z#G)X-FrTdPs?hQq{cYmNMvh@TOY8g(N&fm@tG9Y?4)kA&3QYkrm8qqPv3b6gG3WC7 zNli%n<5#PRi3t{FR{6uY;^HqxDifolYMPpJ^Ye%u-W{Et!Y|8FwYw&pDIF_WSbhcU zn5rnsOWf_$7dMua=Hsw}ioPNRDHnZ0j)*6hk)TTO()0jqYoE?eQg#gK79B--c?3Kw z2M3l9#rF>)3Ei2#&)xU#t87a{)TdC#k42k zGEXGCJGj4(dsLjK0?Cg)u>EWRNEF05I^7%s@f9=lb^~VQC+4(rYu8X#t$OFYbvk$`}Jnf$)+Dh+a7U=zoPV0}n5dwNg4PHq4afOKZN@zmyKgN874$6w9KaqYHD zfwjNr!|wtDY^w6Y3vKO)vj58$4iODxuG)R^dG ztguxr>uH^L_iefjYxX5@DAH8?c5QhZ#_#G4gVfgdv;V*80DB(HP<(Xog0Og z!aEcy$^ORm0xe5cUeWEg3r%^Nt(bx zs>ro=mydUlg8FXDgW4KY?h{rkzSg3-O!R;ut+iXlp=!laF4SRUZ_2Dbll7H z1Jk|)%K=FzCksD*#4a@0tcxnZ7rI6$Ppe!N=4GMg#F82on@tsS?QIOJX?vcp)X2}E z5Pjt1_IgO-eA6^GJpFd-5UxP7aL}k-%3VM>*%xm&fRY0ALjE6s4awr}Ll6Yh8WM*8+fdxfrCV{n1Yz-}@^~pJsKs2a z7+AQBK;XjF)YW&@>q5`Ybrd(Q%kQ}3iyTupB_R5|Zj>eE`OB-jxu{`5L0@I2E4PSk z)Y(~CF)rfbQAHlEKuhOkX9#|;4K-?QIGFBd#&SayNgM|7k4sAS&hKSaRbMG7-x3cX zIS{p^BMlTe6&q^ToF6@$2eTc{54c^|my{eYR3wps`Q`yQu)B#;aUMEAQ}n82gl^G; zmeM&f!2^`Br*2@e3JC~5P2n4GJ1#6Kc{rUqsdGBuYxG#}+~>LmYqPMj3gOxA?-|Ov z?f3%eDraXo|I!xDX*VC4b$ES7MAJS#B3IXCR(M1to`i%G2Jsy}n&pAPeUDe)uI2*o zpGPm%*Vmh_9AZD&p4LG-FnDF0TKN6pEt}tm5=wd1MmT?Ffm|V0e@X#GV3&c9T9!U z{8UN);l*!-hJ=M(P+nQ7q@;9zCS>)pb?S*c0k}%ip@{X+>2=uKM!X|Skp9t}j7lG& zg+1Z^d2wV3JP!Q{m-pYwl=&UB<>9*r^3Qzb6*doruRkg)8%+&qIRN!9Dq;ZkE*(|` zlv6p=kj06Nj*WoGElTdajLB{Z9WoFFgTE(Hnr%=`8&EmIt^ zkz;3ffA3*Lg9IVxT~uuN2Ap5T^R~EeT0a78o>V@~HT4lAVkWK@3Iw1|a<^m{hu7u4 zS0@5kJ{l=lQsW&co2X%0zrnIoGlNc@+3lzHXBe1`frJ>F>sfc3nV#quRt8-Is=xFD z(ha2yX2e;bOR!gz{KW&1UE#>IiC7azVN-Y4NXDe$zznnRnf1id;zF-0_j@^WN+mFU zV&!Qyd3s#jkvNsgSXIq{^mfP@jPj3#+cKAXe#H!HKYoWlqMxbMyK%=>xwGcG-E&w$ zv7arRI-6a`a$7DQ9_J`U3(jl}r!+16c9qi!t0dBpHB0)^%f*4|T7&fm)A$sqp-eB* zuReb3M^ZGDBUdtBy>IT|&jON$w5%)N;>h*#gi|7(f3^w(Vs%k*_o=Al!oYYr7hy76 zeuInk>PZ3PcE>4?2DMd_yA;k*M>JF)Nw(jMZ-dG3R|-=M20QZ}j)`}7$hG(gZ(b)~ zubYHjMSY7fzZjiBVbZ15Xxg@6ZmbBpT2;+{K}VIS0vZVb^WFZEH1Pe27%6FggLd7) zL_}{e`-#{ANHgG;DU-s7{-##vpq^0N{~dIeGBgGnTI3IvpYfimCZPh}(KZXan8I`W zf*l)p_U{YL2Ip(sdSuK<_E43wjn>=kXDl0@-t+Pvo@#BGfl?Yyp0OrSy@yFvV+>}Jdk>GJvQm}{j?sS3 zAO~-j)s9)aNADv0xlT~)F|S~IP?O;67n?Cd8hsW|UMzRm(f(9Y9L!R1X*3CI%#kSl z5&{a}N1foWKNr6&LIPwu{Nd>0*{VRrm_8ha7_E(GF7iBOo%;<)c z#}b}%gRr0EG^6^ zP&A0o^nICglqfi5BS@TeYsqKHZ$~P3Q+?%ju}@*LrJyj{FNvsCH`0D?9Uld_>VAF@ zw#TleJW<^?O7#MYlvJ^C7 zh)VP&H66FxH#AlraN53s!N%i3sy^!2FW(({msX@#tv5AtMO-`)vtCNIZeQW>{%(Fw zh59}QVNSJBWNJvAqt=QZ;&SSqlvOS%AOUBNM(F%mNoiv;v%dOSYI9cK+KZDl!<%Rn z61XHs{^wHYFYt-WxHe^ai(=`>LEiBwbcEu4-Ohxe{p>Cpn(~l)o#{Jb#->frRWjOQ)61%GEOn@kysJhpl7K&u!+ld$;JMq zwOU4Yq2=ZFlHy_Y8Kb9(+hlYaF>&hKwU^{v9Iaiy6+O}x5w+#7xjYB9OP&hvcf?)Z z1g*~-(YZCN1|rp#D5e-!7T+q%BfM;t|9$v4TQk_KsYH z`hC`!zVHd*sO1WJlcL5S!5}Umz|;3zZ|~{nFW`1ePs_OZ4uBTJ-T{iV$BeYcrCC@7uBQA! zvhy#It}y#3q^M8q)4<5^*@~=Am!*R&arc9RN zTu#aE#-+Hr zxIO2s+@a}|jV24MxiHX*pEWW#Z>$o9vyO8wGmf$H)3NwJ!xR7(0ko4d5(hPR7KMcr z&j#Q;%a4bt+9%$e7OI8cZ{BxJqXSvx>!T|`w)R!Ycc-7tdr75qP5|$ zY>{7Ua%S2*cs!cgr!7bE0Q>tr3^`3ouTPu6YUnOADc=oBnzN2aTEG0OHIrCE{x0G6 zgtv$MS$Bn|=2??!Fl;|=IuuG((yBq8U2F#>`2LgE$qa*1lo}L7x=lHkonnykEy|x| zj;{jdbrb>-QmRHIdN5#>@ zdmS&7JV*_c1Igq;OLHb>*6{@FP~&E9fT1LpAN#6KQx~@)UQMTsUZ<`=l#O7g)XKFrQ5$#jw}oNYz^ zUYFOZBGhZ{ub~0jh^>@Lhp6vL%pdVP6)pHgs}{vFKQkfiYQYDK=cR{O;*Px&ua;id0cWrK|*&$>(}>`?mllhyH8h(8f6@ z)UUYdpI270HBi=H=O1Bgb!-;sf9MGwn$p5tC=J(AQ~9WY#jj^ZlTaGhu3apkn*@g< z3ka%QSP7MuXN`1n3$>E6Q=CKlCt;koLx0xVc}sWR^nma*!bBku;hj-u<7a3zoFlqu zyZW>JdZzK9zD`bCC}Jd2_J6j-R%tLsE@d1-<+s7KPa58^+=A&)k2p2$eOk_V{K*yO zdq;z(;6LKHl-|doMS7F3*Uw_)-%6`0A2Ue0S86fuzy|C9hA9m!ijRDx2VvFba6!l0 zF+}jdoRS~sz&UJ`erd9UCUkoc`lD;O-FG%Awo+Pi(*gvZwqMH(#<)oz>Hb&3E1Om+ zr`mU |30MBmB&(*W3YHcwKIr~BY}E%}Hi&ZKW1yb|ap_#?{`vAV464U)6{(`H;+9vh5b4`0w;GBzrN0rU?a=^(&E)c?Sb^y%-GgpEUK z$+aG)i>fr8mE0~rvt}A3OZ?-h2=cN`K>862q+D>kRAQo zlLcH^eESrtxQrc!bDD9v`4<5bD->quU}I;<<^9XWk;zF|BWGo0%!-hAdXcrYuC8%^ zP9Ic9nQoQrCsb&?<)3E&gB|>DILEBB=Jdyr^@RJ8f{~O2JsiKBeZw z5B_~Oc^Vz`!_7V}`p(y(WqQgpd^aO2%CqF+i=16HOIZY-Bir)yPdwB6t1{m_vr5a4 zY!0Yix>M179rDjFox3C`nL;gRn}F1wdaLP_%SW~8(S^8yz_=9YJ&fLZu>(G{cOVH%|!@m-t60~IZ{x`R(I%=S zkypoWR>VOC1ys&)GQ1Ni=S9_F)yyg#sf%nC@^SG$zpjtv3ikfIAq9LfdEP@&cL9+U zQ@Ht!YKOt&3R+0nylBx2kdcgEhPZ|M#>FMp=XwqmV)=ltHt#Xw5#t0*acj*@8rpHu zKN#ze^3Bhpifsz>t>-syQa6F=@lpJwYO}B9oYdSdk{maBj%k w8GGMKl8riUyjH z!mvtKF_+~0UhzOHGm`Ic{XbaEl_zty(A5KrXlI>j#)IERi*^)7N5jI#H1~!FwCCGtA0N*^_5I4QblGIFB{WmO#YJrMxErGcW{c9#&M-7P!%xi88VT0J+eO>epKnrwzhI(FF_H>;cjrR&GF4{n)#CX6Y;}mh>lg6H2%EwN4?C{ z)!3U@$DnJwY3yHb^<&*`@cf%ccpUeWHSLTB4$Z9;wT#L>s&2@SOr2AX4#W@+X$|U7Pp4Bw+1a^S8qkFRx@aFXj1VzrbBRS??qNj1=nRZsJ|MS?-9MB{dkgkuHUhomO-RSSejT&F#k$D@@pltp)6nTAG(;==6PI;gU& zIGPI%(f*pLJXDbnMBpk_&C1L&w?Pfi{tYE+nYh}GqiK5#+z_qb?XTK8MF*)xzW!b+ zi&!k@^v+4P}jdw;WOQZx(i_xvYwoA<4~69eVcI81Ja2`$9tyhSC+| zs7Czb{`GqFtwtW##AXI^#Mh;2drg*(SW{gLgl?1KfT4`IDFn*7ch+0RN1TfBgk_WD zU_TDi-gPpYMy|R!GuxE6pY)xaavo%Dz5r8F>H9o{*z&LP*edSL2Xh1D(OOq2~JgP^qd$dTl6&{>@!v%6<8L z(WR*q?)@IJqqU|avNR85Os2fNE~+Xh%V|I0{1QuibHTYHgp1WKWmes) zD8U1`tc85h_m@t}FHeGj(1`&>Z8@t3|Kyx%OLOoyiOvw}Pb0gm#Rx+qnZOpD# z?JBJ46h-1-eK4Dm>xq#Y)wDnwwf)XG`ooJ(t(sp(d3Tg2<5^iOYLHkgjb?H22W{EK z;-ZXa!KHFkA(J@z^UjjRiW(FZmZ5{IcXFC8y6+3XFsYETO&VS|A8Qc~6R~eGqZatd z!I*UF1-Yj=7N3#5$*@efQ=gYZtyn|w@M&&)N*Ugz!AphM^jmrS;dRrxBuOh$d zy^83M*7w>vxWBHFOjs-+w}n$xrB;^E44wp}Iiy_k7iG2T`s;6%x_vCzQhPm>G>^_y zWygeRYRIhk2qZonB#22AM#Ow*Y>;D_Ze4hL?eP0}J9mFs;6=&H8y+N~A*}KJC1d{f zF4xin2kskJa>^JrECOT~_667T1T`!vg_!zOy5r04XUhnH5%c68g*9z{*-D2v=>6KS zi643c7dUGH7}iN?+}wTm`(_5XGx~q_eEtvQ$*iMa=mQ&ahy3pYm=>wJ{z_g!@;MB_ zeD}4Sl9cfKmrcKYr+>YnIu)u)sov^9SF`%IbE+>UW}~Gn+A@x zy1b(Jpa(_)*XHtVn;Rrg1!nop?-2nIxCA~9_U>lJ_i8#mR(difgbB6KyC>biAgxsRKE5*9&J5+hmTDe@+E*U&v+D=#r zNg*8v=y(C&gA){xS3gLMYCPLAcpZa`ZSZ@%$LEObr1!A_R%rv$b7ZPw)JpOe>WM=^ z##20Gc+^#g<@2#<+i}{TuWrr@ny2kHNDYra!Zmq#zEJllIFxK~9O~KK;x$T)nyOL{ z;$s-hFDxwFc;VvWvX_Ar5#iQr*NyQkpr&+I*BU!2+S2o2 zIyTzu!ZL1#UNP_l-Q`$+8+hGdnxOUW-#x5=s#CYfx7@BQDOor)ha$e}?euq2EONVe zF>A?Ike3&T^xm-H8vi;A093Px(;#Uj#-PYJ4=q$brqKPtSjL)ClLUd zO)kAJG!vXGO6Lucr10I}TV-on66VXs%5c9$-Yn!>8W!OV=TuYcAe zk>z~Tqzet`<#R-pFLu=#HiBTaVt~*p{(Gr?cz>#0-i|DMKCb=sU2W+#{WhL%Orytb zEc|hpKuSBb*_qg8!ELRSX3RzP$(DqsQvUi>HO8zARHK>l|mbR71IiVB67*o;q|LyDLA zNA@;2CMJBnl9vmV+x2u`%KYEWkE}mKrh9h|^1a-u$X%=+zCe@-O6fFW8?Ci$@0L7Y zEEb5v6`Nc`n33wd-mRWz`VcnyJrsG8GS8<$p}Yj{P5!x;h_A9|R=`ZTaISFc=+mUq za_ebWDEnFbYt_^Bp=xWC$5G;Z*kL$jJdP0lm_@Q42FaNp5Iu_D=B#mZeFiDp?z$yN z`G65|ESsu7)uh?JrCepTJCq764#JB}{|d|f4%jbmf1kI^OX>3WYpn>FHvUr=`JW$& z5y$owzrz)4bAoq!i^hvV{16G8Tw&;H$8XL9B$mWElH9_ty;_H3wV zpBZZ@J=_X1{iP6C=vexf`s~;u@QK7JjRZn%0OmWB3c)Pron$}shHW!* zQ`{PX!u_=|Qs=}(178;FA)VT}L*VOGW_-0}1e@f{SyX?dJU=G_E$ol`+xTQKX+9|C z(&njkS#utqTA|xe3fn|$L*6?+Dxdvvd8Q<9CttnDi&4NtahsC7e!kuEJ{@uP!Fuwwhg{p4<#O@JQ#cL59W7 zh6?)+#AwgLavt+KC#%Ia!^z4VT&W@9>nV2^$K4Jxm!eQO z$X@jOyPrSvnJ95|Cv!Ig zRz(oIBspK7r_N{Y9@^^ju2aJusQQ^;#gH8v@CG;@{^;}8L+{&+hKA$^L&My+B4a9V z{I^F9u#E0n)PcZ4#BT&V!)*p`agC2OV-dLPGj`hteUm3qRJ{rb5uV$9-r7y~5gyxe zhMg{^F6_YF+@Gm^$Gr4FK~A0r0@b8=LD&tM+HBlRMOG^BJW~Ua&sQhCE5i7S2NTBH zJj7@$uH1i85{|NYU|XwuV58%B0_Vpv;8c1d1_M|echV1+zP?f!y9>t%)D?v zDRf8PBi0#+LJk+o3eUgs>{aH%(^2mjQ|5>Voe68hYG@t#T!Blfu~U6=zQXqB{+9c6 zsLP=+c??9adk|}fW#f8N?3aeD8#bMNy{e(?eac?7-lJLG7@ChUXxpKlhRt6^P=woa zKO?lg!Z}(3)a@T5o_WdB*u;wAyT;IwvZa3fuXTV1z4U-|wbj!dRoEdJx3B&U6T`9c z{^;`VH779r;*y`O1>3ch-Q3?`;Qw1qR1>r;-I+@cRZxv2I5TM8$M-wcs=E)=z*7P=06=`X{Li?cSCfaJM?0qnWRQ31 zk*=%{Va-vkoAQSU@y~PVwwdxu-}7v>d2^lg&9Si9tDJY7?<@nayl>4DY z>~VeH?k_PVz%y>1|3?<)G2IyJvHUq-z7R|pef%sZ1Fdx8Cg-_L*2KP}ZQvx8hepgd zIwYWCKZ|QxslM;;-BqmlHIl4HRO^3s3z2w|e%>BcjnM3_Q~BNsnzuaspfTSQWkGv< zX+uQheyi`ALm?=V5ZF3q-xn)NR2CQb*17#E<_1GMb{a49x7xpY=p$-i3giOmr@Wv& z?@HsvIpLjCE-SpC{oB%`kooR$kHFMDGDI@*uYZ&0jhU19GvBlwRUoqAXQ2)7x;MR+ zV$&(gbSh3Q)34rsceZ|Kp5NXb4lE1=zbI$Ug0)!t)T3t3vrZGp4fOsX$u|@oy@%Ku zm}6_$ex84hum-tFm0F_7VRpwiV^VP0SHn`^OH{TDUzB|ki1O5QWF#V2LoCY zEAq77&|yH!oGy6O+wR|F2hWT%O6E@MI-ESDQv>@DknMlH*!I@6aeV_zJ<*yfyiJMB zQI%vmo-6@}3CWwB?_Xkv+5Lw*Al@n~h`@1>BhLf>FZ>}RL z73TjsJhg(5nraL*u|#srS|!ik136l(7Evuqc%~hPUf-h11gjL#1SLvITTJ6MeK{T4 z=*4(tcuhd%i*f*U3BhyEJXuL2bUP4I9OB8dC1wUrq-KGXFlp&nF7v$gW#9<3PJ^;T z`D3G4gYjnFQY@Pry6OA%rQ$)JYZ&*&cA27PiJ$8lJTV@MH)LZs#7IfWUMaH%-MVF% z1bLf>PgXt&2YmChlezcu0sx7Hyvo-Mz2M=#ec-PJTJX~x_jk~-U zX@gT3w{Cp{%^Pz}z1@1+cvhK~B+dpbQ9xj=sy%qUKk(A)x~4Rzc1P^s^dhzs6MPCz z38tX~`zd~D=`y40O+)asf255+8Qa~2=k>fxx?Hofx$dfuvtIF}qItMuAe7^Ezj-db zkV|(ut@`i}EV2e)Rp&BE+HcJo?0AWZtY{WKZ{rOpF0D%h*#XMt?lbEHj@B3 z!6e0`Ypjn+EAEnWW=pk?x)A+ahX`7C*5U$wDOthmnM)|2bi^stJ{e|$H;g)V2mwgy zjxc);UT%DKpyJN9f#v1%Gbb7F2SGm#cI+v|dyc~y9!8QSLnB#jvAcwkO>LYDmxDzw z@~zVXbycJHcPOryYkYihZS{zM?gN>Zv|e#ICVWX1823N7VMB`59E}@Pilb=gv>ztQ z-y4yxe%aU8hk$^<=Xn>On)*WEkgNJx?XHwaQK5xj)!0s**W?g~h9L+NBgE2orU&UUzTd()HP0*&CgO+;8+q zSy>$xhfOj8^)+vtwTA{|xZN7p+JY}8g@M?GYj7$7N|;YO;y;kljbwM8$=?@Qh}8c} zZfIzWhZv+niFR;fJ#=gK4mE$?m|wJdp!gnH`ZhS_jjwUIrll33cAdwgr-b@u zM=S$1OsV_cWey}+0pyrXFlgQTgcfe*~a(iI4bNzE@k zXM>e7^#N39qH8XytSNvHV~Mq8YL)#-;2)EvTA8&J4U^Ss_flyi{1*xS#(#;Q9`VHPDys=mAZp$%bb}L zfuj3;((Rp#kd%}gTfxfe=})Czy_BX8wO8fiXGm9e?XMo?Cud0+ zS+mTBg8CF{NB-elS%aJJIz`DMmNR|FVB6wx&6KR?;}j}4dcjl9Os{DBRfZuwx9Ob6 zhUC1tbkGN;W}IlTS63r44+KYy4bOz9hF+fy0@p0PGDz{Sdp@tY=(=CaPtK(RlQ-4a zO!Z%1(#A4P(oxxdr*DddVPQI8tt}Vs2*NNpZuV_TYU6t~&vnn|cYZGK`6z(MtWyiz z{LuV!R(UL&dqgeg_zqtTj7-_bF&4&+3(@ps^v3{aqMtZzQI2@Xov1dfJ0olBeE*s3 zf=oXOQamm5k}SeMT3vg-?mTQc2YN!dEzfLMiNXC6Zo7!KhH<>9>$7$Qe+<@jWFz90 zt8`9L#d=#+dpOSx;LG^$SMU{%A?i5qc)$JSz&2*%wsqY?1PScqgPljYU-T(1B5zS2 zwjcJ!1}<7C08-rZ-694=nRTrk+|}aU?@WMcSjv(mPAkD=9^;0t{Ug2i`&pV7^aDjx zr#FiKVuTtlFz;2UO}A@7P-gK$OpLi^+QW*Lh|Xd8gn9yDN?0)HF_TfZIGma7-lx2= zZ3kE)y(4%me3Y55|3S6YgzyW>@mRfQ=n$_|`YnXHHC?$@h~A`N9pUW4bo$%3uzTY|ALL4}v3)eR*HGsr~Xl^Z6DX9Uaq43(OKvNPPVhzdnnshklkfo9vuaup*%5K|_0RAOjd9 zEDk+B^HK_skxLp-2HqE8TAY(Pqy%^GFYa$Imm2l2I%C)n?EpjABCsy~@-%VC-k?Cj zqoLAg8O*0BZv(3;nx*VN;Z2o~d-+0>!G>cj?gADKY{L(I(4&?pD6BaWbL)Slg@+XH z_FLCn4SHJ)NQ#R$#VRRi^?7KY7v)ugiYhCAPDtT(CdScS?C~L*d_t*-dHV*e<8iiz z?cV5hnqLy+tf=c?q3NM{znKxWGMXPhW->7`tZi?jmHtu@%E$uX2r7$j6;9zaXR36X zwK0WEG2X@CLZJkR;2aw|6(l&?+ z^S}BCsSgZ$=6usg&%3KN4HbSB*j6|=dsjbYeSSFO71&VPH>@-8?JDBzM|=1+`1=lL z9c~}xPn8rAUmiSso%6nMMI*Zdf(vU&MAES`puXGOtgDxoxtQ#^p)acc$VE295Gu|g z;jm#vn4?yX5G@9qb}p9@vudIt8^AnJ|6UUjy2uANplIA-LvLNGwz=M>vEHWbwfT># zuEAOV9EcmrwA)?)bAr+89m*cnLlhx8?$peL;b!@5Uz{%Z9**a(?Xu>L*YxJh?ROds z$HL-Cfk@DvhL=yc+wA1IBzT`h{zLDT;bc>=I_TIk3fiBKBd9EI% zhC5!ck%!te2jH_mYNDwOY8Ljo?b)-(Gcm!B3Mhef^YY(LVJ!$s7y z#1Uthx3{j%tJv9{SRiZphK-NUTk?`|wtxnkrot~+qRmY` zO&zVNIEGQ*{Zb?LDQ@tfJPCjG>LtU{sq!NI`)#!fB1FcI&<6lA+=4;E+74f7-C^13 z61#*{v!2|*y7>E^d^*tve?H8;i{fo4x?p*7$qah~Sx+us{N3c5gVZc&N)XO`(M>Fz zZSjHeY$cD>?Vv7VmXMJjc=Emywon(xL??L|VDfeWvFMq9?c~?RfuSzWss^lW>@L}e z*WXyI+(A4<&;W!Rw=!$KS9lQ5{QS56ZKX-JD4Jp|&=^-6{56!mm2q)mhWmq4{U^xd zov&^nEVsyc-j6TVV4swR(wv@oo|xA%aWe;RyY*9U7=*b+qRf0#>uEXO+C&5Y-S`o6JjI+TI;#^zr3vTFtB&}f$d_6RxQK5G~)$^U@BZ*OTxqC0R|PZ&B{(mys7Md^SHfF&+Ji^y#u#NFIG*wSw$Fe>W9)gVn1h3qqJssW ziH_oz5oO^IfsJB7tc8$))MEla!i6@OR49P>6hlN&$<$xE)6irN#z#W`f!6T>_73Gu z+>LA!79&CfUwPho$l9sK?qpz!@YKz!f$AfOnBGELnwjN(GS}jBQ&2i>yOn7c1!%}S zR@%>@1A|DD{ryQP+esNnPgc&|#-Arf5kQ>eEnMcp!A1pzH_PC8?Y_Z48Fn$6U)M^5 zcc(-pufI4EJRXf}nW(-%*Nskayy#D0iaGaM)CJ{#X%u37&zx6X?+>ts*w>Zham z>U%0mwhs~K)N$mQXg@7Mf&&t!9(Z?ZZ-gn^bsL=Bb2HKbFfA=1mXo2=c7aR@vpkt| zcB+b69bwD4{``04D zMWD%XyM1Z|v?vhN16<7LKTQ84%?6jKj|Td z?P_pp+uT&X)YRnZ!Sc3YpK(gTY^Zr*5VPzaCbr?_i}R_fnLlbQlz$l` zb>rfqybuY)KXROH$gMnsXwhAw2=UFEkeOJ4AYZ=N?9RBogu~x!*wGb`ndW5w*xb3W zZNDMK7$vQ27y7Lu%x!2fB?$S*+R4m(b-)5W<)7QZJF1V+4>3m<7|cE)Pj=ehfgN5X zz)dwk<@gt|=StZJ_UYk&hiUwe#{vP`M=ARv!~^qQIfVbXit@@FL5Hyf1aC9u6mL=*- zsjBZ!*EKacrR5}j*LR@zVy~K+9)CP~@JH^nid3P~X7IvU!$%YOhN|^@Q0?Kc8W-Ew zEzk>^g$L8o6bY9pbBDaslM9AlM3PLUVp747+60&VuN7kpK9^QbGisi2*5UHdkf&(~<$?`si0kQ9y&cfDxP91*X3NXv_{?@Y$RXioM3b$_a*GpDzHC(aZ@*Q9#24E zOJ!qWQ}(>IJ??RvYG|jL#qC{~dLwWYhWTw`qcf)^fM;=jsIbt?`EtwF&1foeX{%^% z|0fQv)PU3Y)C4OltEE;|STYGC>_=$Q8RInQRQ&yYOM-SQ({RDml1gIg>z2CrWL7I8 zZHASDj*dz!gyhh$$Tj8&>|3%*TC%EVI|A4?1tyEjFsYizg_9?}!b*XU3pY`i_|!_{ zB@K;G?Q{9Ny?k1(XUNa92~(S2RFAn!+{vyqV23Yw&Fwqntw5q3G5RbE7}^DM7Egku zeV(-f7U5rldUeLNG|8&l44GM&oft690|!_u8yz;C!{Oit!T`ReigGjx+(fn7I?u~u z7jwWdOvJ>LnYJ|-N7t^*L}IXxq?oN(5z2xzP=QVoZl}H8~ee6S<&}` zq#ebSZgb7MkJrooQQZInlw@qgi2GGLJ6ETYz2_7IFfb0=R?Vaq&8m)86O;Pdty~D_ zYbM4Q&MV@bZB#V%%pP`)XlSJL>Fl=QBh%KpE_L4v{Pym?By9ckLn%p=3-{^C| zWs=GZB&=)v|F;B!v}jX-h!Rmfy*EkAG&D5hj6NYkre?canw)>7D$R@p^1uL0!avy- zii#SbfePEpGJu2lDQwkm5um;M9MN6j|GBsQS4=BFC3yF;wduDv@f`3vLj>KOl-c+@ zhqtjOnj$ZwUI0%s>i=FGtWHpd5qxTy;b2kGyM?Oax}FvlDgOq4ht)eV1gT!JmYJ1|^kck(Y%{p@-a546O3}RBdK`#nlvEu?Rw?Y^E;T`%Y( z39eQ{=1tY+k=K+bDk!8ODS^Q-h@}~kRn;8pRLjjS7nUzct9Pjyh?T-cT=Xg$`}{** zS?j#$Ab_td9H_u?2K^fYw|TFRPf}x$;hi};a=VWrsb~p>BmVl?S9ai8cprb8k;QSZ zkQH3kmK{K-L}f|}xA!fE0J$9x=d*Gwq}HIX;|1@lXC-8J*2z=|QqzNH#qU4GwjbfyLO!KYb}nyzxsZWk%beCt zsYqO@IXa2cHYkj8hC*DMBbgsPvh!BN>5`m=FAvO~UoK+M(Gj7i@Y;lVYQn!*7I88L zVI+=_2Yx(?r$&!hQ4mLSe}9UtU~Q|gI*X3S^+zVLjYpZOGTiZdn8x4gYD;;+XK-LZ zQBE#n-fBFpun-RmOBDD_E(+mfJ|&}ub^8k;&XtA$U`~q%r7@$=F=i&ZKU!Zh0LSH+tfPa`;&&>-hSZ$7?+s zXl!#`K;86uw6D(4Y_VZbPO}|&PC0fq!w4=3^ghh;x9;)0cWRD|jLaPN2YgkB^V`{U zbrG={1>{{%Z!KQQPeRxPy&omNyIPQRU}<|Hq5))FgWEq%`z{L28F)|XPdoelsiQTf zRQr&$#Sx&Rt+V4IW+cF)N^oaym&!_VegdOXU+%h(iDLi;>L6)i(&DQQOy}DVU51nc zdeuvTRPr{K%N+{&ftl#Pc?prOFZ%`ur3D0hZJW~5^Rn_XGc)ruGK$m1gplAhStlkM z&I}p}>L&9kfOlG}73BZYlD9~%jY_YD*PGxs$SYRR5N+%@g`>?SNhI&32c9V%R+!Jv z`K2jg65RXQ1EM0k;kv<*AIRM3c~dR#fZp~3jzSY1$P=lIZ@?u)v5^l2|NU(lIF8QW ztgq>Mr;yab>ZROlW^$U1|{8#I3eWa*iFgt7{fQkM2ImN*6_B!!uu z61c%`HN(QMes4`;gJyn3MRY7OX95FnUw-9Hm6ylLiK1$_X3PqTd5XR-{9n+sr`cwW z%#P|-4(eov!2(10AYjp8Ny(=qV%7#k)(HE2?G=?6Ff6cfVvD45xApFLlVWLTdIBt1 zL?t!B7rqx3!zw2kKf|ongi3=uu8o$WrJ{PZxRx@6 z85;fV_Jxb?b3ybUNYstBHZ$@j*HH1^$l|;|jHB8@rIocQM{U$oe@o8;o07#xXEdU-Ya=3c(rWV>?j~6^DZ69=$I=sXY8ddl z_UzA90b)#XiTmzG*ifHT1o^=0HpqFjH2HWKB83$a7bspjpk>Ct)fCaobkk(gzldE;8jA-Y#kJE*UX($vuW0vcTB@i zW`$r>3Vm_Mu}xsfL|AI9_V@%oJxQY zCwre;?N5aK@QsK&`94IKdO>aRFwiFw(~eC$-E@$p?S~{bx;M!$88HZC^)n-C+X)BL z;-#es1*);>m~C#wpOm^Cf6?c)r%dJRS5R%X{zw~BRO!7p&YO%(>v9J3yodyBYwy3d zl~t;M(a0@*H!>j$kdOYF&OlsxF@ApU(o)8CPYu1&0a8}hi{VBHs*=)}&gM8WldiyCCAW}O6_#FPY)0bc{&uUz}nxqdwAnuFczCU zD}-Et&E`cZPm=G~SwKR=tQn5+K3d-QC@}xXtBx-gmx#V5Vw*n5r)7!nvH&a(egf z)qAf6FyF00p`4vm2qRLk5zU97G*LFE}yk49vp$PRDmc-a@v zc!j{dD{F88wI9|uVv9P?0(!KWDx~{C4`)-Dk`9tK{)m`zWB6Q_T7Ufk6@g%3-?Gd;n%kqs1Vn*%7mKs#oZuog7oLxJuL6}C6X?TAuwMX{;g4(I7 zTa;D3-slhoJ=p4uinEDejY@6)6#|$j3odu<45~4lB^ItbtF$CmL>ubzDfAR*Eq3K^ z(x*bWVeqw{r7C*Ho0%J0*W;K z%a`Mk;3_2>BSdV>wM`2z1t%)tI4DHtaaqsnzCGpNM_4C48Ivzt@-XWQc_?yn(P)lz z#-+v3{>Lub%P5}y_@dY81Ekf-UyI>xi&o;_w6-XX*P#;Yzd?0zaREY!jttH~LLq5* zXSP#|2fOw{ad6vex;&iPxE0GE^?6oVArS@pY(tr6PMiW`f?`@ycq$=q_teb$Nm+fb z;VyICeab2wzvCW-r+L`*krK@^iVgdl70VMh{nz(N2RO=VOk4D8b}+BLH#F5AHCwSK zwgdL*Hn16~w4TsnYLN8UlpsyOBjxI6x^FRo6O|{aNWb@D0-a%A@QEGcMp@f~ecyO; zMitE)W^W+SlX(keWG5CJL^u1~K$e4&;%y7C9uiX_RrL4a9^!}0J{fqL)N?Mr?vijK z=%QC1&Xwq$;KtO27)Dd_dJ`-0ErH;F*7BhW2W5w&sXS2Lv?kZA>4hpS!+83x-{UI5 z*qSSIu-W;=#ZZSV8bW@V5(0$eEbax-T)kkP^AA{zCSCe=UG|ua;&Kuf({F#LTI|0$ z`mOV}dd~_;r5X5pTf~fR@^gH$SQg+RfJ0%?jAX(fUTCbON7VEF@PPj~RnhOV+wk#6 zez)mb*CCq>?f1i*S9@6nqNEmiz$K+P894VSeplbkD**!l#K5*o3CQrw`flYnG%LV< zW3#c(DL}pTy>g-6zER$65H_I&p z)9YFD3q?dpI6X->l1Xv(mQiz{!b&tkz81fw4T9<+?7>K|wsT^3`zr_=rmYb~VC#l3&<_LQ|JKp+BYdc^l~_xPSjqxF4F&>pIHXj% z=;;zgXlP6f9q6Iu<$bZ~1#jZ7egYh$NPnjq+)dZ{5)PMJRrfQip6za(eu%ro$!Y&SI7>%`g2 zxu2fSB`L)p8rs#G3P$;Jg*bB~tucHRiGlLGQ5~P-Uih6a%AXcDO`j4 zMPd8R-RuLNP9-W1xH>>h0}2WOJnM9DP1byLexa$+&H2Fn^3ee0LgYc;S0xO@?cMvn1WB+1){X`DN zJA;ag$t``gK^8O0%8ms(AIN|-OjPtAFQMgK2n}E7{^aEWxekqu=T60Y`d1v=q3#gA z(pROBcz)T5G(OVWDkZ8l%0eLN-f9%o!c*2z08PQ=1R?g<$%KVl0Sfw|Yzhu3M|#y} zQdgz45|MQ0Hc99{U!P~hQmDwY)jmE?ds{(DIOcQ8bCwRF`c{NYWKc3jswiBI=*mO` zIh*Sh61kjqpbHvnBX?fev#DwBPe%}CFJR|xC-sw~RD|PFB8+GF)P7jNyx3U5Z5Fy{ zOOXqx*@Da@d*8mI%vnTKfnuT5dD9qgfRc|@AFkv#`;^nX%T6|l;~-3FV$~@$fS)w{ z#hK9U@d0%u+4#*gwxF4OTkzyiw)!_SEd6bw>8?HsB2XzBs4xzm_WKVu_2xA2&~{S* z%h;$lVKAn`@>GidaFONr@5aX1YXJ=dK_@G2-jJYg!t{>BSXQmAnTq0fG2dZv?M7BO$225(0_i8)U&M4N+&2sJ4JJlpDoBm9F zDgTZFuRQ=;??4gFBnkH}ucfnJUU5=bc2rr#W6oJx?aZ!;(q>gsl9$|`&SP{=xR?9; z+3(5pDmYnnhl$97tY_Q@r}4p}`er(gAOZoCG7vK^5IylQEDl}Ux5~ywSz}qiCg;|b zJHPEUD0+<$HMaz*wC2$*>f)pqcIVo4b)rQR@}!EdnEv*Gx?0quHs_{3p1lt-P2YVA zm^u*xDqx`(irbdk2vV6s67tQlfVPS3!A)bsjfu!dPMW8yUz$SREgco*PT3*Xiem$k01~dUm9&t*EH2kb{Y{K0SR; zbs3z{V8#6c#_6%dK+LrY$6jI4QSR^Z#w$2@gwg;o85#K%r5A19 zM6xy))fnnl8oCd_vx%n}hKh1-8O++*aqyh*O{CmWCALZc@wybTt}}QE4XdEp<|ISA zFNv^&Z8ZKE>oRr#=&gL(2;5DN=Myt>0mNtjv@v#e_^M1#Ehs8EessSLB%9LEWTb}- zG-$YO^0r^oKe!qx?QWBZ?M&{SJ;3o|qkcKQ&E{R{9Ncx%z}rJYPdPYmY^cb4ecI&? zjd}We&RxH`c-h;qidc=zKepsXh&%IO*Y)WQ&CTJ?;82Ew0v#YVwVeUHz~^T!6mTG0 zM2CMo&I2o$McLN`Al9&wmL`-l|45>)V zeRw|NC66-cgXQQi>ehZgL>b^2w33umP+3RLpSkbnNd;nJtR}KY!)j`( zENrZTM8p1I05rzic8g9z;HDi@u+w;8^Avixc7R7OE5OV(YyvQ zJ&Y+H@4s`~+pCI-lA?|;F8IFTuCGXXFT%kL)%;vt(OhQV4=X|#3JQDjq)~_S*Zs=D z$Y_tmkb!FpG<4Z~WV)H7gippf3>kYZ4C{Up4{zNbtSW+ADQ(Dm#dVU;JHb)+(a}I+ zdoDI4b6X4V>&NMk`I&?C5z}wuX6;W=fszgXrg6;&H$WsDxi zHROi|g^2xu7x1u>=ooxm#L?-P?xn+L)A2aGH#6$TRVC^gx(Gf}H5&``ssr1+Ur_sE zEUIu-Zj$tX3d*WVRyZY%^3zqc3z0*+Ww1_6&ZG=S;-<(@((a6yS3@4aU07QUdwp4l z{@iCAd)H$s(F6t~55!I3{oujP{-~m&B6R^gkfDD_{3b<;|LSa*gcU2Cl^WK2SU@8? zkx$%$RUEO9^2>~hdQmSrMJ`>ZBo1FFZPk2zX!}D~SjmA{1RPv*DNR=&#+ogvgzkz@ zFZK*_DbUXn<>!WDKJMp6E&P#GnPj}t?lCzf@BS0?_4(rE6{ePQi)Xa( zNiv6I%o6yC_XZG>07Ha0~M zPjp={|5W_55zseUekh-GdHO*Nn@8K*g8jt63J%pA5_~*{ z0%Fs+T&R=qR`*J;`6Bxndig*>K~Kb&hJ zWwUuCRKDYs-ma}_Lq9$}DNwceIS4rhwzP0GIS_OKaN@hkU}SRA(gRucwAIWcrM@9ljf$*;sn? zrv7GiHap<=pNC$tdWhJtVJ9^ zQVzFx1<gR^>IkJ<=H~K3h6{;@(xy8Gs;M_nD~ztcgDS z18Zeef}YiaTsQ8(3=m-g=yhmqT0ucUq+-L)K&T*~#kl&?Ib0jV93x{Q90L0Mz}XJw zB1ENeC??q{+uV~eTcTnQ1(^zU)1HWX215uP zF|VEFDV4DF)QvJB`a;ccFGEc2T01pa>aU90PC8|*Y>l{NHjCIfgh$*dAvd%dV#;_V z1utt_D$s(IyK&^^l*>efd=q38x|R!0O5?Az`X*otCg2ybliof5Va^?q-Gx8A20}@S z#*MUf#W}ciI}_qg?Y4pj3MvjCI@xOQWpL*7z*&40BqlHsAf~2|VGoqk2Fm>iW!EM* zkRUH1RkMbLw#UZC496Oj-oMxM`CnkjqCwjeqC7xm!YFgGDbs$gA*XqAkY%Mgg6y1_ z*IkbxnnxKxLTsNk1Z{u5XHp=&NT))e@e~Q$5_cN-;h;4@PZ-quYZE69m^UYS`;|PW zvNgff7nL`4!n5YXZDwd#*nCCblErH=xe(p$Hr~DL;A5D~Qsom+u&*+{#29`zUE*Py zxu9`TPpzLeAR5j`6VW*rzjQq0ikISTCeUCxx8w(7YJubS^n(xp{qnHq63xTFgI7x* zAW>xsPC?gXX#R@8OEig-ZcLei34_a#6fizlrsTPv2`Vj#b;!f66$kLJ{95-eHmm>u zZ(sFK@Q>KXewJa+J>1x)&IOtT`>YweU;v~t#~e-*?^lmaxGbEr^o@$CycfbZ>UXMk z*EaBV2Jaw{slzc||5o-STj=PJ&spF{gzy5w$Vov_l8p~F0g50!aPXLY>0zRpv$|4y8TXzMYK1SRY| z7;GR?Bm5)RjHlh=nHolpIx{qM>O{mUq;{d<(O?j0=e zaAWRW{NcmCZ=xWG2_wEC?{=mB6f(K@>Vfn_$#D1*)S+bljl*}yDnWBR+oFpY1elsi zcKmbVs_o5)(W9|0m2MRE0EA#L{d%U0v%9ZO(f@Ja!4-SOSnF{f{cWWgnB z4`WfGT8|tJgl6o9KfnXWJolw2hf`qEa=UAp6_*b!7}$+b(89R){@V(5-XJ6})E0Kk zxX)jwJD}u9x3rYGe&Zz*#jyL5@>DMVn1;2iZns}z~Z)0Nk)yVdoRDGq$VOK#{km~yw}w9=N9fWODuw8c=@@ukvm!imihH#DG5Y|CVn>~fVc#)x z=|T)V`<-E^?#PzN(_>iM%oPFJ_mJTCw@NiAma{;fvch)W+uqiUiSb+aOa)eJQBjAl z?U>4_U!McDK#XXG`tNo40fLiqG=(|KgwklGXn}A2i*gwuYG@M`!ca#EMd|6-m=f^b zlEO6-^aOE5oBfxk5C#8fu~>vWf2@%LBm17Ej51x>nH`B_b`D4vBi7z0XFr$#mxyJrR=_^XhfUxOl^5#A6SY7i&h z65lgILO+{Io`;cvkjePwi!+M>NZ<3Rl(Xq7UQ8(b=-%|p&4~@f34cdj5}h2jpJYfs zN}8;w(Ky;2&B?}x&z&x#3)LP5HynEiYO^uV)-wceCoV1YKEq=wQFZ$6vS;uXv!!6) zD-gMu@cts;@xG@0E$R@gbm;N#;1eEIznu;Mq6`vCV#+-AWjdGsfnkNrgS zryan2MoJs)$mWaP8AvKChJJ>$jd${{~1Ae!sX zp*+LDEGyRa_5!Wjai^tGR9CJjhn_De4_40fX=jZY_e%h?>03X40?vO2a>=h6nggBM zf*_p8$&wYrj1ckE7a}GACuHM%>a_e2$oKb3B;9}i_3f7uAY+0Q;O(%vIdj?w=-k&YE8N(V9 zFFl0t*;pnS>Ofh&`ICnIHOKqMMer9spz$Hury>Wv-6TUdzTCG-AMum#ko$6gm(8_j z{d&8spa9sG9D>g~b6{{!QgksM@2~9>`4Uh3d`zR@ZxaJfO!r>G5N~Hs%n{(Lx>*_Q z!1;zxXP1Y#sE;H7?5Yw?eWtM|sFs?*qQ5>L9dJ`LZDtZjlLkH2U!KdO{*oonLYK{HK7ed%=FWK~Hsz{To=2n{UqO1BH0# z_3;qy1KVER^12bY0sHn*i8=yR!j(C;u&~f}!s3&V9UJ;}d{ruHLsYn5vCezS*CgKl z*~a$Zu&w+fju&W%7&hc4mvr-TZh7s%5GZ}0y+d_lqB|ID=_USn-fsrTuNpIz>QYAx z2t17X`4oJKj$6aXe4Vod?)!{c1blZAN5Au~iI9h$ppavH~he9LXzGW+O*dYSP z__cd^t#XsUZV1G6JnaS)>Ee{g5;M}t74*ye;u%J++9lGY;`8$SsY~})ZG;IzEHlin z0M>1P?7#$nNdR8zAi{HS5#Z$cSS0ctd;Wd!8DI*Td+x#e05xJag96rOX}+Or2%yQY z>4@x=qe01Cq$qqkmgq@%Cb%v*BJj9|a&w)Ye9GpWA`m<|yxOKba>IT86AU{jRkUSG zELl_GGX_Rp1n~T>O#93KqM0IdBWkt+o}S>dLt1iUqFS9r{y@IZ?Y3ea_11>lhVq*T zpb#N@r1^3w?}LyC{ZYDiss(H^-66h37I!cOU4y=vy7K#VDz4V%al7#s?MnpT?!_L1 z7r$?J%pXk=)RFiba788LV#=!l5(xZyYJ7#z@z8+hRbqRs@*!a0aA2>l(T@YN#ZO&Pkc zOFhV7Qoqqy!9Qn#jS&D#utVgu0_h3?!_jN9#M%mjipW-?h=`ubBBXQ2iW1oF)C%Wu zhX9~86yPWN0@1|#g0ahM)j<)fKh?{?@x%PBLlzN)Db#_E-AH6;q$DP#UI@kBiEipU zBO{@e(Nynj_A5EBK@EI+UZ_vFU{-7r_|?MzR5TKTzmx9>;K1S(?FD9`w< zp}N2SG5hkNu^=PT=&7=nmelN7$liM3&roR9CeO?WQ@Zl-wWJfqIF5ms@!8B*f|n@> zjTo(NOOXHgFhFzoS&R@TcF}n4Q2z7l=S~^Z|5mIg0H_H7^Ixb1xL{y?-06LYe!MKT zwz)g7|IdXe;!-MxulyJ9_c;Ia$14;Hx$L$9pV=mVf6y9Tnb7~a`@c{9Kld|AQ~iH# zc7yYO3`-g_gMfr={V&?Y6yhhy$GRpKf|Ut!i)H`wh{zhSEDr~bQ<;#hAI#X5P)MOp z!Rrq@4b%mip7xi6@GB>*2(BauGA^VJnx*vn{TmqRl1z>RjAe9Tvn1(*zVL7kKobJH z1EHYE%(t%wv!97Kt0^xpZ*G2QFq_Qg_eIEI94ZNU8Db1X(dPrN{zb)OcrsVkBP6st z5R=1U!9)wx-t5^Bxr*U`$K*F44k}as2MO~K7O{?qJwjbKG5qbA&*qrFPysFIo=~_1 zC{uzEEy+znfUG0*tHb0eZmf&H;-5kmH-d*$O%O|e@yxoPTqd28mU!h9 zzgRYl&1e7~m>9Hnh5)pFQN(N(J0gPRABBF5&Pm=bv&^Owncuy+2K_*w$5T121^^aw zOyQ}R&Q)(M$dzc@15Y7cq;XW#k^Q>X7(SNtuT#>G{>Ozc86O_CqFZ@sLnO@G52`(k zSojPgg+apT=*SQ>fymwd!Y0tL(&V;sw=nYhu1_#NEPBZ0bW00VV8dn;>8#!>u>l`@qFaDEW z9uQzybLt~JMDcCQ8mNYtSN6)y3@#!MnnXv-q$F$wc+EOoS1ywiXG|SBbiF^u+dN0L@KNW)0SJ@Xe2{Bi0bO&u1|?^7 z@E^~o4AaX}$dkoDB@T4dZyCIH9l%)WQs}Xk;B8EFI^ELp<~wDfKIgjOT2;*-rWcjR zzHh9uX1BjfbB!WRW&PL3wOT|J4a;I<2^nn$XtA&?mcXS?46GsUVA;qhA&kfjbH!6x z6lMdTF~CwGBddxx;7D6gS6LlW7(`ecAHm!1SfNe3_5CZyiTjvuvhB*m{u(W*ZD9C z1#Mz{%&$n5Bu!#A8*J&A6gn*^TPB+WTr8|IDq^98;1YaTSU1M+s7R@#l(f`TbPf6! zl|XfouCJyOsZ{hGs0Xu!S>N88!!VuyGX4x~MNABTvBe;7&LHjIP>1Dbd_O(5&H6KW zdCJ#j?(Vjmb`E$UPq?KG_Er`htfS~c8H{0Gv;8c?6(T1YF( z+)@BAGs(SABp5PSlyLu*lX;mc7@baoyv`a%9p`xI3iPSYZarYJ3pb{PV)V^G=$%;U z5K=UUr)AJ3uufy3Uuq%a?)`C>{}v;>MxCC|qDK!-jdHNRe~4a7-`p0*qt9$XSz$Pd zrrW;6zh)wxj*1G#XM(<=_VETS5`8R?Nx0Y^+I}k%V+;)m31pY#0dm$l)dzW85SKia z1Z$kmFrOGKpP6{lR8KlOn}`}3MFZ4-7|8pXn5;>};n4OdnY5I8G{19eI<7@YL&NKN zPn*vrB5DxJ=+;fFfi=8*n-VP2hiOTJOhzFKqW}#w;Tc0|=hIV^xG|=S=OC62Ya)5P zp(JhEV;|4Alf#A$Jv#}_HA-*0{J!5Psu~Ng_O2UJMss8(HJhyImAl%4BUQV?pe=V_ z@H^Colqq5VVv5AIfKE7ZoC8-fPPzDAcv(RS5@P!Om83J^EGjB4e!RG|cX0wLxG4Cg zRp-Yu`NI~f0h62PnjN$1*6%7bLZH$uPx=6eKnm?_b~}7&zcT6z985W&F>!Hq?U~{N zb{IuhC;aC+sx9mH@w%(`o6kS?{cin?lQ`jnS>kAB)=OO)f&Ve)5g_!>M8xCQO>6(Ww_m_Ww0<)3;eA~;RbJ)Pl# zI)?Y~)S~`w_F6dA$1JOLXGWJSDzGDv={o&%lC_$p(2RC1l%mcW+C}y9ts2+d}$y z-2Cut`h6V?n3Xb(tX@4pCAhF_?BBLFd}LAh9@G2HGpkv$;*>%JY9gD9j*_o`b5+52 z{k}4ag+?lcS)$IVM5gJM=c0L1P;`@rYYdSVC(1X!Yc6oGz}0#>G+NsEey27Sf|s>5 zw?%0Ihvk4yFDpIW+R)I0oJ>^Eu;T!#qVGrm#sUk2VlauRp3%jvX`@zik&Tz0o7q{_DJrn;zy1UlE%P1}rduebJWk7& ziUz7F4fQRMP+v_Q*i=i@5sjjc1;eDo=H|9E-YmnVM0>8nNv9e&pB^Qhv8c4}pW(!5 zcc+2yv!M7i$^b6@d`#T2SXa?|wtEhH?}h_lt_opx7wwwE;eSQMM5}X|J{U zMO3D}v9ZC***RWurb(49VR7Aqnors@OTyK4K$A|TGgibmhgS^TDEiz@Rds&Zq8Xfg zkTE=+f*vKqi|9EhWvDQ`n7hqZdz?*P5AxRdUeF#=nq(fpPDWM|@N~iWJ(ZG&g#IZY zrlM#%IV**}aHvKxGCU?loyF)^noZw#I|GAhztV&OsF4mq1761g`;kG45;Y zXH7CHtfpUO!w!)tl117>b<2NjtK!O9uel8DfoCfkNvs-b)t;Qz*(?f6FXGOomYHMq zkbBNq+DrzOK;bUT!ZIj9Ad99k=%LjcSUQvGD{GZR?lBhr~H66((B zRfBOf7)ojkIZf`ZmIwV-e1Bb~zo8wh6!Z_sq1LctWAD|JEt^wQTZxhtX30cs9G>qs46gS%Yfa2Y9%#|hueV@e z*)Kh)KQ^7sHCZj1>9%8eoq&*Y|Qx3A8RI0@iv&}ZY8us4-Aj*qN5-s#_= zAx*AQUf}m7>J=9gRJT5uzUu46cLlEYIUEKvY+{#*efHNs8y0NqI%Ct#Yh9HzHE&MP zq{iGXA`!S6r^l$69=kf-!aYbC;9 zUQhXbQ&%tfcN&x=CV4oi9Iv%^zNNsRkaM4NCu1IT>fcMR|5^>BdY%yl{T?oBda7Ev z5QGBXB8Qr1V`zl=IcPHHF%tQkk^FYd~v#a)cA3>SWSi%CQE;PzCO>5m0je4tF7RV8z$2d9#Z%+p?) z@z>-2`xk_l)>YuEaO=zaW@IRLmY`ka$VY=i-o@u1_xCpr)v+~Kj_VK8W8%~GP@$Ng z8JZUed>w8xg)qk7OM2#5~lT0vTDE{n#dL2GKuy>K8;4h1_C(f&F{_-(w z-wMCW4Ap}0Nd<`^Ftcu^dF-Nxu_*FvtwFe~k5|wpz;F?g6x>~Fb+-9Qbv!>(ACIhM zqpf4}8@P99btW5}=`;TDf2*eMpXob>BaI0SIf-+3=Azp`*~ z`l>zoURpuDI!zq}X^-*?6K z6zbAwyTev>2e|?a92|ZTlQfIBqRlJ&9%}Tl)X(ALJ!aKE_b|q;qB51;D%f)5xUVQO z`3EVf-Dc%&&d00S8(WDPL-sj~7W=lROLr;+dEM{751y^+vf0r1yt%8hhP&j@Kk=fM z&dr}EKW-;GA^HN0WbI~>n^&D^*X$-=f8Nf|tB|RcWpSmI<~LGbINzAsh^hqArC|YW zp4m4!Nx3X)N=6Oq1MN-}!Q$tW-GN^OU2aI;(tap%Ih&UTG;|~tgbX#E6D%(?khgTn zhYZHH%-_`;hRIL8>WkWU=V?+Ftf*|(4!rJeAceu{GC>lyAlw0;xJ6(FOl@lFQOk8g zkD{H>b9y@0V_PD&%lWjEs+*aUl$47KSs#lk+9?hFJgbx6)f-&N*?P192#`{vw5BYy z3yc3yW?=$phzkX9`SF4nr@@qCsb0Afpi>=<^aOZ5{&?T~h?4vZzCC&^Rx+vEVm0~R z#AOL|MSu_i?Z{8!P;Q`V)>6zxtSmVtNc-d5P+`NtA4y_E!vu;~RvUk9N6QgQ4F`Mv zREx-P8UMY^n$&PQQ4x{lt~$AF7K@R&W1y8rLq;Mbzz?wwFRS<4T6?-JkweSi!E!_j zo?Lc1kj)?_C#0nO@d}&b9uFHKxJL?BE&8gCaTer0WqyH6L`1X%sUXy|9oF7GqkJzs zjRgJ|2^~3|mXakV>mvvTMWlE#oI9aj!i8)O0v7>QT0p@5{*2SG55>8!CQ-Dncp{w> z904@~-XuflmCgN6*WU2frPK0X6l7FXWb`a{yXsmb^;JZm@p8>oc(*{kfqzoL2X9RQXeoLSkRnxeE(@IAC>HUc~@YXZSg91l%Y)-po@Jy%d1v zsgKDtW;hQuSL*LODeggHNS^*aN$!p=*vBM>NW4Y|l~mT;smyK{%HI`01$Q2DjMXOf z?c3?4{n(|#yG0)I(yn@|0v>)*bWsp76NUY>qB^ViA>#+S!??_kjf#pI)T0!NNY3%| zCQ8G}R5nLaGcfE3)t*co+zQ5wC;@7EB-f?URTr~68*ggpGxEG77E?LOdGlm1A()x9p4L%5J*E|44O3dK9D+u;0o(W;iE>z=0cyzoIrtc7{7$dVHWmVzmpzff~Hi< z&~8s|B>WIvr2FxZLEDv(k@|Is??z0^IoCR{`iCQuP{?xdx4`dygx@h!DI|Fc=!qFE zde%&47>O0*QW3$SKrts{%Q~6EynE4k$-6We6V_XX-Ltl_zXG*rWn^sdcu`P{cy)M< zj2`C}7Un}m>12SC4y>{h)vD;L>~_FF^{U`mJ>*P~7$1AEF*Ez8uZ)0m#!>8tMZJ$F zpyTj*JLv#Mtfq(BbpUmu_;K6$!QSVWg~a=}cIxqZm!gg$Xm{{eU>|VGhdO|3$ASeg z%Atfb8A~1!QOIKQ`}BwqxsqBlxty?kBN7yc(P28XpIZ0UlTL?zF_hB-{XPwZ@8a2p zDUfPv^gpsAG(W@feAv4hAw-HfD$&Q+$>C?W*f$}!)zEten?$;aq3&6U-2CpKq5a^# zF@zeo>08f%nV_PkO1Dip?m(n6#~d)B^iq7=h9OaIX4DVlLjH!byB%!+O#zHosHs78 z(l-t}IzBEdEtSq-`<3DUUDi(w_8&mjrVEmlF+2h$G6G9$>CazJ@h}Fz_w+Q7;D5x- z8KKF$uQ(;#M>x6(SQN}*uW!}~PzvNph&d2NVfu;T*%zVuqJCl^3B%yfQ&PBtM4@7##WE zFYLH&L%0_L<0EtYQS|?P3MFd9=4WNVJ}V>Z_uq%N%~Bt7Nc=4=x}P59Six%Op>s%5 zstmG8Y>^7c)asG^TS^w~5N``p;j?BB$=fY!8jv$eWgG0&22XNh7Vi?JwH;458s-+J zdxA;v)(&z-Wkk?E$C;g08ETxhs|IPRg(tpXACYoVhc0pv{cRZhzxC=~hfp7(mR}O%6I1e)gA>x7@lVg3f#9fV|Y`XNN01p~DCTdBp z=jAKZVbG^0n>j0^Q_-HRj?{o(6*H zvf1het2Q>Y^T+>K%*7p+-E{Xq+a9yaoQ^^nkDG%QUlB#K3`gWUeY89?ELsb#(S{mc0KTxenRIGeV!%QTq2n(K9SSnL?jW;ML|YVubuGaz_i6KGG9Lu4g9rk99&X zey+m0aP9((d(T^CH`m~7*`diE-b9T#1D52xT7lP}##_Y-V$7gl6GubQv$EWB1oRXD5@>5A|sY4 zdR13aSAIOtH{bp=f4*JpPr486+(fIPD}>&7 z&^(7K#h>taF`N9#m!+6%Rr`vX=WxoU$63N3MaRq@!-cMOxX7%LvAJiB=LA+3Eckf6 z(R!Sn2aUGb88Y{1SUY}>LPuk5=v5c(65zZqpnIsE=leTA^fhU&xND?iY+wVhM@^G( zwb>3kUXP<)X%vkU@{v57!q1g$gZnIHUxX7WdNP)N~kRZ03seU|uM(Yh$hyZ&sb$N5L=?`hRUPaSDu#2}U6v0Y7Rl6#`z#xPC` zd?)HUqFm2>uBMSS4zC=gWYt@94Pm{r$i7?CIz`cSi}Bu{w|o6T#PjjnBjIV!2iy5$ zD<$Ua$C*W{?CMKwnY%eoi09&9k~RvfsxDB=eOZ@!xN{Ue{fuezOTl1 z8;D|1pM>CDW(+pow=qQmMVDeX*)sRDUDx?kI7^0WObMGE2)l`nCFjMNbEKrG*z3dE zwO2wl$tNjplZ}!!ZMD>Q<+FVkY#N#@+mqA>aJ`euyAP^^_J=E=UgucmbyiQzksO$6 zm|LydI2r}|8E@2;e{pNZ*1PIuq@wtnOh#}SS^Xu>jJHd=+jsqi4rx027afx!zV^=h zSSBzn8;hNP{{cEOm1J`EYcf?sHr671??Zd})d1ZcPb7EJ5@t|GTqT#*Z7GRuYYa}P zRK}Ot_UQ=hy3OXLVx!9Xd>W?K6)5kFyrgIy6jsOp6+o)W8df7tb(Zz{5eysj8*3hC zx?qM=1phUuMzv{etqVsl*}mzM_%3W{vZjG?ibstHV~sZ{1LH%sOMtX?@c1pu{<4X+ zeR7mhvg)q5#jZfT=gKcR4K8R1Fn@7*X<~#vHV8xmM}jZDcDN4mu|vY*B6#)ArPi*l zzaXjo<|Zg_YCWUVrAA!x1oDYYdR5wc9YPFVg6>j(5Fpa|e#?C6B0ae2>gk(tw6icf zgLnAGtYrA@J<>CdHE=vl54-eI4lkX6{M(o8!5k^uaN_S}PLb=7zp4lF_(K;SXEFN@ z-V-Ov5MUv9Gu^4HSwn^mW%O6eJ>n0jTDGs9Pg^3BdXwPUjGW8a^2U%_>-10RN}`PD z5ylK)y&_kj;2!C%&k7I<(-9X-kQ^?eGLMa;oT~xlD093k{wj#c>2c zMbk$&a7Ohp$?T?%8ja36McVAI!!-0g)rD)Xk{+*2YqGQ&NUKQKCF?GA-)wUsoBXM# zu}$aT=hU&re)rV$#ExUqSx4Dqo*geV(lgm$T3_3Sg}zDwgHZ2TiUP56f79erUtdA1 z-hM(so)f#+gh~owpljlDe2NsUdG z6rWajN|geN;s@r!m$^(1KcY${v2kTwWj(+Ds#*m6K+B%Gd1B4wFgC3g{FuLdeh+PW zoxGbgM7||pH}sgfWwqt>S!L$coAk$=`cd62BfDnFuQ0EXf2bFNAs z^-UeLU`Q}kv@aKJSfv!KpOWAKcAK}k|7NbVuo@AuLtCv-Ci3Ly>z+!>( zx>P5GGn!*BmN;u2TV)xAJ3OQ67$AN*c6oOFK;@v_<$~^9JgGlQYlL=ioxrez_@w$M zBdx+F!`9^dRNnC%YL%R>S553FdfGDk<69`WWKLt$V(iiAPnQLM6TSpy(d6)Ycj^i5 zEfhcHH$RdVz=Rau{2F zOmnq8*FA(%yE4--6c*%NP>CNwK13)rhwj9#nQlD z+^}*D*kD>K^(+S!ZUS$VrfDPg`A0caLnuY$*T7C@jMs@jKCNt7PUzEO<3lt>Y{FEb4cTJwmbz~Z{Tw74HBM^uFRHJxw zvCEMZ?)0zS`2D<66Lj%0U$!AeRIkn%F(pCO$A#I=cEy6Jbvu@#{k`1T1ud0ojW;q@ z>Ew>=MqhtoVgtHsl>Vk{cS$QHR$OucitzXlNIPiL5tJ}yt36#*nQ)VRXk1H*ovDz zO42<%i*+BSeJ<5K;`?jd+Q$`>T!+mRIJbslh(-4}KhJd$W$>7HGQE=Q4_$Ee*5jed zkiuPx^Sjfkwyh7wRk@QKK)LDT-r}om+9qya4Y{ zr(&&98~BuYx-&wAJ$kVG3_0q2zld=uQ6sgp>Kv*o@-nRKm9pyVo8kR zDE}9AZy8lrvxE)e?(PsY!QC~uySuw2xDyC&0fHRd-QC?KxVyW%eGVg@3XtRy1KgRdAe%zNcRSrjl69Fh|xCSvu?j70jR?-)=Rg3;e98z1K<@}cqLE7 zvadVVWEybjkl1WA;& z#QkVRNF7e+KFPxpqjS-SG%f$ZP)q!%@F#2o#F*wws{NI0S|<$)x!1kI<--=OT@^+3 z)htlm7Vg!ZD}3GeJTocaWMbxT_$uvC=k|KQY=GV=8q zNtB;Z3hz8`OWtmJW!S!d*_{G^e4ouB{O}ny5w7IS&AYgnE2wYaQL0-v=_Y;p(Afbz zV#(Ej(eW!BU5Jy?2qX3QU?DSW6t4-Ib9Q4#gj8DDp)8<(y#5ZNjoM}7tK}!my*zN! z@DcCTXpgnj9qNv;oX~R^-rvF^`pNUTn(4pXl8yGUE{7eDMSrlkg}J2-k*kW z^L10jL0UJ(bnKPN%nt^m(FtMIv9*^H$nWQoZgO;Sa4K$fFQu;dMc>X8E2nQkT%oyn zi4LbKC4QuVp!2Lj5zvJ3vw*FVk&RoGsg|)TTjs%}NIuSC)i@9y!^pHne!bh_>txQ) zI|MA-VXnhe&6_XNNsfrTqn7qB z9Lj6cbj-w&(bDRn<6lB$TGJWR6X@wHcw7NxH4!hb%61)95nOMqk7wjQpaHg}go9+$ zSjKR~eQbRw65F%hho{1pit)cp@(n1msx%_`KxemQWeJIvx&-18e$s72^Dvb)=G9li zwTN~%+V055$f8~k9+BPKYx|WM%cqECloMKaql;NTRZAd9>7}Vk#B)UQ>rbZ1WYhH~ z0;0F~JqDyH6RS*&#=}hlKW%N1<`3B$WL|VKKb>xO+vk0vsHJ&^MMmZI4w!SL8!s9WXK2N=@~gp z)zmjvPc)R2H8-E%O!1s|z8rMXpSU>&rwIBbLKAL9Y4@hHhP5*K5z<&xeg<1(!Fp zjPj|Ma{L8^SIRn$-OS}ZBnQ@~KYR}%-ZKer+T2^6#BzdVXYBF5tsjf0r;u;pE$Je3 zL(1Mv{x>?ju#!7!LfZ|I_K*azBhbUHGdwhi5f*{ymgLib0!sqE4GLELKi5Owhv zF*yGHBDUdJA~Q6N-yS0z_+wVH`Y`lJZ=c}NSSOE+;5-89%&;84-ok&bA-5oy{&;hU zdxL7Fx`|L4^>ynuv3ilmYK?ePm>*&`8&b0jcmTJg&00MceQ#2H@}z97hCJE*I!W38 zY@W%W9*gPdDGHl$a+K?VN? zTp%D$TiW0wJQ-Enl9D+-+21oEE$_#cO>^t<@XxdG&-3^dAq=VOIa-i6)(&$E<$E-m zd^I#MYHx649bwxI+h{l+6kZd>3Rp-FeSDh)JY}{*Lv406?eLeMhSx;%eB!JR<=0<` z$51XVBED-;&)V(nHn>+9j!PmltHOr!teMm>c3eH}v5X4c2csd7*5adu;3-09mxQYW zKP1APg4zr=J_awq3Le(d8OvVd71%}KPKPaV!b=yPK21qF|73k#8^vXa^QLVQ@Xl*j z_=VBesT`YSok;HiCZ08t_e9->rJj+KX?~SCNpCd~LnqS$!@0SV3VxP1>~zrHh2dNp zcBn0f*oU)-3k;Fg#>)=p?)us(?`}wpHB`|?T{ERY^~NwbLcIHfMRp%uxf;_kF~xQJ zzl%;5zA{PtVu#M;7qQn>!bjpZ2oKMy5TV!_ZESba96@$cR&*E>aeoucGL;hfd5w2e zU_>cM(t=&GpggEGkEj#Jaxm=*pK1Jo^`a-55)&$3$2y`U?)gC&SFs9_MjRY++FLh3 zviH1dEXMKL|G0h>vS%GnlrzpcII}dWy?k$$`#mYu0nK`(m2FZM3gST;6pYsJ1QT@a zvx}tP2bA9dtRRUe-##s*I^c9L&xD5n1*i!ymES?Z5Psur|3tVRf_@zsB%NqbFpU2^ z54=ix2nzb9+b6`(aJ#jXkuu#1ZtIDuN^Y2T4wEb8ZE^t@OiYZ7jJ);*>ms9~>Khu2 z8F6;(?d5;6GBYntPJW=Jq-8+L1mNPMk6!ool3M}lt|PDvZEQ;0+Q46*L$7HG25Z_Iei_l#P`g9hXmdqsGk8`Nwb+>qJNaQd#Br?Xw#WZmgad z%{4VdRK1OCYA(b4Rd z(<-Z^Bz(wZ$_3hqcX4@{hmY^NpDK`&ii2dAOG-Q6R1)Nq$TekWUf&_UN2RS>*=T`s1Y!lU6)pBHD_mNypBo z$M&Izbg#`TyDO(xb{leO93CWbRjaujr>2hWJ!n{cw9rt(C19no7SO8mfLm(MY+gh- ziW>;?V6Rxvp--kS_Fb*;=+@hefW_XIWuSgF8?;i$sH`+_S8S+swVn7;7Y_AD8A*eL zf@viDczAdwFVURI4iNGWDwROwHQ-(YkiIEE;}YJ*3_7WVbfI`vq9Q=$6cp?ef)a@{ zhn8xq9N20Qlw0_Fy}>1t;Wc9(SQH~P7n&bu;tEf-%lT1JQpR9**rzvu7Q?ZDS;3(g ze1ZB6O8f-b4yEPpQ@On})+VNpzBl6x{hWb+9v|1PIJGivRu$UluFeBrB%NqCvYHUv zY;w54*AX%Eqt~FaI>*~q9}3HyVq`tG$ys?1NbIH?N@75zv~t>(m$+>0gbD{oOY1h< z91{uV*J#qZi0dxCYIEe8n&egJdS_-&bFoSmOaoYpGvdZdl19H9oTqTutu*?ap7b3{ zLeAR!f-}o}-CSKBh$7^3*&5v)Q5TN8PLi2Rc@zPAIU3rAj?QSM=|sSy5%@5=Fd8ah z{spJj{E0f6F10N+T|#=j(Pj6lE(OjMkq`k2{qX%pup}!+(nT-5`sH>VIW1(QTrA~b z>f~XWdEUfiH@8ARUR9yk=1lB5G}$z_ZFr)WnTkVtGias=e(J8ie)y=_*wO8(xC%W4 z<7MT0akiJ67+2ho29Lnsg>Dqj0T$sEafL)c)KNpay;O&PS%eFFSycpZAC&z>&dW{9 zI<4@l?5LA&baWF2bMaEFK3#GEA-Pv#Xu|!)}73)#;2){1eX)vhM z#`lwphmW;dSh#2orXz4FtiKjJ(Psz=CrC4UxGDE7fFkaHf$TV~l3buEkcXgD&$Ppy z78lRksS=?~?8|0Zuo?D02~_rB;!2&3jhf@;Hv3f=@R@XTP6y@{6x8es=clf-`}iA4 z1SB*A9zIcAQ8K*5aSRxaU{SqR=gp)@aSW|gz_)}rXrIfdU&6O6xH9x9xI1RgGh_M- z;R)bl`?JaeIgZ5>KVs&>0y^FZ0IC7aF#^|3wAyXZ4YQ*~GW1K~4vP`y(U_R5r53bj zOV>MpXLBpzpV@ptqNT5>C>K2H*3<&FLbVBVxj> zYq~swav|r&AIb;L=Y&P=+1Z&Zq?>^O2w_YpTp1{#J_RJFZll+1?}CK%K(4DzRvqhW zeZ&dfB2OfEQYm9JwALI1Y1e1vAv%(~rlJH#LA21y%#Xe-b%j@#0WB3<@CUSNxxuIC z;sQ<|AIzGPXw~$M5Br3J`FfZqyNYWT$vz$O1jJp-^g~_ynb`<~iorE+^4cS-U|K<- z7%)NqUg^0YafxP_xxXOu%FzwF7GQTeX{h$hfXh-` z#<$h_6MgH}Y2yTRZZhhQ*3QVJe*oX9SahBh?0!Iq;9w;*9;kRC+(wg}B< zsLQRW20O<7BY<@%SO;s#VQ`Abp{Be~2v7~I=4E9!JEjMtCLJev*RzCVLPTmrRho#8 zp>W8N2@?M3o!LzDf_X~oWSy^rk)nZfeo^_K)5=COJhO}^LqlPmIFnIN3rH&5(T6ns-A%zcOj;~_CMbUj>H0YAMwIDe1oxO$a_(B9 zcDy`<=SLZuC=o3!wE-M&ir$r1iG3F=?OxY=wu{>NYW3q8TEu)eDb?+WNVXpiON-W)dY+>(W|5gDRT3{P+^^&O?_O_m zila8+J+&XTIcl9Ea>of>5#&V6xEGRq4c>=>(my>}gNkL{;Q~Mxzkd%>1BW@V-^_6ljI+CAvo1ra z(1{(|dst|qFq;E^(_zGAg5M* zmFZGOE_6~6WVFOeks!%lM4b^O$@)M}3MzZ!JO;rXK#?k3>r^7(UVWfKT?{Qxp3@{A zS;JjUQsT;gt)FZ?SW>YD`{Kd*CqfBHf?ixavbLv!XvjMQV_{*jwYBvpE1YK-6eM(X zye=!F1AYuR`?C=gRygpEu1;@R+J0c5D64~ykDSUuoKX1s)Rcen)|d)E%HM#fN)AM#R@l2#T&eMr0A^>kL;(qX@+0rqDnsrL7=IULW_asF*c5>yPY;Yo}`=p)8( zv-~=QEv}>qb%2nsW3_8d7ah7J24%oEG41!s<_%bku#K>o+n#kKq~L-{00uKI5LqFn zQ$9pEO1bU_evVebQU)qc=570E_g=(7D{08Y=f#OW{iE9;|85&5oLOjprqVi(G(!G{ z$#cr}kiGw~a-kEqtizJ~s(6L40pnU~p}rV=* zllcIF6pb-qL$(9qshE5_lyytV#_fVNeN8bvKhs7+f76jmr;Ba8WUfJLh&V_xt14)T zI+~bIZ;3mE6-IRwO~)r9zgwt0ycbrLKIvo1nDO)|BJoo%{F;`?=ciz*@{0!+<2E5w z$x%!nQ$;ybZ>mT+aZ$)P0~jhHLC1KaN2$#-Z)tc(fOfU%m^WQrUQuA34LiO&C3VDS zia2$KU@RSxHb%bWpFi1K1T!abyX7Ir8Auc-5Hh(8CoC;+FWt7Tx@D}Cu3*e!dNyIg zC)F9=#lq-QwfQslt%{A$iNg01>WjOaOwRqG!IU7z7xL+gR@-#vcn48+TE-fjSuGwv#N6v~kiZr)BM02FrT_QIqS^QM8EgUT5<6uIg5=5$`) zy2{q2{lKQ=C{sJF(OH@X9`XGcUPR})VZA1dWUUoVb+65r-G@;f^vGxSGgRltP!3aK z46MBoy|x6krGBFcSdpWv(aNA?Gh6SppyIt=X5-wtmxHYBn4(2?sAz=K*C(x#+Xy;p z8Y#Q=AM}OiF0PE>QsX|QZalO#6mnmw(9E7+6Sobb-;|h2{$)eeUHWkUYtQR|kG;eY7tACc}eyQHL3A<1ImZ z-ZZ_%qq&LGJYiC5g zsD*2R$79wTY;~kHwp~;qA0Ye({W|IT4@d~-AZynewCOm>>Gd{aQ1TLgy<4u%vGJ_{-V+`0N3WpfJZRSabfV1-Qp+ilunBM%j zGH2D9n^ABua9QWs+R-#9p5vcHhv*A0S2GUV=4+a${9j#b#RkMwh*pL^+Iv5)eB^A4 zi0T0f;c~(KuzoVItH1j>I%2`Ay&%s}LZ&<}4@>D2YuqCjz}DMXg_@9q<*Ik8)Hfjn zit=gEQoAh#@yg>YrImHfXFGod1mX|k)B#|RKgo`K=fg`s`6Y(32j0`yW%uE zBkzI$C$pNGhKllfI_m3D_iT!H5=HLp$h5GPD^b1E4ZoUl$!VG{fwlT9$D=T0xNx`~JE?u(H|P+N zHiZD8f zblwiYP zK5AXf`lOW_w4cSGpr6Epf~CW+@U(c0^qcgWJzR~xNw}H!{S6rxS^i_5Q4PSp zaYm=vmRHcw&@j-@loS_P+t_H6{}_76J4**bBN4$;(NZ+l#a7ybDo`#~*$uu)QaR(Y z@;fG`z$s(_j1E=BWW~UCrRA}D=$lKMskxZ1S6&Q(ilDh0<#v=-Lj?fN&WS&p=2KBV zL5o>9QJOh1^3asD=b;C`WluVcim0EH#C&XwOAsMPy1PR{j?PxRfS5us1BS=>3R-wp z(ll1kPtcT<1>)jCKRznKa-xqx>rHa$)NfF)MC}CyCH%Ua1ags%Z7wR-7eqK&ye%YK!Zf(3UDe9+ZXhs%zR=A>av^qCk`}c_#(sVJ(IhCI~ zSQycUW|OUvh<7`Cm@dw@5wamfUC~;WU%hN>z6QxqMk64PjnbiAHny*=JyN`MBjlIX zdbzpT7#QHNJ&o@4c5c9=3-)fqHueQZCG1_zGGKe7N<$n?t*8hQCCfd&pn=i>D>aJS z3Y#+yKzXvTFefiRTd+bsQHwt{19M5C2h0zgo(%NgcWww`{Lar$Q_}SH^ioSc(h#Pn z7N8}Lgu%f{)0ppnG42tzSetO=nwS@0X{ZfJqo?~sIAAb|G9y(O`&M2b5fRZpXNMKN zuAWliq~DaA-CUg?Dwv%;gm~++w~OuUdM_t4Mw(VeO9#{^!h`dae)>(UO4GbNV-{(X z7b8hSy)T-xCt&GPlyj=_yO;^T=ujQ5YitSAq({CZ+SC12)R>!pP3;)Wg}8qY1AXWr zVgk%4xtS&4V{M~z#^+vMqZU1(KZZF(`!C+=RhBz$EyvC(wU>N={4^O~oss4-ZqB^t%xoNxw;A%qgzT zkWP9gcJ`ny0|lON_V1mZg0ieYaD|t5)Tl}%;7_aM07Qmn2v97?-(U)mN}%TA=WlOp z{77Kka=}SZUU&`efWsEA3PG(s(}G1*@{s{MydcbD-O%H!7hX#d;KZ)j&W0H6*6VwG z)g&sxH`1eJQ#W2cd3j`{;GF5h8Ck(Br6!uzT~Ql#^?T;f=I&jEj}{ANS<|>9@Y8{! z6mHCsayg+vN=2;P#(^V5_;?4zc&3i(NeE9^)UP@u&_o0TsQ`c>BTlx^pZ=l&2T2YT zouQ4G-=zL(cX#)~LXt(QZFe1u*F%rJI86(s;<$pZtK=7<%nW-?S@^wlSbFlJHLc}s&Fz@pBD&oP@jKc_0xYz{B3g<2 zn;W|`A_}@+Yq8uVc4sn~%t6igt!=!H(#0H&KBm+EpsRMZs3O$QsD-TjiRJF%a{@&e zkx3W_MrP-s+*i}+sX8m#9%79;a-PC@DJjx6QtW|4XXkd(vSG;KQlyH9d0a!kewC|^ zwS~v=4I``glaYG81`HJJ|2VGZY@Mu+9Z|O%ot(TEn^N@tsX3>iuH7J!OJ_(GMq~A5 zq;YDid!cYbT?iEjMs!uQ8Y@-f63E$`ON)7gMHh%ms(QOC)~B?Xj~`$Jj~&^SIr|>s z0e*<(vIIZ3Fe}A<7ABoiVxa;euUKV`Bpvo{S{n=65NxOb86afby?vQtMgM1RnSk^R z+HV+%pSshH*U-=q^_9!kO}=|C)Xg%-aBpEw!Ra=cHn0cT%@8wo(l1E+$O^kIA`;o@ zJ5+GUg8#NdHC3&vXuWq0?0h+xYu@yB|IM~*%} zeCQ_xM~=ky3L-2lkH@RLnQS<0YjFJFM8M)>4g5%nDqJUm3-^*hoAYb4z6@4!NLBqE zbBerHQdD#p0^Ci9i*CJZ0>;JzYr~gR;r?P8>Sm9p-2@fd7`1)-7K5sVt}Y>yZix$i zn9$Fn=v(o7`N;=|66=k+i!*jvcN^c5eI{t49jV5#=baPw^PnN2i`Lq9iR1B3_qWg@ z68!D+Z$FZ@5IG~<-m|M>@~X@hTs-z5K8E4#k?+9;%IrC~@8khU7&!7;8rULF2gE&Q zRciYkMnj{%veAVPU4mko%FeX%u~~*Sn-!)XB+7et$91<7v>8E^m6g3^=309|ay(tM zGn;|x$EJnt2`NjynF`8SHAa`2(^4yEpyw1Drx9W2T3!4c+s+BK1K()_(xE_e^BGsn z6Xq|r35)pe>fJ+NgiCA*l}=ojmo;0^RaG{075@_3oDP^~N%8CbI%8c}uBf#BDkDC0 z)U?dPGUmuJDvS)r`H(xsM6#G{< ztI|?iIbF<+s$a$U^W|Lb56wKwYrchiEFBjQXQ$Zhu&-mL9Hu*|t9rwOD^>?77d321 z(wH(Fyv`263dTgi{(#d<|I$?bYT3QAtz=MFX;zHkhPS0pAl zSU8H2pseHbev=@t0Ybo-L@9lwa8R*Hv_cGVU4oDb9El^QOpE^7UX}IB@g$RLC`(M=+zURPrsJqc(rF0p<8%dl$4CLzR&z9Ga@}bJ+`)| z6Ka2)5pqTt+Tb2kLa_3G@pVDJKRZ5%pbhBX4xkwPF`ghOKo_Tv0O){#L*V?q)Qk0( z2?GIz0s&cw%RFV@XUljXbp_tvfd9WZAf9NHagTd`hv@6ONWi;ZLjU_R19>no1Q3u) zj(8|J(9|2q-0;TpoEpu#U*i&Yqc>S#MuI zhWdOszjlwOn10o)x_74a7}hPEre!hpD1EV!{aGkooqH(NxQ-2866WnYsC^(+l7+2a z_nYv5wFhH&)_J#?0$hzUa4X72pH3KZV*MU0_PPLWOg$BVOu#?O{c`366jHB09Smcl zqTUZprD^J;R~!agCp#MaiM2)G!N>xK?L(_9A5p!ut2fK7N^~Yep>n&kKupB$Rq!QQ zuNxsmGgc{~4C?*XdMUk+lr*cPeY96lU46Yax1KP5 zM!nHPPA>ctfo**C&IWPE^WE}!ha-ZNXxk}bp5EG97HE5Ov~!%J^d!p4O<{0A8ZdaW zcc2ZZQHsZVIz{fFGQo6j=A5sK%mf=!6gvA=PTfHN{<=(@;Td>;@7#8UoZLI9u8}Kf zZ_dWXcD|uOs_Uc^lyUNUS>em%3@f@SOxKr4uO}ZOuiEVLL@aRPh%C3|uo!AsF*7@J zqT9M3iolOZd~%G7La=eLqo=KnN`S#FpL@OV(?Oqujm>#|!VM~V+&ISgvsWD}>q#na zzZq7bGH{k3UTpOIa`@7Ho>yJh-yW20vIH}xNQM2$vR6`15M*tZJSZoBL_K|lH})p< z&Pin!`bNbKhn*WQ74|h%-(%Z?_lmTCJI}Mw{>Mt-_WR4Bpn{W>s-&EX4jwfZ-^^q0 zsDiS%KtV0iE!?LF$M^O3efz#L^g^DkyvS~{wugrcZvk)5lL!^dV@A_2!;5m2(4jKF zgm}^~-^`HZ?TO_R)ln}g9=Q~UxGZQ-G~QX@(dh`=R^Yl`45*&cZ0OkPoIV>*Ti8s- z(nmR;zTX{Zj-mn8%;mlNOPV>oF!(7^dOFdW95?qLsA4X?ImyiHc!R zabYE>nt+Ut&>KBG=&UNRiodBw{Oz)*q8#)~p@XViY<+%nUE0XQ3GgbdoQQS~8GiXk$}liQX#Suk|GU{Zu`E`P<9|XTd#3D3a?r^buPPz8u-F z&$>j)-ZY4c1X1+|620B>z~B2VwdVSIy;j^^<{5al87E?P`}1`??hU*_im8r{_!4r< z?_Z}l=Cr@L=nJW?&MJ4{cfbfLfBGdOHKfN!j@F$Q_|&Y&>v~mE@m6kmmpZmTzby~gdj(Vo6RLPpj7cuX9vqOPjTeUWns|BWt@{ORqwWj#fE2_sKFy`3JLnAp{0 zoufgeEUugP{jK3#uk|KeKE(c<@LLbi=(l5}U~Eh#WS_UcaTkpZ=L{s=@$#Knu2gkvcZH_jPmy{PJXf1}f3U`U(}J-Us-&*Eun6==;~3abjP1 zX*x0C@(doE<1~>Zo5um)cXOHa4V~JAlSOSSEJ&`)_lLcVK)L{nkkIT=OwpYDqiW)} zyIEtF0Y=}3j+f_-M-j@TqTy4X5143}DM_jPEDQ?D-+|HmGbL+*O%Wu{DkBl8XCV8AX=X zvHOffVMwoZE1%cx_KgG1Ht6|w9*0j0BeyN*J~lZ0*RaOV?XNA`2E#|+AK-;$pWC0g zsmsVI2RB>RqZNNpVT-)H5)0HJm8FMc!Cr9q!Z6zB@VE*{=V}ggf?Q;*&)9rv?<7Y*8)K+ZDV&B)J=PgR15tvPdJrnvg1r>J^I!}(y z<=v-Q{I7|>j+Y;m6Z?@~Uv3GV0~!Z6&fo8_bIkeKJ??$^JlHAu^)|P%dX&O&Evue= zULRKg+s{ZDIGRQmMJ)SBZ(fgkJqzEz-<*8r1yCjf_jP@kf6vC?f>O#6zU*pSCo;~+ zrW5nuF1s>^aSy>N3cPJssHIo2wAHP@-TP{EL<~k>zmC7ZV!v0;B;JVuYo+*BoE)&X z`Mw@FW5$3~FwWSeak*%=mu6QNSAQ1Xyn0L-UQ568eZCt|1Zyc^-|pymYA-GQ{In3w zafXMvL*aXW|IX@sT`?T?9NqEKmW@B6pY>^#^ZES!a{bH@P*_baU-JI6+#m_5O7SV{ z{ZW5ir5-W4Xl225&qGP-sz_MCQnMXH&at@T?EL-lU9Y1;SxN28DCaq`!)KY@KhkO9 z^{8e2dgRE)IsWbOx~g|)rbUS=N=JrCHYGYzhpTU);P^!p zt2*W3wmtfo;&Gsi9N;No5q{0`e!c!S#>UDtxcKt^vb_Fvgogm}{7m3ez#Sa=>F%@7 z!&62FfhCcq;I1yh+55JB@JI=M`oSP^n}cg($7?6Dei8nn7-X~W^(;rIsXwt8YH0i2 z`~CZEhs|oh@QBn7JptcW%}~J)Iy^1jq2UvQmA7bY$<+GD&6)io7~@UZx~`3v2yuh0`ahqFg3-nZXtE+et!0!6ic@YVRf z4@nm<8K7|fpufw#^2rUn5X84bnepSjE&oFCiUspI7l|kkzQ^h z{gWpT5acw3OV7iB6=ffNbI(s~7kmLqsqi>#k-{(6hFzxS_+(1BFVEIC(L#dU18a|t>Ejt9fw0c_&#yzKkYDLLO6aS#;emnRNy8p^M< zHmmibpW787T8RROyh;!PJ~So*J^l^&YFyAYgXOpMXWez1o^_i9O(!EOr_Ou*_c0c3 zbxw#b?ak`-bgbwR!|FNvFvwDegPVr>R08%Cnx*23^#Ge*xVWZ04zV@3fTqij2;6C7 zsB~sZNx)Jsr^gA3w23t?lTr73w8MCeQ=@>P!)5xo2Q{z10c(w-aMYR9AvDRQOfKA0BmAPYK;4Thg0FT_Y zghiu+6!;nIRsxCGCmRzOU*P;3pm>V@4tx9>7HofqF(CZN|B0Y}2PIUX{{%Pq|AMFD zkT}s)TMmsc^_?>w`#1fGzk?~%ck~_Ou;lylwtqx36MW$?>!m*0h+6!fkQ+61O5VkR(%f) zuYl(&JV}7yFX(@c%m07+@DD!Rl7(rr$pPAI`J@i?k_DDyIQvftg?oj%MYv##KweY$ z&I*{GlQp}{dKBV)#dfX}{{tZSj|~>n z2pl8?a8$rF1C#OHRKth2#^Qo()fYn25xNL6HJ`Y$vOTjtVM0E0D?LnM%h{) zdl5H4(U+YpSFsm~QloJkae|X%TI|_s&{lQGWT5bwfI+LtcrWwbPs^Ffs7tiTdY9u| zj%M7TbA5F>2vSra{0Q?qsR6}cFddd#qB?|&EfOE2Y~|b#AIyfxam%usg1}u&rLP|- zkX|6<|Dz2xZcz9Qa*3uDb28|TFhAi*Tl`wFe~$;prr6?uCsTebJ6gN1tH>baJ0ye# z>F<=&-(w>iGP9eN4egb7gQhhU4-P0Vapmu~Q zigzKh2qp3^IVvG!2P$Z*8MXzcqk>28Ag8BWjBrD>U~(@~ewv0_Je;=JJIU9C0E9 z+9^?dlgS`=#5Uzw3#VN4-+I^kn|}Gb0%ImJb4VLTTV&W}YpFXZ%a1;BPl$`ZFJo>v z9w_HluV6-5d{+f>9S&9e#aNI)p}qly`ts;szXq+3Y2l#0kX?3#H}R{R>$M(OBgnPi zU$B?^f8O4U6LcShKAP!mXjn($cD z2mGSg)tSZQ-Gi+}ZQlN;DT59aNd%Zm5s-gKC1G;`LH)gEt=MbwVM$GWxi_S%-Hie zohi%@)HhhX6{*1HsFP?*FzO z75$`pxt24VbCX_^b9aPFM+Eb_P2k@o?0{AS><{`zipmtmiKA;tr)BLLwHKpPmU%vf zw;}?3o2Wbj^ABff&~IKqu21+*uhd8$Kj@s{Gz`Pmd_Aj_2M%-L;)Uo>so)5tKNk)EO~UDadiJR*jL(+9{hxHe^=MI=gXeqQ1pyaI>_uG&KzzGXv&FvHxqyBMf`r{O?F6wcgkjF%!gMpy%V) zy%fgSz&~X-uTf?y46q(uG+&_%V*j3DWC&YD;0g|{ujKjeIR_5343rSxLTu})I(6u= zAs!roMi$893g4O7Z2ih&!y>%wzzi|F&VH82r8q{{Q2Lfs}Hk za&oHW4C=_j^dCp;x1K5-K8X2+^N`;3_~@!b{RYR4h{6|?DHVg8#fpXe`fz~@3Fv;c zChxlQn%TK~5eb0)K6iSF?BZ^NDiE$unQ6-jDo_3+apH%w>2HRgbPph`Nu;l(r=z!; z?#uZv74P`pj7PycYYNAF09|n;CJ4iYl14ZY?K|_QD{!fmG7K#8y`|Cd>z9-s0xOf|I1Nn!C|A*{9 zk^F;;L;XKGtw=Bza3dpYCl80$M@L8I@&pYoNLv>o8Lfykd|ZY`NDN2MCPw~VBig|t ze88qVmw_C=r&V>w`(@%))EC9~y^yy@fB> zJ^Qq#{)5kRS8W7D?B?4KOtH!e^N|VKjPVf}Ndkc0=N>$`>7KZ+-!puF{&YyZo{tyh zD?zAN)9G-N+f0w03g9Ui*QK*N!SuecyqUp#7AMb)8tS^ME&aUNdEXO$=g8~v^0T=4 zDUXGUIE80&A;tC_lkx)-zad~4>$W4qpE1#KDvX!`8Uzi3OzUd`PIK(ekJBKU{cEdW2w94xop?CRn%~l-ttDNpf zpY6WHrKMXrn9)(I#btPHo@fH_r_A&0W?Uj+_qx`1xB8?TOv*FboZ5;VF%W;l*fmw| zpp=Hs6?#qS$vD2d#iOh-fk6i1+;;jcrNwU&n|Ebo!BM?t@j2gYcQq3k(i7w3c)Xu} zY8w#X#S-jY2~K5-w6!>(CWo;{Tw{_?{VaG6L>c85DJc4O0f$Nj6F;N*?qP-S-zD@1lnch! zVq+3w6Re4WoOH6q$Mx8FE_bcs-0VIjWv22*!br_nBJZc*fbWq3z5G3?Td`d%U9c4@wv zOqXFr2^~05V||C;P;tG8uJ4?SBCh24GrsKpAJ*P7xQcCS8(ncD3B;8^+})KBH$vQv zxVyW10))7)5O;Ss;_mM5u6)ft?8AP~d+t}aZr%Q~s#Ybvdd?nm=rf+N+aABB)*-uh zoA?N>;22<^&~UxoO)Mu9EF{M2ZCG4<{9yq8G7mMkz??g*U07trCa*MTjU#^P;d}iR zn_h>;{9pvZHQ#WL8ppG4>za+qG*M$`IHl$W?U4RqAF))s!KWpVC0CZ~UKIRx&UTsE zxeBH_T(@wkCGTNSmi0l?&PtmUwZ* zLi^R8Nl0e@(htq{=XjYkxzEj0Z1t0h-|Vi&vkT>SWDX$*zILz;5|Fz!SWBfYd!LS? z8%M{F41Ig8fe?*KAkE53r&HpDcv>;;nqf_|zjk2{Fi=(w-0@m{uAIuR#I{j^^ebW7c zRj0X%yEFI0gRo(S*?@lY_Y*Te5S07tzsqz65ZYr+-UB=U&gTa2b@YO&+TqsT+Sb0y z`j0a|Wrx}J&-HHk8D1dI0;h*ZLoN{w9v%(z32)Dz<{w-e>*M^)U0Q53>9QBT;Id8S zd&O^wxH~+m9)!loZ(Kk(yN|EcD;0Kf;?*()?>Or=4tPIoQ3wrC0Mo3@5ND#b6hATU zjW}Rtm#kc0q8<@o-2SR7rhgtnWQ@*q*hmr5J@0swZ?oUP4+}EEsVQAsua{zBZI5d$ zXI&ewZWLctp1oW@WJQ&g-7&`Mm6ecDxSeAQ9r@s?bY zLzDRYqnNGRsG}<~Ya-k@_Inl>yTF9k_=y_Ch>d||c>`2uYtd7&UQdoI18oMZq@zRc zhfZPk#m~#XC^M_kb@yH?rg3_DI)!GCyOZUEWf()ml;Zf)HThVl6Rr+QTN7q^g&Lu@ zG~{!$s}mdw@(UiPlAS&Mh}}e&xlhz%@qp5d*zA&Kf{o}t*1k)DXYUUx2UGCVYWv1h zCFxpjhzT}}2vmDY6HNRYcP;AdJhjtxQb87g0HuOS&fQBsp*&3+~MD0aS&-@YSK-RfAiWV=-V2DiNy1XFK(%0b8 zK&RW%LDjOfG;8vBwm3-GttiU$eM_C1L*-1z*o<>kA+8|5Gg2E(r%VdF=yj{AN-i+C z1$58uQ%at-W@glLM`XGjMOe#=SS#(XP0YmOdZ%o7f=fRgkuzRbLvto9j#a&Mie|-5 z<@fdsExUZTZKj;P>PCMr{d0@On8!GQ_x!fL65E{|<|2pAn~$*>!|^jCAw^W`VFD?V z==Oz@VQGLtZPiu)Ak^Nlzl%Z}6C)sOiu>of6V={bg8j7P;-7ozD;U$x>U)c0uG^78 z5jF8gKaXy}*HrxJ#E#F3ZfbCNCb>V~2|k4C8t@bOw`UOM6fgTHQ}@umPH*6K+`1gg zE8+%taY|bsl{pyw`-PjTcx|`nBRi)WJi7&yT;?z}o~E-iipaOmZ@)Y}Fq^{!ztV)o zZ4_2bJ8UBHwthizTffx)ac>`LEDaw>*~xa3!^{Gm=q1AniYUPv>e|}l4fa#h0bKl?`;`EpLW)Ba+yyp2HLaT!b&RwCN*#iauk1sdo^DCqcdkLMo@Im4On zBTZ?-ep>$A6QO4KF?HEegN!$>_2qh?6pn`+ORhFOb(u>|2`m2Lw5K}{vfWggKOXFI zWTC0XfV<$ndb1)q57Y1ijJ6#wVK0P?h$yMr{{ED1%6etG0>hzLJ{hy-q%HKg&y{qv zBqzG$hX7U{eoO|X=XR-%XS^zDUD+M-#1nGs)1$scny%f8bMWQf%2jH|Xh>~|_FxHa z#<0`R+aZBBr*8--A+L%|2?`Sap%G329W6=!hD4s2MiRRI%MQDgi_wql7J zv!|N&zC*=3pSc{QbyG_-5uRW2ZiCmA(aq}Z6TYz~3A6zB z%#P?!r`20%UzL<|NpZl9HKpfV ztxE$tYPK0obDVcf$?-1i@RE2=ek-TM6NJY+DPQKja-tP8AnpUS_ae-sHGSN{FKnDl z;Vcbj?(gvZR=*bB>-Dgm3&qA~t#!Mk9Cz6n{m{Q4`jNxSX!nQgN`TSKl~VT4$A`0a zTu8iKvjV3rU;g;ck9BTT zjE1zQU5}ri@4<}8PO`+HbAoqgR&ZbJ=fF4S_6GG23^d*c)t7pE9$Q+|F_g9qBBK2A zyPpF9^yZwy`ROU8@er(6pbQZ%Az2Jn%*F<7$tn~zt^ogAhve9_n(c-jcJ4@iHZDPZ zyFTH?&2Ovy#=`nmo48c2;|B*p^%kN)ad#IwPL%9}^arG1Vus=pT5F3v59jC(@Ry{0 z^8p&_USlj_|J%iu;kaw<7RQg&#u(W&^Y9_YkUb6WS23CEqU&vP}*y3iDaB2=HlZE6-2P zUo{xf8-4N<&p~oO4QF9fidCAbuA6#V;>OwBN-78|NOD8-RGM~K%s*oyc68L72tZFE{%-XE#n#@?yELqtPA8`q&O5W^T{XV%D@HvMP$-IBFePX2F4~9UtOiV>7qWu8DJcVQHufcjDmf zCs#U-s1lD7AKV~FSd?TK|`fh8aybQB@`ks+_SOGxMgUV>e<<$ zjR;Zf%Tjvt2r4uFjZBJ2MO&2(_@MqlHpK0^tEX?s{6!Iv)?ba88y70$M|e%swJ^j% zn^xV(6Sfps6;fVV-d}8jaRrsE>r}VYGhdM-^gRm%Iz;;|vcOzFAlnZ*q)nIos~WHb z{eOcU{RTY!D*{9Q{|U?V`=*CQAZNB2qpi*CZdg2Z0pqh2VgBc@R%{si;2NZ)2FiIjaqTDmF=B9kTUxN6L!mLjR^2S6W}226Iz{m1 zEj9G7U4s0d(WbBauRXi|6NA#$yo`?z!6+z8?*2|kzY)0fURiZ=e;Q8d9@QcYpj~XtZrx6zq@p|satkH*$WLunCT|34~PV$d(YE<6` zcR-PV6~uxc{2x8}nmxoA!#D4~}k4}qCyWZyFaN+ebF)>lJc*i0{{3YN5)*>qQ_Oz{Hn_rM3 ze06)DTWsN+fy(C=$R!=V)`FT9s_>#XflX<^uA6$KKGIU9C^0A(`OF@#=i%!Zi)$ zgFWd7?N8!f`p#lXB`PMc)DvoncZ2PnGo56)1yYPc>xlDL1{MPua8 zKW6$ysR!>kMbW2`D1;+p!pJo1o9MbbW~Qckx~L{JI=}n5`mroMK6pn8P6d_L_q|$* z^oJ2a!||A}XRKBVhJr#PI5AbbX4WzCs^LMwu5`b z`Q#)8b2TU3;%ex?Evb=}mv1GI=7RwAMrN&>8`+{)%g zZ}Hn3+1yo)q$Jp&-Zki7S$seYfirc=^#|6eYyB>33>Fqvm@gfBv)RO3DA*Yj@)J-< zD{}`Pt8M3x{`2MQ?CR=TTujN^VPR%xuPG~gvkw6(2MRsE@KF$}zcQA;#kegE!t!{` z>8B^$y(YD9XfjyF>C1gVTrx|%89G)W7-36LrkYLeiiJuhA!2&3!^+}l^wSBeEvzib z*c_Ni;K%ybblb#X1xKOl7S#ZF=nD3 z9i}!C{C+C?lUk-%Iosb<RJo;hcyvWs&BPJ*($?KD^|1UiwmmSoScCc$)mf zO-09!N(I@ph)^Aa4i)4f`p)MSW~BZPqZx!*BRdJQ!^!5h>lQURk+y~ZkR}KwgCIuz zczqfo+FZ1&k97BAOE^j=I7hZ{RP7{1%U@xZIYlU-HXjL57 zbUfUV{_qmV>{NenHjK}bK_TRz-Z(5QwEDPq%+Jlai;}fwn=1zRQ+lAB4oXM=oxA`+ zEK3azNxyg@i`bYSkp1kt=BT5g;HW0Gl8`5s0u&RVRp9#I2Kd6{)ef4?v(SpcXr)Te zlD3oAgWS+sg>oy&%@7qnwaXT?KtpG zCA=`kKi7Jc*OxpAXn)XU1nMMfgp}VbwO8=f@$dDnw36M+&Az(VQPPFNz>*p ze%dHhn56|+Nqz(v8yN{doiLWOW@2R(U}V;Pu;ReoGQli%IWl4hT$61ixUUA)7NgIk zieF(y8*PMik$0JB=j$Vl4sZsF?dL5wy;4L)%lhk%u8G3QUh2xu5Mr<5 zYhT?w;x8ah#)W$&xrsTi#AGEDoy4n0idaH}(g)+9>vCvIYwBq@xO$d4Cl(eKrnU86FlCzju z5LD)7JX`I96}y6Kt1Ncf>PHb-W+)$7y+UK3#4cA7t*4+C1oq&_9z%O}*KyS%2#95} zcRm~jW>K8X^{hedmTa9dQnN5$^RPfJaR1f@u>AOz2{jLTH|%$1g+pS1uHpR9*n70i zzWlk0x{aQPtWEy4CB1FA6q#5V%)?CLk+L05%oB+tx$LAFs7$Mdx~&P5K2*4aVIwCu z7aKeNw5!>M6XmaUT8H$+RK?st(ia3+vGr~~(Jh{fRD;@heuIwy>wM};xl8vMbarRv@E8sYkHD-+R*%4L;ddY@W58DTc;HnqpLnuFK`W% zk0roKWAw$Ao!o8h40lK-(rb8xfVcCy&4~!wB_2?8FNbpXa!=q&G?s@pyHY^|@i1U@ z&?@0S+>;mIoxh*_kZC0vUgE3{VXQ`YxJdRE8ZQ9xc!z-oT&9+;&GUyQy0L#Y?Jan6 zU`k)#+`gueLxOCZo+|*^?+Uw1kx-QS3`Vf>*bCic2={rzv%;TR0eb!Io3=JU@&4PD zu!@<8ZFb-Bn%VLiBw0``ew%9!mFzAwo(o@A?>=qx zgx*XHG)t_335@hpR92?n-?qOv4_7_KBYnAg1Nz@TQ6kTyZcibsmzr~I_AN_^b)yQe zc{7;9mh196ADV7%F_O)dVRVhL9F;v8MLA4sY2|b(GWi2szX3Rp4MLa3LdhqbWdr$z z40t1knVET@$4RpnfzoE_GezybI1bzh*&L0<**T$W&rNYzMmX z#8Kv@mb&()`B6{6$ZDrCL`STDbwpw(Z$*+|_T4sGj=z zvF?b^XMPl)N3J>W5*H@OygO03|rd+M6{#p^jwSU^5%hW4znb`AflGR*9nKcuE- zch(dwuY1GoqQ{yw&v{sur2+LxoAj6|z2}F?7El?&zfL2BtftzO25e+g07VfBR{K_2 zd8gL)eVi&J+?D7(cR)_u#T|`uPEe%(x_RiEwnk|9)1Y5o81$b?Y@^^OsSa#`r$%;X z{i%-kL^87^d!7f#5|9vH_2r;}he>gFw#A!L^AT?!n)x*q0!xyFL!uC<7VtIjX3LZy zwA1!ESSoXhtPXSC&4!8yr?s3$$cFgXT$yFDC@Tu9UA0Cq_D}6S(=--#@MERVKj1KJ}hJ7sW&lK_f7tHO)^mVTG5MsKbZ%ne3-zPMkB16SD<8dJeXub^_!+UF|s?i%1D%=2a?iF3K!{ICQ|RS#zgSr1%R^l z-@fl5r!>k0?T{kXd)w4Nuerr&*GpPa`yYGz^Bknbh^OJsFt>5eM~)}g5fQmvU(<7u zP)hB`7{2B=t(0Sq^P|$hSiJ7WQO8qvj4Hq~|!ys$;6bRUVLtTMPiBn2upDm%Rd6u};5{_pvC*6^O zW3}*>7=mQZ5%O<{0?%Rk5` zvi?t@-!RCnUW&a|YQzUSaVRSBD=N`TYw^Dqdi#FkLqLh-w-UF6G^@{hF(AH$_@37v zM15{7uzl%0V z2q$-Xj9=QlFm0&eZQw>=JT{{DlYH%i*Bd~T;QhV+_2}I!ZHvSAXe=xjK`0O+drYv? zD71avsAzwg@c*S`qb~ZhZd(Rvt{&bdN6a?^WP2~!0zb0dF-|S4B_V!MzaeHL3OFzq z+1-QLOT0_sblc+=;JEb8A+jpLJiE08v&$P+LmRe-Zn=oWs%DEZp%RH?St!Sz^b|CR z6+|}I1(fp;W9Z_Ry1BOYG!U?PoW-{;-FUWdK2}YBdShk?y2a6GhE9@5Kt+6^4Q3X8 za)GF-Naw|62i9%TEb-rC)gGWG;CbYa^YVa%d==U#>{T+uq z9n$M@-MLKN)%JoD`J%=qLgZ$o;%t>gp%t;wJ}7Eyt9j%STJ}Pw69ZX+2nnI>yPL5`HP>DQ6cN z3pov_Hn_P8kiBV%Y_WD=Pn671c+lw`ZJa@=^}n@~_iGy$yowd1{(u)huze9^u!vs^L^9u^biWmHNU9oeo5nf9j%*{n_pw2v7u0-$*B9AL0RQ# zwlKFEfZY3UzzGjhbg#QrYDpE6v5zz7&HHaeUC@O|%9;X;M&2+Qw$jpR*N?tMX%JpM z^Qx26z+cxAdqB~asmwNk>?y;&7zoqm_?+$R>>M24@w(r$lC^4HmXnh3L-I0*@=zYQ zi%*|~EEX1TKS(ib*mDbGhQhsR!-s@?{1qT&$)rT*I!n7`=(r&6UsYB!me$z?OX$xve`1QAv1QYX z9_`kyF?h!Fb2DQb_6LtJ)g=3)`wzGeq*&6q>R|8dA9@XjUpVDaQNfDlR&%HXca!Ri zx@#_J^6_csU`;vC0Ifm-eRTO?%VQ4Ff4pM?)ZQjIj#?Yk)1B!3=8r?ca=6qtG}c7) zUj&pW?ZKiC=hAC?iNxhC&~Ds6XF?HU+cVGB*4E0)%lrEJ_V!F^u^Q{@LaxI|(LzPD z-tMf~a1uTHXK&SZ)rl>E} z7BaDc8|M~YqZQhXOn_{^k3~a8Ma3S9&^*^?D1u~LF(eWcEla24f@62K<`nUY%SK%; zI*<4a^p{s8fU1G6OFz(grlzYXFDU36nXjj8D^u2Z(8iku(6;cB@z7C^a_}-u_EPb; zHnfnkaq0Fk$zk@wj}DeE|%+kCJBiEG|qhTP8-lZcB=1 zulHR^WdxuQneA(j>@$L^;~ObBY?HZ}n{8nK7GLKY2>wb!h?xfQiY<@|OEwiQSPU!v z>;k7J%>w%@NP8Epw;oBh%0k$IKFhe zU_(WP?VwACp+w$iUH!~posRRtjPm-W^K(D{rwhMDTDr(y5wbut$!OS|5UwxU$8RO_ z{3n~+ zE(v!Q9eJf^XFzV1v>rl7M`6jmU;vqR{6;xtNz}+gjtzJj^LQQ+y4n1miW_Y$@k0nsc+Uw`!0F1D!>e%{1?@QmreH+E|(9aIY0 zs~#2ip-OO&qp?PPJ<~bNTwkX)+LxKMXKJ_^H=DQ%7Z9LJ%~3skXAJ>_$yH#ly&4 zOp_0-4W(L}-#atU^yBCS9zl-ON{1imY@E%}5HcSmm`__ZvGtVvB^IqibrV!)rJWR3 zu2`f48*|tJ7Wsn(;Zhz(Q)GEmp|y?jhc#9wb_NO_y0?lehX{#J%lb&G$QlArw7O^Q(=i*f4+De7{*X@qWjqHKr6!=4>!*Qtz^cXD2!vdUIE-6B>5xwfuSlPWs z-@@E{7`l{U5&{UvIm$GbLv#6qb8FrhYdD9rCTe~}5fmE|hAe{K4k*ut;4q)mKi&PlOK%2S*V8z)V2bTHq<_k}_*O{Y z9g!SF+$>=%am!_TAjEij)d)w>2lp6sO8NK}1EH*TW{eQ87AUkXt(*d{|bw)A0B-SoxhB%O##*+mAoNNH+NB9;!&b@{*-#q!eK`d zZk3AvqBVjJ8y$|HH}-)>zx;QYV2i*SFHu}d>*QG0oco68W&B&b2FG_kD=^TvGQbBi z5Si=!V~@$+>%@k4O6ayXMzPWsY{AI7FPkBLm#yZ}L=Wa5)vNGUx0pt+rUh9<(IMEF z1w6>MK3)&9M2M3$pP#B`ga%oozFc*Nfbar*3}>K-TCQk1+2R zp3ymQW=>#Xk*(UwiUWNTWn;o`#`z=!5aG`?Gi7v36UBTJFLGv^^N^rb6F4BHvnxk+ zAnseHz5SEn)j6=7tQ6kt{Ug9E6oyqOnfIy`$6nqeJ_2qK4N z77^A~++up@$jDB3c!jPCQK^Cik|2J`>-O3S?;6rfbm}zGb$lN(^wpcTj;2?unW1Et zDmHRt4oe($i3D-(u?ou!DY*ZXXQ*O!DXDN}(J{$dsA;Z!dXdu-lC4>nt6n9$;9rUE zNFWZ!nkhG=5LlpVPe@6}+9x`@I~~^01@b*4PLe*+{no~|!&EQ>q1m7nrVyT5x^lte zhDyk$<|}Bn4MRXQh|?e=o)K$m(+Ix6K|KFWit#Hv!h-c@VqzMbnDBqjp4c;ikMFEx z{~-VMN{6D5=XGpj=Dpb~7*s=!i;}FP?A>j^6B$TIL1O7{^y0cy9A>!q%g@y7gltp( z;sCLI_OT|?21xO9{IcJ|G{ZG7l^`G=fp!y~zj3g@+d&9d=;UY6N&#pUQ?)3{W;b_7 z?^_VYjEMqRIo7wZNjaO;VK_MU4)*Q`r|Aou)L2bu6tOm=WH&_kl3}BJQBhC;Z)$OI zF{ltRc*xT%30#+qLhCZ~B}ZlIX@V@-duFUgp4PcS^?LE+=9HGF5E}W;&RvqbN14tl z`e#iD?G6PwviTZZIK!t80`T)@qpIp7X9DM1o8{qwyQZO4Vb1ef+W+`GKdF2 zB@7nYrT0%k%r>Ktd7*7HFwZzvmmxl9ZLaSb3tit{N5|Sec}L1XRIyCMN}nM;u$HZs zY;-nMkAH+fGxd;mh)}!b&JFRa5Rnvy>6N9~$55Sj zw;!$3FVG*zxV_7=N6(aS(p%R}vP%thwdEHQ(9owQmmd}t6&7Y2zJDL>KS%KGOy4hY z-9H@i;zK4tnORr}kHCK7;pLSkw!D7XHITi!9I53>9(V4a@KR>rsQJLeo$53H)EX&Y zEswQ$hr!Rf*+~)!wrC%I~;kVd92dpP9J!}lXqFNtk!&C)F5wX;#-&#E9v;eTe?dE3d&j_gw9DLrR6EhYj4iS=73U0vSO{Y?JT~G0{GoiX}S>AP->e{?y0mhu{&3HY! ze0h885Xft6sOyWum>iCt<_dd$M_Y?sazWazLU22tZR|irGRRk52XS@HhGA-+m$cBN znsYKZX0L73OSqTnK_0i?{1Q1fLAp8^v)1`JX9YF)Y8c6`}2@ z?4&m66ahF%|I*UG)(mvW75(9uIm>LUW)f)4D9MlP`NS}+C!y$D{7Lj)O0vI)wlHI)XdSjM@%OL&!etE;@}Tu?9BT( zVunr;iKb0CpJs*b+8n7HBjJ}FzrWJVaj3tHS#hjt#u!MWY<4&0y*iI-dTUB;{nO!D z5KFHY#oku{XeWaQw7{G`q;w8*@gmX-LObac`&zusLbYtqJhZ<|2o}vBvvf-=46C$U z|16Q~7kez`ZpL%8+Za_79}~!Ie6KB`FK~n`0i@+^j^e=65Wh?_P;PsqcbE1#6K;rb znsnU)x*^!nS+6p>L=}J84dBpY{;{qeRB>28f|ADkDD?SM8ET25cD2Nk?v>J?Dt2zN zKi(U}#In{rPCBe9TO;su$6gFr^tqxaIXpsxcwpceA^#!S$YNP*USM-5NH6XS223Zbt zgEu?h-Um^{eIx_iAVB*-0NW4nHvT?TuwB6|$EI3SKOUIzo2mD-Ln=N=hg`=1EAyO7 z_7eE|eorBFnEAw2Xk1Qucw|C^V)r5zYzXV41=OK|+&I9B9t3bof`DEBM^L^F8`*z( zL)}7iR0w`a*~E7{w)7IHOC;h&QyX+|{W>3~J)zv5dx>A|CjvVLGNV825VaY2woVqc zc65ctp@W=&h8Q513Ajr5MyN=PG2NNtYOLJu2YQ)o&{O}hQ#CJ;2j_4o`n25*Ghb^y zpPJ1bWgYM;q$rTOgAdatUHZ53o4h~KSTSP3oG8Ki0Q0$km#Yf&DI-?~!`#;E?D=Z6 zm>@5jjiylIbd?sJegyXCAGMXP^sVa#H=*vPfmW=(kQx8d<#=$i*m<^B@l*|uR|RORBIUBRecDd`fF>qNj5~5ksxWU{_#!)8EwKlnVz@8;?KXlSiz{weYe6J zwq0=e9M}#|bibZr5(Tk3a3%ts&~ET5bhD}hMJAb)BsikDXVo<+(SCbyk@<_TEh^oF zYg|Q1n~`6S8?L%&&PNFYNy~wd>6lGN7*vFXG>32aSd(7SsqlA6O6K z>yf0OnG?BLgG8i^Z+Shn5{IDKjN}{z)KkXipO1z@*TNlGS)j5i^VG0x11MhC-#eKe z^jnZ8$$rfmPaa)&K$YgJkrA0Hp(#tukSs_F8ci{Xce1qR6C5%*OkiTF4xvs=?NqBX z+7norUY{k+-mH!JF_{y^bd9nT|pN^1D+CdRH9h( zg0`%kWaCFNlWb&}f|cc@Qsa1|11+EVfOn(|ZaZ1azt+XNH`>L`N?{T!M6>KP6GK|n zfi7WyC1oRVo&Lu_z>;E+>$wt>)C`{rW?r^G(mX)()823qMLEjrHmO`=Y6^TT^me9Y z`&!>bnZyEmiP{2qe015%FK%M>Tilo)uvZ#Y%% zsA$(uUj(g6pXd4rf6_Bmo2=COy#3{ef!qki>D~%+YP)8~nh4(ljO-g=*o54OliFIz zAcM#L`bSfTO$Kn9?CJ!5T<01s?Qz=%H5OL9z>*g3i|uua(kgcVdGz;LyoRMk(`#vI z>b()Eo<1T@?7WM=!PI;rbi^2V{gad_jwjUY-Brf?=VPp8PQ_x^!i5E|lAHh$A1&rL z(;lxNM7;u|8ie^y+P>2V!?-Lp+PCUM)8JjAm?-aH^E;gKEl%L1r^so4D=fGy%e0nf zy(ApXd~@~msWKvUu&=MQkXpqxPkxN+E#5uKMK~uZ6gVwX?ab|yjg(q)Kl)WGl9~6zSK{?>C5y@lmyGOyV>J((rDkRy$8E%4>)b zXU!|ju6pBL?>P8MM;Gowvz#{{s58fK>kR$!jFE5WURhHlyGLIdh4`IVIaMiWNKr5d ztc!lkGk!$kiAh!3%*O)zwjC{qx zv9@MVSOjJgLwj@)Oz7?s>7JfcOxn#4&PFPEsf`pUDa1muuLc#!h`qYy_Os=Dv}m=F zWW&h5(*D4_kX4arYw{Xlpa_PI)=XP YKm9k)9q{L)mUtrFDXvD0xK(8{- z6YPW-+kEW+CPOS`iYQeaPonz)&b`WPc#w+uiWQ@hY4y~}l_yi$>&j78k;JrjS0QH5 zpuRPvWvEBNSq95u;Q2*77qXdIB!yPoe5;=9n~<{;lTc6a1niBioqw{AP3T&f3beAG zY^_PWLSA6D;9i~?nw$O6*3OqOcw1)C8ecF79|+g~EGS40>-IL(^(6i*nq^F@Fw6LZ zfn{sdBxS4p&ahT&^GfL4c4>gUkYxet6gOP&0bR};(m0*5qjyC|4F%^Au!zHT2D(dHs}7v-Tt4HXoa zS(*!9ZrD&pv12_c5cgV@(oHI;%+G?dQOgn^Hr5sz*H_|$u`Ax=ljb91K zf~@~IaI3PztFv`^NT6%1PgHHZD8bt%hVnBk!yA?g?TAfcc5#63HMOk3>A0kU~ z+jgM0u4-0X*u?d0TyZj2OZwXIb_3n%7OI*H57sEppLgu}BY=&qNo{c99aA;Tf3;n6 zT&Odtyn1FbfJ35RI0n-`F==+Oj$D*dN7MBET|73wTn8~xaPJ1A4OULvkv>u$9P+yr z#Yvi*jIOV-GnF@TE*`I;g3H;NUTa{ah~}&^;-Q{o$FVZwI?O+e?6e{!w^*1PO>&XD zG(abJ>sG+%oYL^1@A%A4jc~xkciPl26(17_db{0b*ZcbV9uJd~I2Kod-EwRQ7oj!j zdv5|AKPchjK?LtjO^&9$Wj3|(t6~3MRY}U0ED6-z?b@Mj2c0^ z+50Sc6V`@RoqMBFo|l6N5{d}H;ZB^qSm6>`@_iVH_7fbvh})ZvWEQLxO_+=8k6olj z<|_0}JF=+74Ky0JRAFLdF=OirR0j74=E>M)K+0U>u4E+%U5rD+j=pV?0 zbiiHGMI|YTfA@=RTLbD(s#t&p05QA<(oO*BjP)OMZ`;5A14!ijPnOGazg~?@`5!Ki z%IUWwS!0wYjdgCx<5;V9su=sQrQWv}zkr)SROairifvRt12h@#i&5mvEZ<0UFbuam zovR)WVtl#J58m{NOzHQ>=P*PG-Q(56; z=c+`%p}h!p*DzCuk!6Pko&CXic84Xl8zE_+q9o^+=FGBIywgq#M?jSrp%V!%nKZPJ zeDC0)juqJ+a_uay$dPA--VFNOz-adAI-+xj;*N*MEeI9)YRf1GXm3vAbGY? zjEUcl^kvl~fU(=gRx+jtproRSpQ;9mtI8bk%iN5UQy3V#>0h-%qDXu07yO|h%`~8` z?=-qT^oRsgZYI%Z8I5Z#dNa`5 z%h8yJX31pyfS0aX-=tP3DG#ZHd=$9k7ffxN2!k7%#$S5h1MCqoy|h>$jH_$wK5j}{ zDnW_$z93ZNLQ(@9W1fMfh@raOdp$#aS(Sm!M>`>_#VZX&roMWzZV}HcKb3BJnP?@& z(6ne7tu!|m*_I5wce4Xq@Yhx@hr+^Ttvc^cL87NAn`v=an|A>5HA}d;OH(Y4j`1DO zjs1YR1oV3uSJzJ-4k8Ky>7C*-A=lSu#im$Q5~fB0#)=ggqM(;j|BmfcixTh;7@6GF z)#Wb-uSH}WW83ww+D>t>#TJ?xoTPPIIxGJ^h~L34R|sV{GrxZpWS4UoYBVb3ZuNinASyr{YCo?X8E z_O#K2L3>RzFHb+o`wVX^}NY$5aXN2@4AHr;vbuud7UXBJ!+%H|=)8}EjNg8lTg66ngM6uxfD>8VG78VMD4$ng-Fywv zKbr~bC`7ZC(!@Ake1aQ!WhcRK^safB99E|DVk44lgpgP6WL&&4@QkG$cLTGcykY*- zZxu2x;AO4PW<^g02E$9;cM*TGN#&5ygw;$O-q(kFNXDfi%=UG~{qy&s{#o|+E8;S? zHBT2iAFN)p3@Gk*)J2wiy)W5ye5~4{a+dY>+eP+R%qz=yOAF!H1>?$BZSUahWOMn# zs1ldynL&n*){j`eFMv!;V<4m}C4Vd}q)yR+_9gbd{wJeje1f5MJH)S9Md`B*uJ^<1 z;@x{=*9_WqF84zl0((<<0MVQmpiZj48B;7aJFif@;oOalUmEb~7Ad+yzmRBp7be9_ zqA9d-=aCi@`=!3PcaV4aVQV5RO@i1-RZ3~DeTt8ixTS&-@BleDNfqzf`F?gi&SkPo z*#~o&D=A1MEg|iMjArz5N4t|_^)&7~IJ^!H5EJbo{hT<+>5a`ssBdkZzQ5hRc5SAl zgv{ZLjhmQUo`~$R?U&fn4Jne5{ha2MSgmEz|ERBoS-L8Wmn<-`VzYMGos?F)jI5D_ z>$sB!wtgq>QyLu8NE9Q1>T3GXwcI^1wY<0-JFJFaS1~}3oibBBF=L98poL@Vo%cOK zUX`C`(NynKuWGXqw*b{+dAXradTmWj-ym}~GsQR^uiz;JCi}SZcnm=R zf!@^r_B(sXVQ`+Nehr%tu7F&y`HQy0wUX(l&3_rQU8Cl#`ut~_I3lAaBri|zyWflOd3afi zN!_$5y36D|LRn5Gr(@_oc0oDvPR)eSn5fg8!?Ealj=j>8V+z%;4EOUQKQ3>Ol(^X4 z4?Z!hs#m-o?sP54a~5*ZG*WT5S5q@B_mLkY_`vwBCZqVe3~c!cz}f!m3IWJ;{(3z? zXJHD~me)lI%D!sSA@Ab=YT8(RUa}zB(5Ib`Vi7+t9`Ka&gbr#Z3%^NDz72@#Oc7{0 zF*JxOo4E;{mZKsgkFne7xvJ`j+pp+oT1SKxyM3D;kvz~RK0rsE%Lr514jwZyD&yrR zs`W`tOeVrVl$7{@pN1iQj7-o!n0>KRz#~$Ezh`Buy!|#ZET+|quCS`Pf>fZjDy$FF z>jwqhuu*O=1+C1%fR6 zF9!m+oM3*tS3u2dSQdrT;c>E<#yCnx#Z4hE=gszGEKeTE+aG#D5G4#ztu{yWj;UPC zHnsF=b|`)CQ%Ph3;ZR`piyYQ zD3MveR*gf{OAL)bp~Pmly`n;ERa;wIBgu|#eK=%o=riR!<{jBOvF$8Kf5$mEl++Y* zJG`)o_v_3s8=sjdPzVZ+HFhZ@o@`fa{d8a6uB-M%{`@M6+c<7rf8wc zme6iZt)r)`c+bqjzKf&t(&6_y+oJyN72&aiRsApr???&*u*&KLb5lTL=1`^&sO) zzjU2%%E$OPyN8DauL-qOyJ93r7so%zm_93@A9eOJR7DLUQ2?!Qe_cHAe@H@h$Y7|= z5iqdZ^Ii$gnT}o++ zJA#JmLBF@A75K>Qn?WD#*gw!O^HL>9L$Wl5$MN`)jE-(8d3+p3<_YP^(a!nXo`;uJ zU3^^ruJyuRXgku0svd`*Q1^1ZXJdoD=C75rm*&0E8D|Y@zz){fw4#w#aDhS&lsA@5 zYqgP((vXFnTA3B2&_z}{)@pHj>X{nYcay~u_bbdmhtf{tb6>l*oI{GYnsk)?ywgjx z)at0DzCDjg)tO6gFr7@3{d?uQy}x6$2w801-<$D=r}8hw_}91p)+m2b*!=qH{|oQ@ z|Gd>RFJuIkZ>MiO<`E+A>*!9Sa5tY+*y7r}KoLGb`U;Or{GwWgwc0*Zc5Ic{=tbAi zoVw7^l#Btl(Q{`IA&~xCY|-NN-);rn+YhsP$#1rY!rUJ+Lg6?i63z1kNaoXGapFjG<3ya zMTTw!6BH$lo$M0U9cvW?Ty^*louBF$HlNN~JSe5*8tCZahBCs{PoIixW-DW1*yio# za(^Z|@9p>=EPzulTGTMf43*kaIeanTSJIVRuqbhX)_{;Fp#)Ew92CU@Z( zv0Q_tq5w5DU|eObIUXMq)WqOcTUw~aRp@?T=HY|-x|S5!kM|@oVV_9Smg@Cr9s5PE z`_b#oKi_oAZ+|VHl!)#vNKJms^c}G5leuvxHD++^61nzEZo=5~6g<-RzRQaav#@uf z4jw|QUWHTZiNJ2)yNKamb3bzV{3!ARu3}!Y*Y0p=C-`0%cx0Tqz-Qf?^#zLa(#Igy zQsHOdE>vH+QoQeGU?+mZhuFZ|P)>hS8{bYKp5l*!F)=Xm3JL(>SZZ=r*z{-y8-NvViv0KUwp9HR^Z;g zI;GMR{Bb!640*4poql?A0QMA;RN9a5_jNKBO3l0D@A=uQ~{MECJhw z0tXx~oRl2Xmlc)Lb7gPx3;dc~S}j`w=3Y|;uX!c(%@v{@V~jT9mvwq;T{Jkrc6jG)0Q90 zQn;>V@np@rHiN4Tj18=7p?ala@fjCUS-4D<$tC=B(ic<}wW9Ekk8%crACW%#ToGWb zV!|Sx8UVah#3Us7sGy1AT;n`N>THzTz?T10-Bo|Z)imkgnvmcmNP@e=AOR8r!GgQH zyG{u1!QDN$dmy;G2Dcd;1{ekg_nq(C_uD=DC+sfF)|+D#Ur|Ze`2l=F(%8Y{MnRFJ zQ!tIP@9}~*?*Jq_!(a5%`5r%voS2@qSvwqN@Nso^UMAI1E|_4DibUJq0Y!xPi^XJ2o_er*E9IN&F+X++VN zSF}rW=eMGI_-25!$+kcp7NS!jjVvB!epFv$cAZ8gb=ioeRnacM+fbcM+3h}6qOT+3 zB9z1$>4jzAQaU`D{<_NqfX^+_dMTYP|O*3 z)e_iOFYan?i~J-=DleO%S+nWs=! z<=5^NU@9`|W#=DV)qFaH!3xFzEc#IU=E*@%mSA1flsit=c6Fmat0R!TqAt+>j&FHo z>4Q>Sa+;IS($tsUt2i74R3JOzFdsHH?%g^)fzrXiGrO6Q^#DNzk01WqXwrXhuXW)+ zubIEMg&enZ`$tK|vS8zgX{xL3?OK33Tz;go2+~&QDUhKPUDJ(Umjx@bXB}pO8Qykk zq^y5z5mqzvmNuDm>Y^Jnrej%g-X2>8xDq(*t#xsk;yYM^J74e9#;CcFUDxtr5u^vp zu~B{vX#&h4hLAiHzZr-D;1C=&33o3^W(~b()3Ez)nN%qdF2hxjz{{GjF@B=?cnRZ&6@_2j0`iHGkr zqN}>`tT${EHly@%q;S)n{+cPM79U{J8siQE|8S0irZx2$$-p@8#gq)ff@5V>Dou+Y zIna2{_5nFyV+r!kP1Rz zH;82lY{6ptg7O93onm;TDkG0sctp4NY5_$KTuk`ql+9yhn9|_S9C%fZFP3>vt+Ysl z0*W`8g{y+!iG03G3M9J2)>4F(C`YHKT;PPspqV?g;4ahb-o3VP?ld6sytu(5jIZ9C zQj+5f3es+_k#I~xB?t{uU!z%gppy$8=UwQtB!=A1OvYD7f)>KeSO-N|ov8_rje0kd z+I(gjX!TKKO1~Tv%HQI#X;0k8$}INT~1>lF4Wzef=yt zcDAcE=toTYR!AD6>r*75()i-5#dd8wGV#^|caxt5yRZ`K9OH2znVJ|!m#B@{CTeTj zrn$ZSZu+Tw^9n?lWH!6GK~~0YkS&UJd$Uy=mqd}^6vRh%MmeXR>S2wQz5qx3Le>}F zFJ)7@IFyXKCU()%8Z>PIQxBv%`oa#se77nm8(;!>=v1!{@PK+OyT)ktFY|R$-AuY- zy94W>+!i$|8**vT<`i1}PR{AoFZ|Bca0C}r%iBgC2`g`D8^mTFz;f=7AfVI(|;1XgE(8HE%o z#i~qr)?i=;1(Un?aHWBY3wTsg!bRiBBrMnXR@;A@E>!d3>Tl%6Jc3m=0)->uTnhL4 zTJ>tdo{hkeio&yXXfwFqZtE$PyM!=h==P|()t=ESN196C^^6WWQ&9z%c;YC-ra_1d zg>Q+derjS9c~q1!*}5}|tWS#6uxGlFaovhTi0-D_o5KuR9bxlxbGeLBf$$qTQySQ8 zM_1z)S3?(*`9S2#{X9fc14Lvs+3xP{{WXjP6E#wZ)z03&N^ST?2s7|CX2|;#e=TWD zqAPWIuopT_$J5Cxld_!24LU+>I(!*7w+n>&b$~u4yPX=UIwJ+8L)QHeyXou4qQJb& z>a6yYq7tA6@KC}N`n%XVG_s;V@1ZhckL4jPLAX3L> zi^Sk%`0%))F@sF>$Rh(}@K=mGCnX=jBuNA%q zp)2Cz^i82D#w9G#q^d1UOU*7x!{=M?{*|kb9=M0r(>NNy^r7Cv7$jC8}CVt@d)P0nRFte{exW4WYZe@vt z>`{Y1BQ3Zp`D>Cgc0VWd^z>u`99Nc?0}7avWmj&Ak>Wsk1^caDKQkxR66#I2G5Y!T8v(|W~&hr=`Ol;f=Qlf05&%_qMm zhG%Z}VB5-G5xW)_RX~6`Vr_e9go+RLmp@$aRqIII1^+ATx(G`|^5(0v4q=-no$IW< z+NM2@m#M#~N01cPn?p$W*}Wsj{6HluFT~FAYXs|}+LKK<$ozP68LNK@$E@VX)K+#no;vX%b4KOvN7ov+(r1O3qGl|W*KObFG3<)00ql4_&%cEACzzDv#P+%# z$EFCr3Fz5O@^*(Pv$sHXf^m0igg=_|J&qd_0VIqFnJnoBsE!=$7es;t zZ7NP+V;vq(S!~XF*Y?K6LC4$vjx6h5g~U4wSe@M<*voR#e9{VD~^2?1M`7 zmQ7}T?E7q{Z!hTyYHDAYcI`FQ!6lis+y0O)+Pq6R>2iywebZIQM1mk8A>Po?@t0~n zG8C%y#dI3SLpmAvNn_UD<3O28=Ph!kJ{!Z4`n=wEWZHM$iofJ1!r1-e74|7M3fgz1 zfW(-B0vanyHgB8==}*V8ouy=y%6KoMtsr%nc{LSmCN(vm8gapjPk`5`J)2IG*}@q6 zR(I(SxbrZiQorB)01Uh9`qaORDkcYDF-*4Zmlx{y7;R+8-nbcjqF;Yk-PxBv;hgR) zVSD1c7MSK^-2L#%^H) z)LoeSc+_+|qcdi%mZDCa#z}dQ9w#%m5Sa2U-k5XK>Lg>)FDJv&(z>>6v#Hs>+^(m( z=mLN$upjWRDWr{D_-OnH?(OqxL^;pEf_D)S8i`<_eGdshet;poSTEvL%hcYx<9NAK z+uGXx`No|0K}?!8aimbCOoFx1=nd2Ig%P0>6MfSA3lqx9<$%HSTW>0=-1c@dj?;o! zgB346o6A07z&ihm&e`%DTEx?5@{%!n6@O^CJ2EaF|I+3B(9Ea;eW)Zq>V0=Ujm|*@ zgq&XNvYNse!nsR%!Fjcr~k3Zs}gclq3_DN}mApO!TGBiVn3 zZmU1-&)zE%hI-7x#-@ok8(T_wpwQu7AkN@uy8XVJ!dMsjTlOZ({*tp=oLCKFXLgXP zQ%{9AU6h54iONbrN$GpL;ZPcMsgNV%AK0Zyhm8!>|B1?c>&p$1c-i!YqR!#BFFrdf zoFGFA4XsSZ`aRG;wuS&D#3Dd;Pvk%sdFLTpFOicWvvLSaXZ;(T2ioc+%o>97`(~hl zC+8K$E&8U*Sl@zoD2z?1r3ZO-acUSx%2sBZ(ueezjFmULKEr@PWdw^JH+BV+yE^OL zoct-esEnp7_MCNdNt59AT;2DOUFU!vYZm@5Z=Pk6QigWh;k~g=`%1%H?$?UQb`#O5 znFH9kCLy7x=Y{>W3Kql+e8Nmzq9%2F@^F?V?5ERHo@+a4T&j$V^K1^^v@2mIXBAZ? zaGUSRB^sFFdnT&;m|5eOASy?F>E`{opl)V@P{?EE0jk!@>es2w5`qmXssLXCiqGq> z8fl-4nyCVEveZJ1sn6t6!pga5;vMb|(f`r^yX%mo=CabS)H+8!@2}W?k{^&uQ&a(Q zUgk<=b;XN|ftnq)6&-5FCw8%m#6R#fZ-5l@UA1LTNt-%m#W&HkGT=;$1bWLc?a)`8Fc+oQbA89*d zkL^vI79X?Vx!+!vG|3-Tx-L0(8XAb5>?I$T`Zh1!FFqEXW&qfdK3dHkHU_t~0hR@v zch%6fS%<=6i`k-?X2@PFZ4p0QC|PZq z$&Qc8@6{?O7h+;#UmmsUg^*p_W2N*Z*{1?_j5vmR$E;09x24n;UwbDUk11fVq8*l3 zZ1ufr!Pa_R3}Mp46Vy&%+l6t=`*Jm-LL?h)9e$2m*@-c|B z3~ly;n5V}(NcYS#4{0vX?W_RjLokvlMTcx~0?J>Uu0s7N81%g*fRy50ft(=Pp)0lz zB5HYRV30-IDE~~BzYm>+wE^3yy_Z^py_B8C-qP&5mN5E)0BA;O6@JT;#Xh*9R=Juh zYzxY6;Eq+T^<9G|n2Gyrn^|x@xHo&WdXLj#6d_qbmZrX?fRrz%OYT!=DQ7 zk4+fljpHmhj_eC8k5Rsc{kZR%n|=9rCc{@m`-a7|&s;I1mofZVZjV^|i)=4|+#wz5 zpA!mcXmHwW&gPKzmDpwxW|B$)BIjbx=(o6|gRdVpH1CRcQQkI?BI{{s9l&6Ce_7(C ztvYm>E32yd#W%l}umNCVw<~L+XEGP@#_py*(8tVF3TS1pNjP6+2?oNZ7w{=hiE(Rt zdv)cYW^qzseJFM&Oq~DcO&k^^Th(Wuro*Vp6xrtVGirj-L+VQ{VYX#;eYQGN+tJwooYMy8&zI2{%1tr)f|6 zRTNdCw~-&W)^=WdW;@&6{W^*GZp|r*e}0}8+vd3QCOny(m)fAs6kX>(SIQGrkp&&LzyL!USewJmf{=4sJEZb^oH4emF za5;?D*e%689z%RB*^}0JbJ!OkUHBrc+>Ppc7J#G622?f z>fOLyK3_~Hy1sXuw^c`vccl=V-$sy*h>C3aB@S<m?!|{A-TOyY~Wo8kco>q2^|Z!(`D%vjVXd z<}D1+lsOOqdYBnRVU$H~RS7dSN2%7Q3NY*vGnlz;C9w|v4bMtSry_YPNq|0s+_z0_ zx;{GYPApu9-@tgXQelwE%$=*OPkdng4V^qq{2FrOxMD01Eyy&KruzKi1-7S*#Ah`! zgiio|YG`Au~fooQoJXylu2!iR%fT6yaviH9jUOXtT~Vbj@* z$2hY80ApMvhjOO%ruCXCMU;}u%^YGw*!r?yP4oRN0O0#uwT!#|Jco9Tz3kTeTp|tn zbrFwB^!V~j)R!s0Q(zJNtOV3tyd2ZSiHrzBd8h^<+{#8qy$!&1LuP$`uiqEA0sMUx zlAxm~uULG9oz>pm-PQ^=8x!X<8k|XToF#&d4RVZ&D3~-*^zvSv7%M5L8tL;qPi!1t zO`ZCFPg%+4Q}X&JH+UyE`V~%iXWBFMz@ixL?+LFnUPfL@-~623E|LvI7*$^0`+!fi z7eO5?ILWeT)UOWTy?eL1v?Pu2RJ;{k%oe~mW}vr|eyX$T6oC1#R2GhWVWnPrJRicn0*p3b=d&E{#&@cl}-c zqL6_N`q%Nl=*o?PGACv9R&3Eg7gHk}v!mtgL)W*{C5b z^p)h?GH=7C3EgA8`s()%j`ODMi7)5}XR8w(29K&Z?cROM(Uu5Bgu%ym3o(Hr)ALy| zn{`}T`Scvu#WkzSpcT^iGZ{J@9#sWK)`Fjxb@;PMX{R3RL!n_!I(PD@a3}}dl#f73 zW9_jH?h|bI>%06fgaVVy1nr1oO?`2soiN}>8@aec1&3BKEfV3~uKuIXL@^=jZ9z9@ zMe`^$@cJduPjG))-RO1LPUWQh{vG)6aJ8`KPocYAz2@~D(%<7vpR%U2vlpBaGou?FEbP)c64^G zu!oS%za#{AoGq5&07nLoSI!>f=RfKC414IdD(t@d_px4m%)E04mKCFmi+vLVn^1`8*f+`Gq zznD(aZh2>dA5PS8J&ffiNX5gaL?*@rd^g0XMEAoRqNj;*D<9pH{{bP6Ubwy^d&l9I z=>r<_;aJ?r8|MAi(=$#g=tTwQlrV{ZO)#VPOlBioxbQD5m_$+7+}1#I4qq0q1u0Li zXr&Kep)FBZ-1SS3$2dK;9N4I)!M{r*Nba8OKV6^T=6Su_93pAk2z~*=p@>pMh-e_O z$lfD^j6+%_cSxaDJQ7BZL6BwzN(obR;;`*4zB^uZw9P@qEX_0NKUxfzwtv`M;pgAH ze2Du6iwiyrF#*luRCS8iXbtfQ?!5ZHe~UF-Ci}!pdmTi4pNgJbZM^`MbKu2Q&`jBU zjE8%phK2_4`s(r$kJqni6$!|YK{uM4PX2y~%&I2it9>5s7EH9zD_a%qGc%)cKzmL?ua%vg0Wy7?IAJEb^ zyJxLVr(WS2w`}>Ts?gddN_Op2tS#sZa?$bCzxZE-(@nV_{DZ{}nNtOdDJZ$XsQ($`8 zlsick>Gr0cLZDc;$QwWwkj^xTyg>h3=0IVp9dT*+6!QQ@U8cN{K&ctmIus);6!cLp z+R638jO>_D=Vs)48y8Q%=IEKlyW0^@pkl6-wOz1?>xw>!15!8391V>*%w_7{6U})M zNfDGHCK>Y$y;pKMYCae~`Y)unO0X zLd?E>%otlif3Z>#PfSEJ9xM>@Dmp5V`CxP`*jw?l@Pe3t*5!pkM8k#X{j*p?rPnV` z-||8eFr;?e)abD%9>GjV>LEimPE2mAZMAejLC}abk$Td)|6GIiPTQcsU@e%qn<>_ zN;0Lx6Y!OCe&I_i8#^2Kgavv_D}VMie!B0yj%$AaI)Zoi+DAs{6SK23 zABC>@Xys}W9+?SNaI;wtJe$VR+N0D{QahyOM?K@uPTUuCxobEZcH}iIeDo>Y4D#LF z-dN@}RaN~dgFGH-)~F_eEzS43CIi8mG8-dLK|AK=DeY57hbNE|XwZ3IR?=RFXJUrd z>7k_Z70dWB)A%T>Z{qsG!osZB3om;89x^Li$7dBy-P4an??swug$Z~pMcaRzm9;lo z8r2q5R1n2HlKJ0#vDeLbThZ{h!mw~*-yG0BWk2k9PWL>q7}y*g0(&nn3CoCt>xj08 zH4^VPr|dK*6E-Fji?56gyCo4RLs*|VOR+%%70H{&xl9se#7W{ZB>U`{D8zXr%wV^cq#0DDMT$|I}3=6B_-e v!PjQ${>V}PX)v%7Tgm_bb7%gJ;3pDz^yY1XcW=|bBFJPU6(p*~jROA*e!Xzk literal 0 HcmV?d00001 diff --git a/package/appserver/static/img/escu/Slide4.PNG b/package/appserver/static/img/escu/Slide4.PNG new file mode 100644 index 0000000000000000000000000000000000000000..5780daa26e4a5f778eeb47eae286bbf45da81c08 GIT binary patch literal 188906 zcmce-WmFwa(>98`y9IZ*Ai>?;-8E>?;B4H2ZD8Z>Zh-`Mx8Om8ySsin_x(KIdf&Cq zIX}-27ECieQ&m&lRaafrQL4%^s7ORe5D*Zka87KcS`(pdcV1c?o>dz*mrN z>N4UGHIpQV;0qWVF(okwi28Ws7qh>&BD%=xxj{gn_5J;U9C9wRgn)Q2mXj3I^fo?u z^>Qa(PCtm5%zfKlYkoQNy=R>g*st0CvA@cd!!@!jgtpco+!G?b)Si*FsPTWvIiRjpAlXfu$e@iL&( z44$A^p5H?=`sq9-qJ|Xo#VaC`j;Xb-4nusA;kN@1 z735MQX4-8b<9WwDX=n}4S|!yd0fDuagY}ZO*yWJgz}MpIO3um zNMT{&q8;i_pE7{#L)Z=g0+hW0XdBXT2Dty2WLctz7{=bF)oe~#V#!cC44^27RI4#u;`f zP1}CZU?>9y@6{o(NlG5o0c%&WHgi_ODGw^h|MOV867ap3Zp2*R5^2GfTfZ7lT(wTY zlY^5JiUC=n5*iv>^`W1M;M!8T9WaXwy3cs7s9?gqy|<%jdK~E~*daiyl+@0;Gj%{a z-KiXp(z$qgdaAIgs;=%KL^-{y?2FQ=TShta5a8r%^|wvcSfgdGRT;^z|B`&`<8Lf2 z?PG0bX-+YGdU|S0pSK2AgxdEK9vr=AW;Zr{^eNr@iSH80>GS8~i&*euQ&aJpR%+3_ zlRWWaxk0)2WxS+4W#$>up*R#%(jjLlA5!x%zeT}z)ObgeazRkxjOvgH-i2e z_U>A9@Vp-#=u-3Gd%pipHJpH;S1Q?K-T0^sb=($s{|@)q^_KfCV|6?o_`YuNetI5= z;A>6yB@O_1SV*;|U-;5ht&oU1Flen4^;8OoZ|rK>hi_1h0&qMBix*fwNEaH1;oi$~}FO;Szr0iX`c^)AD`nC+U7@;VHP^!^0MCJwi{O~Ys z+f-0MS*{taZn&z*$mC4go~i!U$fmG9C+R_6Ez&!d|!%kT#_=zYteu$FHXv;NTgYk^H@5VPExrzf>wd7Tx3KUZb%w zX_l)>n~F(bIsZej`D|k{;Md6?DL089OZ7j#sHnq4y`nbc?8&cpysb861=Y>{gnuoF z_K|n`GcM~TX4YBeYU*T1A=C(@a0n_?a-WQ91H=Po%S~A$vU5%9%6Q7{Gh}R1Da)}s zo1zDIrsCW!X=qAHB`ZDHmRE%|FZ8?b@1Au_KMjkk?6@;NJZ#r&W@Hc{l$Mr0KR=79 zGNy2*JGi-F@62Ct5$3+M-dyJ%6iily<{n-J2<@N5V+%jD0Hy*ONbfWXu4b3=O=s$1 zZl|+Ll^WWiiKY036jH6WDh6Hqje2B84>d0?ha_P8lqrTEdib-EIu}=GS3j<<=$0l# z+v8kSlsGl3nHXuU8|&=4IEX>o>G`WzB&%xYXOrnqJN!CCY112XB#F3ULAAn`FhZeS zG2^mJqswE@f`u`pl_77e`u6)fiNl~L?-zd-w$3@9w~9t`fTc#wId`N z>wnGa4i?O$I|$=g>{*HHvf|?4q*hQ1mW#uw(4^+TK{fv-t=RPPpKncd-}Cw^QPhOrulGhl8%( zA+Cn5l;#Y$!HdOt5j2Gr!DmzK`C)hIm&naRMa98|U+j&b%?>$EJkDc&g_hs*wA8+K zfR{a=r~&`?POn~d?Ab5EZDRRFyWx^F@PpR*H>FqdOrZHLl%p!pD*cghtV5Q(b1v6P zO964|=aP9$R1LV8j#e9vat}Cpo+-O!=pE>Y;tmB_2xAZc5-sigDM60(LZ0cNr+~HA z%}iaQ-9y~*`;X6)5@1bw%=?v@cijG9AZH`M0Qyg`KC}d zF%^mu5Y^~Ki-fwZe33aK^N*8j#W( zNMJYv$pp174ue(?BZ7Qn52H?aKIjG{{Myb-K_nCtjO`7U?!{hOt5WDW;X6NI+hA>f zSU5!wRO-4U-nb9Iy?r$3$$eqG?OiGB4lsqqeo9V|NmY%XD@WvGJ#e8KkS$gRvg}Mp zin~yz%I8aJa>F+03aU5P9l66{%^_4kO<;_m7t*7SOd}*AMq28G_P^r1I)I-unmlF| zs$HZ`=-N-SNkce7>Tr;k2Rj91ddPWuUsT<*|T=y z+Ejp^pqZtngBqd|^Uf$WrEmm8A_G>EMuR+`%P=eno^GLdzHD?1T(P9&z!y+)UiC}W zje#+wUwu;(h;fq>S>XUHQIr|*SPjC$jvCixNJILnSRZ7dsh^RRn5@8p6WKrDjuxS2 zC~KisKxy{LP&GkgbVqVfwcU9wTuE}MABeY;!U;0V@0sT1g^f8>Hth^o7ldKb-8nx# z-QLB;!`LL-Bs(~-RcCDX_t)4qw@|-QzdE>iao0-c1d5xvd>wcs{L0|klNd!~sHQAm zm3v>kxv5%gh(k<_jYZPWAp0k>c;E*^aHlY@)APeKysT8!L0um3B`NDfvnz-^P^4>m zI!K-9gX0=D>7yx+05fywq-knuY5@*9I2m3rCG%q+&JI8*H?5b<*Azcc6fkbZ8E2WW zbn&j>)T-N9E8B$Fi4uZj0=YQTKWzmo75ZMW<|#l0W5Bq)t3nuD^pJZ!QLw@eNlS&v zNWsCv4~2($Kf?9^M@6!F3-PT>2TN6Z$9A`}nqVN)U}tH+HjaVFP3dOd8cHg9xD5rmWClXAML>FyEHd)q;^E+cZ8AqCI$ln> z2#9CRrEsO!1eI=>lS#FMBt^rWuS*|2hCjm(poB}C#4fhRr^jiSL$MeC;^Sh;Y|qH2 zMvzF2B99?0Egc>aK{qI~_HY%`L@jSE57h=7wZgmBrBOxUnXtqGx8VY3sbK1xb60BtQDJE{dTo_5x9}(AAmmp$?;v}FhA1xp+IkjjG!^|q+e(V&;g^r z$BRvcL-ey!^3)l*)UmeB85W(M3va*~+>1NcCwdn}IXOwgZR%npjC~)!XkkOJ4-SK) zQ*?uc`j^=&`96m75xcNI9Ek}alD*QTv0vB)zqWgqPJSh2Sq7^XVbuRALJbcX6S>*T zW>2X=F=P%)QWf0?NN;O2ic1;l8!M}8N?IDqx}fB;xrhjP*O-=TrfPK$ zk13pVG(nz29UMlIIcAfJS0Jg<4PIHTII(z| z=t6gpXO9-JWS{HMg$Z_)MRut5>O!;NKCvZYrAZ0FFg@soun=4`{|`(G_M87N$ofD3 zea%aN0_R2$8XBsotelh>0zEHx7$w+8n^US&%ewKj&_ezKMyTNh2wpU&^mTlzNEl!Poh^0^XIt2Z zxS*g4zvq<=PZ~<{FyLzRDTLOt+GWb-csf_njwjBl<3I;Q1Iv9#^K*jOsDX1w*x$Ke z+=(HcE~J8Z7Ps2!3XNE%)0Qa(n-g2PaCQV5@&-d#*+afRL}6!rm~NC}so=q)oP`#hF?BmDYN3mSow}Q z@nptITiDo?&RD|rgh>}t&=g{((4jBLnL5LU>-czFLo;1URXm?Wik@k`SWKq1y*T+M@9+Ks^soIOYDM3aSsHVdf6<6_8G-+X8dP3~PsqNM^EWs$JMBjAl+=;*lP=9%KliGkM{G}2DXkqD4$b4UX_hY%($`y_> zdsz#7G?0FLC41Ssj`>5=a5gUx=x@;;mF#}atNPZ0Z()6Y?MO^T6tSK8enDivgLC0} zcW;rYkwZXI|q91kBKDM4WXdp zzPvWV)=YVc6epFFy6NNkLAfyK(&LCDP$ems7UJOVQ(1kymjR+edz=>L|M=)^$V|f} zxaZCY(vW9jO0H&&56((8LHLs*kjP<%Y4(R>S1V=Ualpa8CZOGz#=MBOc$i>WH7~%H zu-9GSlqfEllz+uD3DJ0~$SCp#@=>@t3& zsPYVde=oiXDDgDh@25^7Ldl1-1K%NmVXaZ#n_8dJVtF~H?6Iy$PUEXb6=~@8VS#6hqaS2r zH7__=+0D7VXt2rW(<0V+HD{Z0NY?#p<_k(U3z4)L1oXQETT!qgBH$7M9h3@=L*sIS z`NHDjND=gx4BXWXV>a!1M3@(r2n!c`$7B$Jqn5UI^IR&}IvAM4qh}*wDZ5AsZIyZn z;QKPTV~z&o`mS0%?MQxQRxskE%&S8hbewJ?0Jo{u;F8UJJlq}vzUq8t!P&fA!uZbJ z+^m(B!h3tg=TIpp(CnZ(|6O~OrqAuD2RAcxDvXm@8-ess6u{$CwkG5J@vVJxhTz?i5Q+QG0UFh4=O|RrT(tiH5$KO4}0>hf18QM|UEQn^9`0M9KAE zyaW4g%MK+)Rl>Z&zs-#48IHd!-S$2~()Z!&eEN<;SdTN5N>~t?R`3_pdU(KtQ`7Au zZidqkEfv3rUBYFa#NOGup5dU|O9IzPuS<0t#T@K-!ZNS|uF1?Dmx;?CD0Aq&KYvCp z(Fs~}lIg`JKNg%sgY7#yCII~W8A8XnQ~}?}amZ_G4x1Yn!39k5CY;eVeLNT^1^QJ}Q}bDSPw7*^ z*-eAAO~W0UlKU+hb48qLxAia4pN=bfUjtWhQKBVhN=iz?!eD_2-PDyoeh{|fFn`Vebj1O09k&$K8=Ltpq!12fj2jDK^UmMflta6tU>T)UCk1wO|CF|RWE$69CcFWtY zQSVd?E-Eds^h`%Pe)bh}wo6}JGnp=*;AwPZYIa0xzM#Y%|8un_LO+K6_ucaJ1ar%r zwYaFYU*L86`zjmM%yR>#_XrTI**54Ny8MlYN8>`4gsB z*IuR0tRn~9<jz!=rsC66rrqUj(4mZeUkrxcF+4&4$`HG`d9UGiPdvuT_0d#2DS zI?Vmet0+?E)p{)_TPN<@NbNyOK-$%EZHUMV?)}~QFSd3gzgOO}rGNzAH@?~gKsNj% zMII$$mfnDRIS!3z0LMqN0w|7rK^>t2619X_g)AEjm>H=4?AEtFvQeooYQ`m8*+EOR zM1=HPt4)o}i0T(y5@(Ow?czwOBclHOmnpJVoarRMLe*hNh9c}IiqUSfv=OV&FL}&B zS9=U330T`IUT^R+rJH0Dy?})at0~UFBb2#4Kt6raAqN$mXt3!Z~Eyu<> zJi!#2BP$751tgu^C^iJ5<0=Ls$ls9sE8azOC9nVMi_==Cns$jfGW8*1A|fK96#qy7 z7~P&dJi^0J4{E4$y1j@~ay7V#143}*!wmBgkkC-k5O1%4Y?EQ7XbsBA6!f#A|NoPK`?mrdZ-8Q z1t5CAb05ka%<>?5Qo1=^w~19kF33#zshf?GS&)yL`5RU?7Jf>0j_5?>*pwXJ6+!=# zjNV`Yem&s;|Kkt-xuhLtdmprqACrBKubM#*?q$ZH6aqZb54hOd`^SOX3(fs?38CC# zvhACGLF60~2j4-IX6yv{J#WIDnCrqVg@AVQQB(Gfr^l&HGQF*QfP_;{*Tu4L3#-2x zEA!XL>&JEms_Y}hAQG14Pkxj zRunb&ck)dA3_Vr-QEVB>p-`zoNl8hmV(Tz!#E?yFworZcS=RjPBzl~#x}qYKbD#eGjA>4DwGqFbsUW0+r+15b?A2I_v$p ztT1(0C|A9Z)=+T-NxG~FVce4t^zLL_lB9$WWTZ!A1bBovIMO4rF=$N5F=y*PncR)1 zRbuh$U<#J_f=hz$#)!Lhv*Rr-rf*H^YR3PG#e^d5F;ulxuv4?9)o1spy0+%} zt6+W*{vR*ms??q|oc&@v&aZx~T$BtGBFsGO+?2c=(zKTOj$hH#*+ZDd6_pTUA{j@< zlqbh!^m0VOyN@ZdurxU=a%*f%8Y><<-@mS(1umjaoioIv{S}XH5ny&nt3z)lM2m$q zrpX8n4u3zO_5}wNgDz#V>+(1joJ_aBd*T@O-&Iq!X#t~NCyuDi6n>kz^fj)rsw&pc zX~*ubv2=Te5dMCnC~bCEvAM^GrQm-|0*J?40&u|pmx=t}3ETUBqt{ybQj>*;vo{CjPQ0nPTa5i#>Wbh zsBb(B^5Ws+i%F~D^hQcbkVzSxEJI;=612BL@SG>9A%GEh9$BW09s5)v4(a!pzq zntU7tBhec$2dj!-d`@ssh62IqjtEm1eQ;n41R(hx8*GR}$-6?*ByNuWUc-jS#wU-y z`+Q#y=ymS6#gjB@-3O54Aer5(;Xp>!X;}6zV;5v#0|784*Y|E>OB$cgp!RT}_V$IH z?&dxv<(hW483f^2b|3%|s8AG-n-`6t3CFu}q1t%&p`^@aYpPq3PINxYAWuu^*ob=X zXL}{YMn6701O>UIGeI#X5h`b7W>UCz<+KKs9qZ;ZBY0)iVaR%_EMwDOoH_>*BhtgV zr1hvt=!m(fgfhA`QM`UOc_vB^<@fJaJw7=Jo!JxCg7zF^Cz|f|n1afg?mbh3Z5R^* z#J-RwB|@~0K}7eK+;bDNGhR5zhP$Fbfkp>n@UtJ|gA6UzrX$BdYb%g>T&$H6tw`jm z?p`XUPym<%6fDCbq@dYUUjg#A`{fh_*4JZ`_fM@FK&VzSdTP;oQR!@$XUW6idVy=Q z6iHF{AqK>d9+KD((zldfqcR8oafs_92n{rFiA4N=_zjuPvYP-XEqvKw;n1CfkS4p)8m?9x9g{9QJKLwjxP_au&5UQF$p#O% zxCEb$W=NDWWiXrsquWPDT3YpMBqbPXjg-_wlA%r=2ba=GH`%KPK-tHI>n%%3vk#>N z2M4bYL9!tonr2!0k=-$c3tgzWnL=w<-Z$&isjK&zdIqCD(DMaB)-tmlHklTg_7Z{6 zYn{tH^ijvt$RQ^(xb@eP2FvCTdAUCo&g9J>X=`i$sdC`7RYL~p5IS_r^gyC4nb(7| z2;!u1C{-y%2iMdgI1ew)W$Tt5%64yWJ*ZouzmaBjXe)SoY!&6NFBM|!?F9Y%PGS_e z{dvTTDxYLA_y7W!(?KHL)OFJ(U4xm!Cg~7k^!FP$4DE%59<`7jaV%hHomkHTK+2x` zZnqMJ9#cn}L7auNrq6flTR*aPRs z-R=jSx*PF+R=rXBHL&17KO+YOvd72QLVMdk54fBSe9X0P{v@)%OOxjLM_N=y!^6e4 zoc-gISlq$FJTf*_2wtYv49^Fj^~$gA`Hj&EJS`&MmA2Mg3#kh6W(T`+Z{K#O0`&A) zA7|Q3#1`fi_L;Rmi#4G${t&SbaeQ8Me$CKXc}-i1dNX<9h%yn~mTk zm_r7ZNW>C`_+ln#u^R+^A$O%RS@JTTJT)XIBCR#O30Vh81`E%#xsWJ_fL-(6T(Kl_ zvL(P{v&H{D+}$Yh_-*WW z$=l_IsO-;M0~?{Coq&M&jIw6yRswn)!k@EJq+g|mv^ zHn-c~an)0Al%GTbvYscruBTSXWNS&B%04)nq0_^MA2d(&jNF?GkGu;5CI2hx60`+c z_tju;w9icP)YYJ11pp5HuS<5r#q#U_N1df06He*EMCron>gvQx>~B4$d9#O=m6etx z#21*?CvXnm9f>{k4k`5Ymp`v?2b3x1 z9De2q!GJhXZwh<_3 z6Qg>YQ_P?F=cR&ekm&KTEy4$O=cEV3>2}9Nvaw3~Mzq$pZez!v8m-K}dboI7x&~Og z_<066nRz;O20B!~nR}}?w zxUH_+(z3D$F$3a1TAbDZz++`rHXF%fKfKi<|W3NUon{T*R0* z)_@HHRBsFF%{bQcMGAa%Jn<=-DXGNIKdT{r{T<>*=Cp_^5^7gdg#lsOT zgBcnW(PhL|@M#Ryv6+Z(czk&c$YJY;SX*N*WDGm01Zih!aOpG~A@`O^A_F%+4+p6z zc;=P`tnNF+aF9=pv zR`LuL4?P2QWgtzAo!$G4pVH?o-%;;T8JUQWem||hA83@f8yc&1nKhLIIU!A&zH=YB zI5_s`yF0Zu)Vr@|6 zZ7S8Xx3?&YH3Y<@C>!UQE)Il8D{V|#zj~yS9cN8>nWt*fQ_yLVc33>_&ps{!#cpw- zIZz3Y?Z`mJxkN`G1FqHAqhF!cTwHCYjt%$?o*~jNXwWs~<$8vOFE_I)YB+o2;NU{$ zf0HPluUf9z+1W|&5C18FcFW(cZ$>k9Es`b|9o3_4H_mvON7~%sB)G9QUE~l%rnW zF?ugPs5bg0c=x;|e3q%%UyUA?4n>#35>g z{yS*HySc2k^|M~7r73?Vj_p8oYZ}MZQLl0_j-~4U`+SHXN7wHS-nj*iC3T$+zJ-*+1UXqC zy&z!yIuF9fn11OsF{*$FNOTkw!*=h>5Om?PnwoH1DJdy&aj4v>i1KDl#x>8U_ie=A zA5Mb*wJ6wlZ#_MuNlg!PSw3Q7ZGsy=PnQf&9F9qkh|&S8Ddl%iL=ig65S&Kp{KC!C z1}1no>4`ebO0n@%vJ;G><0q%5yL%-U2g@GK_ub}Xn$v?rQDNpLWSCc4_v#Hu$WozS zxs|Y5GLS5_fOFJ@LeQ3CN;-x_xG=hN>uGq^lbETwNwO(wvklwZl`sPgnod55WLUVj zukK%c0|JcArJW4TDQOrQi?|D4b9Q<{o= z5xCsG;&KK!%9yyVgy4c$oma~F!(J_tNwlE5JPLpr=|p76rxCDW+EKQ0QdpiwfyU;Z zjli{)#Y|9w;3}jIMv}efpAZHM@h_Aq#`3g6FmVq${m{u4*xQhQ-FnKY8&_P~x45n} z%v-(UN7B@vFX`gA25K9#c|f2g+jv|JVb#;^Ar=uf(%kAfYnzBVZ0-X5?Q7$W@9X?M zd^f#(*$-wPL;(^1iuX5f6E`nd-kk)@)RZaX!xJnmf)#woHEGASyXe}mmRIdyB z@z_KXF5X?Vd#Uwk7y5^vw8DgX(peAZe}w+i5i}SNh3F&$D!<#BjbVh(^$} zJfROOhMKZmy}!Wikfz*K4idkMAX9IN-C;C^(MDqmjp)*s=%Tk*+{owyv(@v{Q#YN7 zCl(f#x}o9tE*9JCQm}GqNI8CryraE65fKq(0JlUTAqmOJ;h|Z*E;xOQiHS+bNloPu z7Dlr_JvqtB$N*HwfBOa)5qtdp{d;{q$I`;DUs!Vh&g<)I?PJKC4e_>+(&;JmuMatc zV|vgQhIyEQ^rU~wzea81qH|6y$%*?x4r^ThMA3lZzI*OE$S%w2$RYgtZ|LkjV&Zag zh*-vgSW%&Zek#z!7YcBH!<3+)pkm>SpPyfQN5}iizQ|C2zooTx?Q~3@tPO&u=RW`|I&I(4pUYjkECukm9%mO=qWdmh zr;YUzZXr(@jMGU5u1x^eUS{sY`F%bYf7ucR0QI3Cyffz$xU5iK0+IO)aMqNLUph_b z*!8o~n*^zAV_I)_&At6Mc)Wr<_kn~Lr_*yL0VnT+&%#{~OYit(&mC`_=TjmVua7e1 z4=*SFxj`UB%@Yi87H%#|^@ghljbAVM_6Dg21TH;L`?!j!n&w4LAt7I&BA{F%q9`dv zUfy3~)+?kl@1>a-$199o-`~f?l^`= z8F;ntaOU5ywV4YW&?mye$%IPMP+RSkmX!2M%M27-ZXo8Vaw1Xoy)tQHeV3$36Sg{v z`I`iTHAUt!1!*S#n)$2ES5sl3(w{Y#F~sXgh%&5caBDwq&Ye5Ip1p3QrKG+7Y3Wi@ z_~w7F($%*8;R4J~^3n_9X?;~jn+@U^LYl78WtO&wTeS-M+rYJr{szPd5TN?SCPG0_ zY$|Bk0@=9jZ@U<%;p2FYemzL_W9Nv9aNeJ%4l-9?v@M6grS<(om|_MVw&!E-KqRPD z^t~Ix#H2Q1DXU8Hon4+IlWfOVfS;u?FSKV5S%EXzJj4$S9Ac1>Q^%wdd)|T*6FC@u zc-3qq$n`JNFgurFW3!~lvzfFfC4dq$a{jm-Kdl*fbvXILKR+6`c`}hx1L!dJ=msR= zp5S3*M*9t;6qysp+!}vzZ5Ps0^h}Rw%9rJK)ymdjDOh^7_cgj*VR6M=U4MBH7mK`C zvR!4P)F)4sjPMS7gol%+G3xZ8V*VsdJ4Z)N%frFX!p9vdGlqQAd3@|f$H~2L{LM>K z+|L^nm|zklU*3MW8@T&hCm*w3F^8R-d~-5xWja7!IF1g>vR^737Iug(bOT)aJ;29E z1Yu`tLwuN2i9-(Oe_{0`W@lqtwn`-pkgsWvIua&c3Q}RoGg3i$cp6{|pqRNlz%pb_SwCVx3&k=NY}t6cmNLqMV*5R_|Ts|Z!y#K%fIx_`90In6F_S#}>stmwm0 z$tRPq>Hj!?8p&?5(bm!(ORrWhD6M8Kt{EV0zBxgRRLsdoDJ;zLT#@FC7=w>|#>erZ$s^m>8T73{_Zkk_nCY zx^|0%auI>{95x8|u#S3hn;QM2Sn9`*^pVaMw!V>WI(9)CrnaV5a(;% zOu2G1SN?eN-E#dME$VTzk1f!Hp$n9l zg`pDlO;JuMDlV!Z4Np>1dZ=F&+`l)gk&LxvE|rzEGv`pR3rdp3yj-p~gZ$G2$w{G* zuUbUgKPqWRn>@)fqVNq-?i*Uz+US^Ud%&@exX*VP<|0Hf`TrFE~`CvRA{hu&7u@UX4Cxx93Mr?$PixwJeK z3AVfxX;{s?F0@Sqj44OMqIuk(Jnc}%A!Eu|c)!`X5NpANUK_HoGg z<-+K_&E)MdK2UN14b!2!6mPnQ4vyK4GOV60MT}g7p1eX+o&s5YlL}n^19rQ3!Kn|Y zVB?A=Fpl9&JDEvyax3jfAQoUyOvikQWK=Ks;4&j0Rsf<2a_3MBwUvdza*!>ie%h>} z+WJK<#L1Yo6s>u}{B0CV$lXyBR;!gcOdghBG8_d-fH(|K(!5kuo8pT6ZYh9_*0(Bn z`NY7>&uOFc>-BG);;_fWU@v(E1+@iC$Y+_OXFG7tFoL;fAa>(@}qza4!1IqfoR{Pq4}*Q8XmCDwreS zXa*=jtVm{$hy$i|NDqD#Rqg}kx_^-P2kN7i>nOvh&F2}Dhv{7*v#Eb6)0JC z`b~pz#n>c&4S9N@=V4lopujD0hV)T%lEkYUio&Uo@3<~Kj$qP<>2`=%qN6k8_33|j z>$@VR=?0J>%7E)rU>)&M-9y_@x^=-laeB1~b&Ij3Vx_Zkh*eqa9)lVv1j-+r667e= z+!aX}KJfgrldakCn6jG4PE3xDO^l6>GZ*Yx7L_8kGQ-6fB%}@GaYdJX-K?M%Cv{EN zV}^-WVq*=}=lnq;ei6KBZI;EQ*PG>#FHXC4EhQKnIV3}j)z}KPwZ)~GGD^sdr$RqE z!8SU{GCVmkH5#0{d`P&wc>_+1zFZ?BN6AhGu~&U&*ve2DCZ^RtIM6>fxtt{+LiWU$kzS?{*0D$E>+27jBAWrm zY@|zfc4r=$Sw;AT=(xkT@JWz0b_F2wrD)v2%{7YS(07w9rrDF%L6HHvkyb>mCS z9?Und*(CEkh4lclbi$FSs3_n=Yu-g!(DVgT@e&<5PQ#>0Cn*8RE*TDCY62Dpj^Fb_ zoXdv5`Z~pU5>)iNk+fVuS-gq9c~zu_{Dk5r7xFUA@>%E2^3p7H7nsuc8_TCGx)F+# zT2+u^jB#l2GMr?K8f@Cwp$%YaWu?&~Pkx}HUxs$vC3K+ZGN<(s#@gz$rUBr!hogLd z_au%mYUx>O3hEtQ{9n5j;vit2F-&SUp!B97heQouK-fU59;;EQmn)t%DJEp6D`(MU zy_3|h<#}944|>wwht4%jsF$v%)))h+rI(QCe4MRT(7qwLp`5a zkcUQy6d+CyEe>ate1Ej;IEI{MdzEH@YocO4!ne4|;gQN8I=BP`IJi4h zX(LyM?X|4_T52`XV+DhyJJ&H$ur7XIh(cY{dv}=498-n`BohopS=s#0o{IV-28RY= zq_Oa$^CCLm@~eIcCV-m;+nv6yb-L}}v7BEd94vuMQ-H1gEE*N&eJ?QT=3g!aHyOD1 z5dQHrrYv;Lf*AD#L@3E_xji+7U1h?x4-_TSL9=cJIJ&x643Z({o_3^7C|HUByuEl+kxoU9**G^_*_L+zOew`J(`ep4DjLc8m@o(~J1TdgZwItT^6 znA0-4wRW3P-@bzJOfI`<+dtpr)&2lS5kU943in(Jim&z48ni6 zOE?%PF;Fgkh(gtd@rU8;Kj;I9(^Rk7@z|ie-?99itIIndQCtO_ax2UGYMco*#*Y*S{4rrirAb zC*`APDQ}FK)|Zd5(eHEeK!*2kVh1KBkaEQT#u-+gO)6M0cNp?j%oKXiRGED#hy#R; z!effE2NQxy5W?T{|I_gJ#{cCd|4UCM#~w3oM0Kv-n}3S0jWjpLV4t(Mwkut!{0|Y5xoX zWCk;w7RR3|rl!A+GYt7F2E9xQoF^n2waT9nNawV;9CUBe7SlBpMikxf{cQ@CJ#-zn z<_dkD{~b>Uysw+GZ4+2pJ6Y_!`>5XAo^e8eO^-wYA%R+@R;``O?>3mS%SwJ1Lm50` zNeL-k^ttKBsOT6zo3SJV7{yaiP}DGoJ}*EXpoi8FLiXw^s*kEGm z+;rTphfME6h=pVL{L^H-1!a|w0m-?!j$MWz|4be={~E5W+ilhLu4O;;S%KpO`x&0*cd^KJnurCaoOlB zV2_@&>v%!>gu&?K-miZ2njRSzx*uuqMap7Qo0Eu$=Pz&l{9#E5$Fy6h6jDW5`DaU= zfIB|KA_lyt^9NDRqBfEeU)GDz11Cap{5F=24?2`s5Y$wk#ac_-V07j>rhLzSJFObk zD+K*KOAh;BAa;@-$?w?8v_#WJM>-sI&%B+K`1$o|u?vlYy1*KwOuwHPzm;>M@cpZZ z%LsX%A@wu<_sZn3I-fCAB$~`{*9tV~Sv$dfSWi)zvjI z_J1uQen&obg7K)otNZ`8GvMn_NM}=HRBj@rDOT`F7xI|cld17>6rAJpbGmJ1FyEVv ziX9spo3M@ORz}ht6hp}hKJi^4P#P6zAE(`6#+{L6N9-uB%*nP118-mjw1FA65lxlA(qE)RbgG_P?PcS71%=WuVH zI#w_L)*7jEcAUSNz(zzH${x-_oyA*v%<{zkoj&ipwrwSk%wS+(F#mGGDBWZ+Rxt$U zhXMf|uE(7x^_~^Y&)mo;;xqwG%R5YMv$eNJE5DrhjeJ|#frq%Lsku3SP)A!kVe^~5l43_sAGA-L z&(x4OI~^=|Za*Z7Ztdctrj8CTx7xB56Oo4f7f`z+sIW}!I~r~sjn#xdVmhI8Nbm?2 zABjQ3p4x0lb*FE*o*}iRm35JIC^f!xc&G%G=|1?JJy_iP^Nrft+K53f;yR)($G1{tqQetIX`CYAhTyI zX@5n*KwBQVKNS}jH>c3Z&h`CVHvL7snTuz5P%?oOrMkc7wE-()2o`z|rexNZiM9Lk zsF_IDHG~e1P)cm!m|Hs}l{u83|F6B#>fp}!94aa*x}l*>=XZG6OL6|yn;_(?HJEM2 z1V{1z{h5PN39c#sN(bIP+7bTVl0#IdT`4tXYRaAy@(;foc`+9>Va-K2WGZOw|3OGz zh7SVF`Imt?|HRlHZzvRSN0AIF*lpAxq2Y)x)UK~kAGW919G#r(b@ot7l&U91+c(u~ zn{}BzGhu;&kH6!Hb^K3wjt8H9&Ny&5>9HBVA>rvv2IuqqAJ*P7sIG2_0>mY_dvGVX zyNBTJ9^BpC-3b=lgS)$XfZ)O1-EB_teecbynwgrKs`-PR!@c|N)7`s!_gZUfjjQIn zSeb~~vgXgQe_nioSRmYtz zSrDS+kP(kuf|*%e@9L25~MYP%3g@wW8 z#}oTgzL$au%xy)KT3oW-F~FQ#0B#*?tFHI_)-@5`Bwv4|(?@OE`E+>ni_qfq0(v><;A!nKtKXE!0+xfno z-RXR{-L!t-_Vdlwmw#RD+d5bA0-Bx?djRNq%xKeM*uoi~KYW#(?_;r}(x;cg;KS_K zv5cq3%Cvz2ydY3p0BWe)?&U6I>7PXl*E|0?gFz2AN2MOmslVGAWj6;it6R`@n_>NB zDtfwg{>!cH`a|JF<@=+rF7I`po^)xnMf5k$)5WM&l|nr)yUn$qnug}PSL)E;&lU4} zjmx(@y|0aEhhP`&fhRw4nJ#R33w2R1dns6T>1QvDh(3M^3I%v?K2+5o2*h9enCO8A zaz%8FHELiIUavr1Pl_~2V+v%}ZVT@|&F zyYV(;Ry>i`S~AGXVNw+k^q^*hx_qi5OAUzPrj)n3PDJAcHv#sl8V9J-@+DZE^ z+F$h6YyxZZX7|&O8Wz9%>*w|7=l7>3+bkr#22TFBsder5YfByD@%Ou~_pY49_lIH@ z%7Eo_E{V4Xt;+&AZU9hvQ7Ww>`OFHjy}|XSwyKecusjDkK;BKr_U(NA@s`q+DjRaYj#iVs3E%c*+n1$M?&Y@l{rLSclu#RCVkDmL zVdecw&-QJ1<^4wQ?Y=X@&~PPnyWckNZDnX_edYREVcwO0@~zWzl#rwoQUwSWY(q{6 z-{a!MC4t)jR7f8ZO)SDgNe{4?{3)aI0r24-4A6)8g}>-0L$SroyeCie5zJM1kN~kk zQ$~^!IY0j4Q2&1Q&n*CWBh3%APMxmfqfQ1T=OL7I@hmafHt@W%Oj$Q#*Pde=FCTl} z&Pr?OO=OkX%YKL|`<%YqPE|p_?Pdz(CZrZSG=F^1@$I>v!aTVT&u@s^je$S$*W;Zs z>sB43h(KMmW^V(1)2dKKcPui@n)HEsSv~hzSYOv8LN;T?4b$!LaCUHT@bOvGFw*P1 zHx~k{*jyo05_+JLc$gyG@xNdo+OE)Sz~H3G(axj}t1wgdaIxh(JVkSrP`qOcRaA` zH*g&VWyOxuWL1FX;)#33RGzVC9V*gQBR#mPo<*!@4+N6wDEpFPIM}l(OIbOY_yn~4 z7&}!SH)Wp{u-b{*p(W^<2_&`LJ(;Go;J)0sqd0xH zN(Y1i8GL&6>-&Un=_22Fn1TMDTh_E+WW-h37zP!9%E0XXmYdu@{)?+D(6LHDAhyu3 zXoUb#h#fLH7t^TT)rF60|8h*TKiIva!AoL%e6(e#*uPuV>1MoqR&2s?RRuY-v#PwJ z%8(jQsPaT}nA$MOsHlD}WxB3z8ZGrF+{3Ib>a`0t)O_-Pv2nhcEs)0kl;u0^(MgB4h3AYgtOYw5W4I zV#YAR4Qck_ONZ1yRiEiDPh3qTZG^4T6-CD;Bac~>D{R*HEigI?0R7#<2JqTW6#K2&WHkuJdjZdYI zv$D1DCZ#%U*p+uHsk3iyBfi+9^!iwpN?d|!Z!|}6yGs(RO`}LfEjAM}DQmh?g&%6! zZQ1$Wih0oy=%f1DDKqbD^Y8Pi2w^j|;vr>1Rjrkh>W5S;Q^;?!l0&#X;0SlV+&X&t z7LFY=7!4WPXER;tauaKi6TP0~SjZQ+AR`WxaQery+r}J9h#jrSUY-u7#A|NkD3)gf!eXoZ!R1^Eil~ zMCrBxv<|bfvewqt?(SR|1ABUU1_lQF{XvJp+`YW;A=*|E*|+Ir83~_4w#u?Gz3$NF zQv|4=PAK&Ux5fm5k+7XNY-XjJgwKao==J{I7R zW7kI+{5ssX4+^+EP!C%WqzUV(S6^C1mqJE6mX(K+ZC~DhHJtvL9Q;`L9&FqqyZH5 z9nb{-2&B!%4$V*}wU}61lk4to20$`E_xIf`x>vqkVw&H#m)54Z{rs_?<)&1}_-m=N z!h6_^==xAeo5L4NeOp9Z{ zK%Gido^O&erm?Z#YqXxtbJmqzs8B5}(6#^71MQ3uJtv~`DYz6eam;f2+M=O{6JR94 z49H89#7E0TNq;K;bZpIr#LbOMBk;UqXgwRavLDKvAw5dwBV|iv~re#WpqdGe;FE1<%#*B=VG*CFVeWUI) z5g|4D5*wKQZWdfSV?Yq+W^njbGF}2kLBqYn!)LfWtHBzVPJcCooL=oG7vt$7dkvTN z>eWuK(R)Oe8)~U)ZmPnHJIR2k-tm>FtIRH+%GW9vV?*zd=1z~UQWIknkP~yR}ojs^PX4GGNZ+>Xea&?>hV^x4K03F7PoqB^B&O$7;^Zn$H|+ST#q&$c%GzAdvt*0QN=oFZ z(1ATYs-4YiKP=YZtW58dmfb#sXXf*eIAGDV+U9lYna+5>m5+{ zkBHtMI>4E?#ekLRKmIY+JU;%?+n=D*x;$*d*m5tfa)R%!XLy*7W~VF;9;V<*W8Zqx zuX^!v00X(z^jGPZFBrT1jdYlXeyT|+u5&33lIF?DyJ(+kQBmR{Zz^~`z}4;SCKtM! zdwEP75nfs^jy~-T6tB% z5N~E4jWmHKd8b)RhT0JcCiEW|-Zh99%JGHJc^fqR5npHc?j)^o_rVqXAlkn{2WYQ3 z;YLpyjr6yBxT6Hh((aDn(V%}VQ!Vvl_%=dXy7e@P5-&fD32Us4sce3lNfR1uV65c+ z6)TWo|AUd~`fD6zQiBSNak312WqW6%P>$8Z@n_RRR*DQ-2P>SEXPR@l9~cBXJd%{p znq`pV4K2iF2CFtKvAiX;fzkGyA6m%bz2#;&nOT0VX_79hXZ@;}ieVq-07+{uT>XBR=fNz>ijFy$7-~igNv7)o1gm^$FDglKL^%dIM3+igG_1{e(@?@2Ie6zrcm#MY)*U!j zecIKIe5J^v!R5hCoEvz6vIo@;kf`P50Sz+3_s1z;pcgZFy3z#Xmw=W^U2W}ey&UJ? z-Ig1D0l;!(*Ix9qzac+V`qMEq?DJCKB*oP#`YU)KlIBYN(NMWzP8(rwbVIQ>Pp@oUGd09iWZh0i?6MZ|QfF%5w_|k!C`@FNk$}-8SBxs5uib3#yt^2Lh zALsJ$Xg96=yO*xHs;{lB8jih8Nkhk1ZELxL{y=!2W@9%DUJEb8z+5wV)?1`#8A~;o zt|ZJ%iiv0l$GKRvNt~Si!tV5%s(e-IU1=xf3+3nvQV%hm)$tdL=S4{eX~oiJiiQGB zp|PSOlO(dxDH(X-Psc}gCJr7A?WqY#Y2P%GG844ErwmOnRG4M#V4_s{dHj?gC^_9j zFSO10_I<^k?*13u9hD4Rha=oZxAjRv`v;d0WzlRrtFsgGwG4k*lFZqkuNBa%1hllX zr+oQ&tp*|Gd{h+qZNbe1$*TRd!z1}c#&#b#?NARhG;uPtCS_%&3ceM6hUCVxE8%qK zwJ|qN)3(n}r7kEoafpzT{{{!pBlw7cOro6ztA@^GE9O$+YZL#ScotBPK*7&%O`av0 zg0r2$0@(@0f3uT997y=adPX)essvH(cP}>&8=?FuYVtEwd$Q!0@`KGYkHnF2TYRgt zH2t4xu*#L9REEr{NFkUvW!v=$ijqdcic#+;g3nu2mm;%4=qak<)3hfV^7Br-TAXlbvZZeO}zJ?JA3tE)?T=?Px#I{Keyp} zNW$`|s7+{uNBA`DCdM=n5w%CnEd za>79Vv}EGj8G(}4)gN#Jaev_5z(G*&XzVO%VysJ~*qg6MI!`ZYIA|-?s?>WW$flqe zADhj8lF4v!2XcaOiFPd;tq#tH%6W5xYR!?Vy1Q6uBsqG{#&WF{E$~-@*H>^%yb`^N z1+)G68<$9PJFiI-MN4*xP<<9WeNu6>Y1%f8bq-!OUiP^qu{F66uLqU`_McwZ;wV8x zwl-X8_X86=M zUZ3v)>P1~$odzA|_(Tp{sj{ZL{Li_$pKU7F(s@aaW?c2tEb zZOPhF$zw_*2;9n}XY<`TnAHg%F`t!re0TTmgHW_Y^&kFpw!*ula*S z2es;^40(lbE-ya;?4j%JwyNu4D{^pf5XcMH)^vf9D=P=BS>8ij@nAivg?XBUSHyOP zK+bcv8l=x!clMq7gMr>tM6`yNX^)A+b;P!d@VDA1Mpub=OeAp^f9>=#%(rkLEjOSk zh;gGLFZW^Yu)dQTU>yEg>*Z8oXeh$mn(pA+Xu1T_FvubO3U|!ovhRd_u~PMZ5ZmSX zoZr=XJuxeFNPG@0AK=ehHAb6 zKbgS?w$e>Ybl@&O#lF0lvu!M_-@9LP$tt+*a#O+?8m4jmvJksK zJ1G(~D#%tOk%S%R4JMBl%%cH`GQ{y57aC|AEqM7f#NhiPR>r4E4#H;63aFR8rJUye zsGngwK|Ap4VK)y2ClCGbU2*-ips>CVzmWcY6J4N3{+k(9_=qAu|J|7Q&~@$DjA>0u(a}X(B+sI((Cg*Y0*_u-#_X zY-Pr3nFv>tnt2yjuG*NoqWsJ zvVKTLyGB#;K=ac&iWN++Zl~PtKyn@3ecthsb+o&(iN-I{X&gaWnxtG6P;`lsoZ4?$ zge}qmqxd91vJ7AKON@?&EqjPYg(|tJT^QKrry4Q0%6hoVY;$+#S{g~3;(sDzXS$BD zMUPa#$4GQL9Cc2U)>KzlS1oFFc$73!4-=-yb%cc1{30q{D@xIJjJ83DF7!n*R%YZ9 zF(SVP(x|vO`w1A zEq_et*p#(8=TvhhFmc=}n??O}gG}hI6lWi)621yY<8@3bq+@;3nTmJGuTU{uaEBGP zCTzgS&s%~Vl_HWfaipIlSH2r7JabK&3Ka%o($FwhUV==JXoK2_gqjG&(Ve%Nt`g)# z3SK1#KD5st9y0^(k;BF_Tnvmq7W@#EseY6k7g>rJwh;l3MAL`F6PK}udf!*rBXw7I z<1fnCt&o?Ii#L|94dLOI!{=!eE2XpfFhjAs<87d=rPO|b-rH+;7Ky>@D)eNh`g{9} zS=X`Jq>tN~fUhqVW;6hQ27!WK>wEpgMY-x{a3LfyC>IGDY5XDW2R^@|aj>)sv4WpA zu?i~jFlw-*^lyCnM5?h&uuCC~>}V07?QjWNKel}tm+qgCfU4*~5+8@9+>ffEFQ~7f z!Id$VLNg{$GAQDLXLs1JesWLU`GmLJu%5(e{B-;Iu>D0@`5xyV+>eK0clSpnE~Fw? zMkAg4JNGyV7xpcSrNsHw=MDOE{m+;+pmLhNxRt8fV9$fLl`pqyhkBjP`yG0#uLo*4 zdYxizS9cZnzR7Nf*7FtX9==z{-Euw{j&}>hgsNU0b`wIjvJbpY9(> z-d&eB>Bf9?h8n%tpxARzf7sH%_zP=|gxBkGbYA;-7)aGcj^FWut)rB~Yljygh!`FQ z+vT~!!A(Lz%}>w7rj#rHu-byM;oK%opCGa8KujBgnv$7Zs!V--T?=4~ZM~f}Na86z z2Mdqn1+;f}Z%FtGoNG1peI*h3nxLeZAQB+*5ETHj?iZGGq1E()N*Y)~jiP~5D$mbI zvo%T3)kYkTTEmFSj)R+)njW8-agK#PNcAa+R;4FbXus=$nVyNdsya0Rxgtr5%Mj-? z+1Jb9Lar}Kc3l~+-dm&rTS{A{IQ9xcu3+F_9qQ`90`tHFg6=@PB~pHa@=nk^5gl$oH2n)8uNI|gbGiN&+cYI}o?|Cj>#H9ZrgLz9?7crvaN)q; z+21F!VDkv|{HWdLNLf|T|6D02F9@P8sITs1EauLng^h}jjxGd?fEWRLl|s9ttLvlT zUJv5CE+{}qXnVfWbf(Mi3%lI4i?(%)B{(JZ>CCHN_p2a2Qx+K;)j^^fYZ%)&xG5S+3wziI z+EsT|#V)L_n8PxqRB5Zy?7V@3g8Fpk=AvAhFXb|oK0azNGcoY9b8`{z%|};twtMk3 zrN(2PVkHW;Y-3@6h6N&IO}v5qNLtdb9p+&5ZsW&iw_-)}wNB8HX#*5{Y7H)T#^j5; zyIX)|@B#7i@n~$tm5^^H3IW?u834fEbTg+ZQzZJcK!9q;C54R)`zlg1F$W7XvZpBv z2Z^RDQ$Z927CE|y%TZ8Yz78#?njj;#H0YyPDm!~Y$hqe+XR8U z0_F(?iW@(Mp_ryjoFWoZXUn`uHY|E@QxYd(_025g1VmZr)ekE39X3q6mx*VUx_}3d z_>By8*#BLW2(e@D-*FxnqNuuKZ^zchetwaP8GuXvbz!a(%#+^{Pek)qF-#RFmLNOy!!SY209ix zdU$X*ZKUX&=hSj~QuZxRo{I_!pyF;Q2Y-;yz_ep?d1@&fs017H`d`nZwc^x)FXL;{4rp)wex zr$$3SHR7_dFwmxqze(&$ehkGRz#&Gxh=}-*%$&y^tAdI_Fk~=G?ocSvjS|+cp|PaV z0yzLLOBUsmOU2BrNt{@HCeU;slNJYuMrM+ynXAIdOJn?qr`6B;^{l*F8vpaiL}5U=m8pil$5X|Q?7 z75o!XkE~Gfnv|53E6Pw)NY;?IFlofZzJ(RDDRtx%6-@x*J{HS|+Sx7Y8vWXzD?tV5 zprP^U-{QX^jKJ!5Z+M%FLE=-87Uz%&RDpQFOsW!n>!% zHEzUw7#lbf3-b@qeMre{UwWR)Jcu|0V11>lsLPKBa1n}TCdyrnBH1r2YT%m8nQ^CQ zs(p|lA5i?RWaXFI!0kx3F&o}03c0kp;`%`j9f+7S05D- zXP_Q+hUTO7FRtBh5;LXb!H^oF?)xwA2G)6jX3Ovdl#R#VLq#a2ho?7cwNgMZZ|82c z);Ox_7R$>(5N(B+i z(z?Ln*ccBZnKYRiCUbKqf0MU2__iYR&WC}C?zo=^{WrWGR??!k}6lQTNo!(E183C-0;H@Ari7BO4LQ4#X7&)dfU60-yLPcz3?J+7Sn$ ziG+_%j(wUOgDAVcy89Zr(*sa;G?sXC`xo{rWA%v0(-se`-{a&Zy%c@Sm93O@WuegT z5a4A-hhr|gaIo<|?8C}?;edd^$GDdUAT}9I>74_`No`^Y2>y$&oUj4+>G{{%ne^3}p@Kxe zzaDJsz29Y$Ng638HOY(9i85vR{Wnk=)2O6L!Xn=*7+s4_F*`PX+vo~aTx8vRgSz2qUEWO!yhO2p?g@s`&X5>Txc)L6C}ut z?89v7ejdQnh;*X~LkekI*%?sh*B2!9Y#HritX&`mf)y6BV$a7(6elYhCYD;+f3b&6 z8T!g{=+MIZb1K^nBrq&_ub>c6yF!}MQ=lOue+&xlZWI+(&@RYUEF`nR8r%84#cS9> zPhkUt;_cA+W$00`AdJBeJzkr_@H#A%E{qQ?(k7H!ui;ws!-o$rpQXEl1aPAfiPfp& zH{g53L>|s4^@LO9wgn%Q!BwfyB^E*PbrrdlbEFD7`2ZBu7qEIyBJe#&Y<)uJ8o!=R z|3e4JEfQ{^09I2Qj!X?GZzoYF3mr0YdlVleFS-_;2`Y%HJ_s77im0lJ?aEe@5dAJp z0S9;0<#K$MY}u4MF?^6JrDh{8F4jZBNJb=BsoXEBG=rK*BHU+?6dDXMq>zwDN)jL< zq9F!ottX`howVPG!p5SYp2*RT(~L?>NJWIh#G2G-fPtnA(dA+p)r9ST-naqVNA1<` z_6x>0P>v8RLbqa?#R8mY)D6t>-G|`|eUKcA?m%klHmGI0pWYdo?}X_ag^I z=G{@O>?g?J9K%q^zj^GvAe6LZ73#2GHVCtR!VC#amPNNLXc26`=$=BJ1V}MH86o{Y z_5#o?(v;!(Rf&?ZFsGRvq!zvG4X85)_k5jCZER5Zs96|jyU1wR>8V*bD5yUXa{=oU zI|(-?&0xX4Fm@K1e3)477vXS0bX*2_S@aN!4}ECiOSYm$WaJbi{Pf(cBqZ!Kyv)1+ zx0#-Ug==w0kA5#{XTM)ev_=w+MTy$o+}?|wV6a1a@8u3juOKO0KcXrrU?0OiRk-t- zSf2ayFp5MSoRpH|)d9Yb3kqLVkp1>@Mbz)Dpq=qwRu;-mR>G1dqE?2|hLXxgRz{*^ z)9Gl8`l)23aq+E2WXHhf@9U5pB0`wkl6L1Rg zeD(1?*zJT`E`0t>b#2K5I`yXr94kZ66K%X&W`oI$SV6*Y^LWsBp5MR z%p^uQI4P2VKCl2VRMfeopF5D3_zsYtQkN<`?(-ZgO>ZcXJ$1VGDIUv99n(KKk({ zGKN5r{Hp;*@4Y&6NILoy6-kv*a>-zPm;4}F^e}Sf7O*|IH{zrfU7=2&c-M}=$Oy?E zVrY-m*6mZVPjpwor;m_gP>;izV$Ff%FGj7ILc;rURWUaFMR(>v-~%|~<-OvMQDx)Z zAGNh4+)d@}?MdX#Zku4_6vCy7$aNti00s-73Ow^dl|y8c?1;G~!nqr=}l?VAvEq?#IcOra-L~vtQ~haWZhLWu(!yn+wG2;^F)NE<2IC*5Z9U zf4XAY)$H`Tp(8uQtZVU1854#$0JU(6TU!la3 zl>SME+=(UIH{*UR6Bv0ZCOHvgq9H6F4D66EpBH2w6)=Z)-antn67#sr$MpIcFvLUD z!K>jux&GPo1JYEa0Y9B?5_HUOMmyoi=Z)?#oOUNxg!?4k@T=MD1(9B1$cTswzZ`u% zJ^xy$<$Y5H2zL}BvVxuUD_H695BJx1aPV?r2$2_UFD+dQxAKGx$v>oXl_8≥Y|w zOuH6N((ccLEfwpnH;nhAr*mF2B40ydKvAKA2#?=f`bBc#$xm#+&;LeT6K)uOGq}n_ zlU$4cE#KVUJsf2KXG9zJ(%Q5OS+XS+Am6+I(sX}gMHh4k7XvkcRJZfk?sI2}bJsaW z^Gprs*BFMJ)qPfd>_jtW>Gs=cYHIYWfOcL+3%lNfV+dyIOH>yw_pc$%8f4C$l$p(1 z;4G$TB($_@^lHB^ufn5a=ox4!e}GJCnOW*~D-+Z4Y7^yXJq)B74cNM;P0yS{gQ%L7s}N6XjANe90?by;AWzpX*_an!cel zYsy$K*U^NfTDQbZLfAPHW)V4XPzjL4>@>r;d_k0>i;RiVXAVESpE%ZA?eJ*``@$Q7 zgP!~`Ee<6jH@5D%3U`2!18eAD@ZPS+vc5th^KQ$^gx;_!ujsUHd&Zd^9b(Ejx( zZTA%{T>J$Nz9zp_@JLRf>HZLT;n1Kl*&ezi*@tR{Ej9On-o+C2PWdgo4FtrenSC`4 zuq*BA48SboK+bzlb{_g4#($v`XHcLx%qVUZlF*l>HuL)){QF5~!3k|80^L6XQ?qF# z zUMHy1SKhGu$7l@!^e?cnsA(aoN}oJwBpe|+94Jqb$kYOs6-W0Uqxk2YA0Pq15fF$5 z0HosyyM7BiBHiUqkupiJ3Zo>tz>9+K)>ufW#o_-}37t=K#^<#Aw%RYuOw?Ip#z`v5 zna>9dKOijxT)Ek^d>#{<*U{z|EfEa#F^W#68Yn({tEzJ@kJk@P9uB z02s#y2<`uXzu}>-1At}d|3zf-|3Q25|NQeG^+^WM6F;UuR4;c}edwq^s+8kWAUyhi zr73m676A=Q;NmrEHzM|5t;!S-m+rsBuy%-QfB^$s+#~lR0Elb ze7hC}4m}($KKo5YM@Lr2_tn7xRYg=GS00ABJ}S@8^UMaZ5Q!m@;MwOlP>}s>a$R!| zjUq$<_-G6pL?<8BrpB)=KT%V|Hf$iKg#yFRvfCTS;j|Z&7|i_6=ZTpq59nu(6a@O= z|M1KxVPme1%s=S6gmyvr4T8f3e`jUaM2|>taaIkBOeETia%uGprh<6SNxJZSTjiS> zbq+pG6nkR^sC%MK{n6!om9+p^aDH?PUv{maHgPzUPQCUm@4~1VD{Eh-e3Q-B#H8=ctwmK~=@hpj36-rPrN&%mJ&M z%%_5>%pwH{dGeqjMj)sLTJ&k-j$j#%sve?FPONE7Se4=~90xN4z#$i6tT%C!ld{U) z1AnM<%;&`NDdQ`I%5W9c2DC(d^9tYKOux!;QGlc!4I&P;eAUinW^|KBzx+dRL!B;| za3{OtrxTsf5kb6zl+2@pNW0`Tv*PUm4Gayj&Mo@sk~&F2nsZfaR+%%O2c>`7tB zn7WNvd+{pUFkHRazw>d`8v*%|eWCPX3BNkjTd=r`pjf9+5jMQ?`quNj16tuea&cHL z$B`s$2SSI3oD`|)Hrm!JFp5V=>-Ra$S&aARVhPUuJSs420)T)*)cP!um%t-C zA6QK(ukRWtfyGm~e}0Da@b#X`@N*iUKbRfF@NggPn%&DtGul+_2%-!6g^~7Y+SM-< zIL>1}V^f`G`WEnNSEHlt9Bt;U5K3@tyZN>JeF-Ii3TE_@`*=bh-lHGGGwhLl@-jU9 zwvW!}BjK8<6w?bz>fU7P>>trGPkw-Yc%@F%2ZjX;A}K1Rd#{x1S;-UEyv}#Xckg|_ z6lbUw?^V@Us#c$o#RMlZ0<+24-+ZqXhj8)DUkeo;dI;|5I~Wn7zQrJqI1 z6b3IZ1$|Ca2_+AOblW{-kz^bgJ%ZSDFUm;RE8-Ypg+DyeqoAOvyiT__3D{ptnSy4F zAaRH0xdCI2a$yeW(U(O&81H=EfywdoJS)Zs12gK6CMd33rIa-7@Rqa7x(BsBfZbVqcr2p$QN}Qog5tn!wDi#E68MXxx0p41$Q~&;U+z&m##maXLf*>`?R-JdOYxo zE84nv>i<1Dz9N^lPp)&cBV#oMO`CJYCuw(+Nl4*-3@L~09;|H$!%rJm(=l*E5yG&m z4~+UOSO_Za#VUvP1&~vSI-jLjuA~Ha`|Jc=`I{gVCa~u_+0POCdmPYA-OYO8!AxZF zu9SxS*@)wDm|};pUIz#<&_5$boBA0_pcd{rg@GJ*u)PgVjN=;63eE2}^hq3K#uXjv zC&AJxrF}nOEV72K26?MPS|JB#yQD{_XHKT4-bh4-QxPSeaxUE<5v|X$l!5eY=Qfy| zt?N;FS@>v92=m^n@ZE8C7$7dOv=FV?AM%Z-xFC#9UDdTUMI7n68$kG|N+9n$i5Hr` z=73F}@_K{h8yXog5Mk-8P;LXUu-|`DlxOig0&|p{)F#I<`q(Kd?+kHH!*-oz!2by( zM=X}7GBS=w(DZ_!*coJwgw*CFEe12JZ67*};5lY8T+W3ZrXJH(sEAu=0ejWHC4#aV zkd$8Zm>~q2aB~sdYw@R$_B3e`g#4Kdg%lh99IXPy1|ToydyJSy)cqSyAoGzZrb|;{@sc}q1Jb+{rX)F;=h>PZ=BoSAn8yz{ z^^(L*%O@BPH3Jrf|ND7vHW>&MLN1`Q5dFXzMFfk?vd_jL!R zmTjiv$BD__QXCAr%o)=BovzW`(Mh;4)($j0;YIcOIziy`htbG&OHD^XzjDQNRGX2c z{a;A{0u0SW2~3j(c9ms`PbSc>LX zxC->;Q9b9nAs=;Gov1mLx_+*6HG}{O2{hXCmzf9OgdbaRZ>5=(jS*>@y&`QSDWb@xMYKdKBTZAgOHZMcYA)A z#?2E z*`jR#4(IHndhLjjxEx!R^ew$PJXF59<81l78FBdrI!|Lccc8tOgO^dYRMo6)diZl~ z$NhQoj0Rqrlt<>gVU1M@8%3f*v4Y6KZ%!ac75>L2d0Bp&yK<7C)h_*bhDvPAYprp& z^RX`SwGvxjm|fzntu56t!`GxvE> zggXZypZ@Dnf7rF1y|%2@S3zK}GeHA3wkNn%l|POwexQ!f5~-1)FP49ciPw0ZZ!~sP zs$l7*nYUP~*Zj1yf|%a}GC^TtVr2`Q3LNRX z$tA8%I_>S2GLxqY13Igmo-Wi!CXL-4~n|(+EU64Q4HXs9CpBp5U#iN> zM_)-+C+cSC}_w7OPZM zpsg47PMLgVWB~ayFJYwi-3P~hY`uABXEv(FLwavFZ_1J7z8dQ@EV@$@za2PxNdr7+ z4loE_F;3A`%f8HWAGtn8ax0vTj=o%^lZO%~v&D$_D=|j~Z-~xbrT*?cxuZd}l2Tcx zu*QK#vewR|DYKQ5o{*IsKQgxskBTLdaVj|2LJ zz`5UAnwmLkjId@F7JzVk;Mxym8e|g_6MX{dv%a^*UzT&*#{p0LU-}p;TC3{wii^CB zj4XtTr^&`z8{u)?`{Hsc1-jac&w4I~Z-j+3vhCelY#l0%_YR}KGN$fB@aT`jZe0*C zHgj}jsiRx4_M;*PO9(cjDm0UR*o>hH`p?hAsA13*tD_)9edFC}axf|?Dz7#-cXu9J zKnXT(5B2wDBtG^E%bpp5eoQ~%1AMLKudm^U|0%XoQ^5ZC8pNLxZ0`mryY?Xb|I}Vw ze1C5Oz5r<-(qHofzA&cFg8#=g>z1TV{*-nKwa?ZKz#%`YtE)!rP>$_f!q9-0q;((g z+I>)&27arE>c>IjgZeQXpAY=Pv*G&xz3}&;;-2`yN}JT}Y3TKXJ|Dj{d}YCL70I7N zsq%MuyShYM)?1f9M!Z&;KBh>7m6fL0XP{~W4|gdu?$S$TKDd?md358Ei8(SAe!am< zP&aqPoro(#!KrM~Fla{fl+S@pduZkP5~s%Nl=<=Zxe+_|}r5$|BRvJ80Jq{+EKL zDy_L+E*zCRKh)gXr&NyjuHRY>H4JtJ2kDBT|;rPbl#%lEg?WVh_&*NS8WII2Tm#1jIGM;)SU;hXA$DltDZuOYkHXNscYkT%r7D#TB?CX}C}_9hMwsV`LCFYnIF zO}2?HuY;>|m=JGnd+DbpCNiR0!3Hwx${zyeU9>ySN*m( zhdXh!JP4etRJ6p)$ebI9!psX#la-aOtC{L=J;6YKJXe-j2M3jDVq->To;kZ9IMecybRLl$e*{3wc}Hs_A+z zMqWf?#w@={MqqylcwB!YT#*02zfMeZ>oXz&6$qF1PaG(aG~RRGe?l(I-<>CX>OUcm z^>4`Q+ZRZ9KXY70no4=Qa9oZha)Pb2`|Q+3w-6dN<8wpEQyS#ld6ROZj|bJkI!qoJsavua-J0Ax|O(He_MEm4Vd~Ykj}c>n5F;d5i4fdfj(_-xt!LI>dgS=gWxX`!EOX;ht89rHeAiC85A$ zifh$S0t#hh2gb~u2J;o?`TLVvK~Rr=*5LW}+nM$z(#AFQEg?@4E`7DFl4Sz__`6W* zj^mfl^Q$w2J_+x!nNq8+5$`p|wRw3w9XV_wONk0BR0)ltFrF=zmK_5GHRJRiVsa4$ zWkIWM`{i|P5AA5LNIUGnCf#?tn0e5y$IN#HC6!y>cRgR|D_fttM7_5wq?5%l!k3{8 zs)gp7hXvnvg}&hr!$;HU*Wm#fzORp`*R~d?ckho#>u)_sz7KoQ3rdx*&PKrLr?(7{ z;r{3EyQ^L8kEEeCJ9X8DC07*y^73Mvqa5*bamj|>+ikYuL&c;j!PDWhZwJ1%;3f4B zoX4wJfq5RZrl!*`O+G98dwwfoX~c(4RZ~7Z#&$2K>nNRs2lV+xkt-jEYp;@4?bY5F zR}1u6Wmnzbp}9l1v)}LV6Q&P1MW zkt?sLh^PSYG+of#DXoaNU^iyU}yY+fK z&sW?I{|D$S#WMR2C7TtSxeRupMb?AH?`ziH(O$m{MPyPFd!%=8CyWpp<|Ra(aj7ip zQaLJIh8k7MDA_wYJNM|e78mUrtBt2Kx@CCA#WSy;+3}2?j|-CXuJDj7g<#v9XRXND z3tViLOBQly#OnqsKX#;%5s_fSoA~woeFN{l}r09d|(EaM9#VEy5HVw@Wj6BAkMtG<9ZfPD$|uGGj4wR^{mZPeL}Dr4b4OUIPrb0eYKQ zggTEKiIzV5YhB*EB0}Q?8PRSDIDuTEao{fYUifzMvZq~{3?8Q%0_)H9`Ysxu8=Vb> z5EmhV&@v0%2@&n?%vAzTPe)h&e=v1cQE_b1x(=?v-QC?ixHi@_?he6%J3)gJ+}+(Z zxVyUs2pR~kA&^^ppL6!O5A+y3KzCQIDK+K)%FAtRY{cj9?(Wvt*T27Bcq*1~@$le) zfo<6xzob8zFSnn>zz=}50OJ&$u3>LiKz^-%b&ItmWZRcgZwBJQ=N4lak-B}E!ICOw z!qEA1Lr&?C^fWs)|NNu;Ub5%kMFekPjcB}8h2H^O@Lfd{!f3$z@;B33_4yWbS8OKjQJzE0mY`!zv_bkuG2zuy-_?Z7sBQa zO=a)1b~UQ9qcUu#(fTtpY}YB2?Vl|Qz#MdCMcQ|cZ$0u|vs`Tvj4Vz>?Z(>kYxfu7 zc?uROF#`if$j){t&5ae|8Ciz3=F09{A&K{gOngm&BMGA~hWhD5_TF=>xJXAU?$B&b zZZ1rf#UdZd6%3DV=w+geTL{JW|EFPI(9aR=26!((p%;Y*xzj zp~}>>T`TFK!*&>tgs-`!uKQ#-dDr(w1lq9-~9Rx9^3` zjrS`K(-S;dgRM>H!$(NI>3}J1XdA`xdJ2#g2QefIpuWO zleLz|p1N66S{z`Q8tN;GE?rD+x_=76vm$HC0!MqWJt;!)tGAY2qcIp~knoN~g8l24SW>bXOA-VN=lB zURl=B^#2?V+PdHD#izRuHe>`@1jJdv$$Qs= zh-GO@MH;T(GzTtQc~@20?ZgQ(vq=dr_-kfc?&IPfJp@`KezDn2RdEkC*^TT`UM*^% zbwYJL-94?1jh*aIt=&u&Pp^l6`}VscEOx{dEgn-p?d&dC+3MM?H*75tmSXF z_gJ=R?oekg)PnBOQCXDZHez>~TJ4Ad2AQqZfGMrxlS8`w`x*y3qMCX6E<0f4W5A3; zL{WyL(JG@a7xy8g0R0MC20B;!wuId>8uYwvAryBd-o_LjL^CguIVdN-+ zKP`5aEfy8s7LWd$oRyWeHkJ#r_TA90zf4wap$_+&7_EF;#H7>^)$xJ~ep2%!6n!gY z{qIi;TRQimX4aaADHviYKY)nxuVZ81!@844-{TXpu!5->@&JFActXeDRvz+x7F0ir zT-7%-BCUrJoB1c6{Oh~Y4Ir!&lMyJSM1--(H^gK_lj9RQg4ye~q&045|IsA5rOYa|m=4#X5^y{f*u^`Eh7*Q)4CaHd=rRiq@lsh!7;bJ{Y$aS^J{xuP&rVWrVWR&H+76_H)%Rn zqR9=cecJFDB6L3>M4Y##-j5k!{eAG2@#q*(>$sZ_t&a6!v75!&$9{wF_+|djbGQb2 z03yomPZtUV0OLSHO8TCRpM!&gjSWpw{@|0q>+37fAKblt<{|o(Ga2b?(#lyHj*z|>?QKQ*^ZI)JSjvj7LV=K(fBy6 zJ~goWeOWwQFxp3%#7G;5_sT&g5p+bl=>B)uQlp{A&V5vR+k5}y1RZ}xxErfW z6u;FPJh^xU{Ms5OerxNktf_n6-;a&CVurSC0kiQq5M{yxNcXqH1^K4_XW>Ag(D7;N z5^8hR`WLY)`)*UW!kgqt12ph4okK`G!bhV$`Ua(jCh5|ak6K$F)}M!QV{N@YEj2ih z63NYOshsh(A%sT|H}Gnv&`nbXyy706^r4%QS_8>63ICX>r`N91T)K7|aQxfa+8k6v zSv-CIsYY)7^P!#3N$S;m&q!N6qW$eq-kcmnzmdH!qrW{e%?-(y0J}(aOZagwlSW^w zKc27T`2M7X--ZwMnB>;_K(VRy(qH>yla=h$ZkD=qRa8i<7TSurplAC8ga@&hEqxaq zkmEJ>G$v3E6BiT1Lx9RdRMXbRFDgn3&OhdOQ?EtI*_04hH7CWffigh(O-a#hgih%O z6Qfi#FOFj&A9Qk>y8-N&%>d<{cP?wBWb7MI+OFK~VT`+=5QYw!Q%=23sU{B0v_y2> z!rx*71&lV$Q*J+hinm0ld^ftV!WUmj9N8Ny7;YG?CrD0c;!x-DPSSKl5+ji{5-ZaKNs=NPU)p9(S#;U^u*ktIh}`a8aG z>KJ@fNpLXFp3YxIf$Lz@jX(1rjPADx7FSTRR9jq;BPx{>QsOG2--zHom51R(+FyuH zM)vl!Q?{nPUZ^dg^;cxN23KBd(dNv^E6?bYS7XlG#x0Xwkv9|=QITb7C0CMFWaN=p z9a!*aE*5D0>i%eIT4^wVaG8vk)+M6GY=&`}c|uHT-Xw4x)MLPxm73HdB=1*KV&`W> zg9nV#5t5?y==6w_{LoB==x$1NWz(c2!kS7NBo6`+S;s7k)@WndE$^wPrM%JE&(TM> zn+@;QS12+>trQ|&p7&9mA%!}6Xu7xdcOyu#K1P{$+Wp|T#DN{V4Jj(oOx(TYeyB=) zfeQ>letz{493x@NW9t~L`*r9_TX^Jb9Pi^9;>UeF6g)5#Df+Zh3=j?RT{qgD%Avue7MA}nvn84}Wvi4B3# zWQ^+cbbhcwKcf}$0mw2uFgGJjsV+$k4o)!sqTcb7WmGAWvRC}$T!?R!)k!NWtyt#R zO$?0S?)?0GPmdUK*v(!zIXo;Z4L!XS&_lReT1tj60Wh4Y+1YR|49SZ$a1e(GLjSK# z&4yW7<|b!Pp`phwK&>y;dA?UkObDreoR}Y9DRsOIJC@)$eYjGP8x_~?^wusz@Qr*- zAcY%!z~T`wS;)>EbJQ1B{wKyb#t&XxdCjAF<#!u-U%vgE3KZAs5Zh)?)@F-w)8cVY z(N3LyXhZW@brpoRG+m2Y37!al-VUxWkX+#vczE7!UrFtG(9?W;N|a>8sv@!q7amqL zGX+F%1H^=vC~NGe#$%jV(pcj>_}o?H52-XA5DvZ|e9>&V)8v2DnzY2wRFpA~p3&B3 zBhqYn&wIE~+b}$$I9#~WXNt|NH+bV^?pvogWjLR;9u=pUVKOb=6>n#!F>7%Lc5as>knHHfeypQaXDq*E{ew=(4=5;AKr4W?VSf zIU(RLuFTtd+H(`4M*E|5w|jZ}$Wv&kpf5dsWp&oI*Ac2ZM$p@UXD;@8EsdSDs#Mk@ zi*B&pG($Pei9LLi2-xT-i28y+>RuU$v0vu3L0omwau;{sJi!#P%IU$Y89T$mc0&57 z=VKumw{DieoboY8h$h6px3sz=+)MRf>PG19GvR}yZ<8g2b+7TnySlb?;-UXJs`5+F z1JSPmHKMSm0XtbVYmfFCUyIDy!_1n8mgS81$E1N7XwM;0!0yX-s`K(UTeAk;IoGCu z*lFCm)++dK-}0w+gX2c6YHgQfn{p=)by|jmdg`KhIa(-9xRv=3l9)rylr<|$9rty+ z9=@g=b z#J-{{=>R(kHzR*+01MvYxDKF&%Cl~88ccxd&|@@O*`$H)S-*&ne45+M_Gv0B`Bqqn zOov?gGqwLgPsaUy^0`fQAT`JO=iUxi#6lQ{dvy3R3S^fIQ2w&5yNBHIT32OdZAq*B z*7N@1bISeu!oQ*1jy>9ZJWV^!z1Gd09iLq+9ovga8wcuzDj*nX)tehHR&qWj?8zyQ zrFdFPdM!qEaK=@JB-^d}az{)0rS6~lpc8N&#vJFPad8LHBkXpuWY+(TltRY%Gh?&( zl$8AkZ#JTq_v&pT@zt26{We?8-EvPr<|U1_adY_P?M`MLogF?NgIimoYb#qqAC|`1 zqOcV-wSJjtX#AM6$TQzW)K_Juu!8*Tz&vY>Wv8o+Cr1QI7TmKx0y_w%FvZb22Y+}O z1n-FLnoGWL%(ab1)7*b6`@=OgbYfnYB70uW%Y)c+%-P!7R-@&T;n<+_{^QNLNkfqF zr!|(@$5+PA^~N*BYLs6;%~!iI@v5fx{F0I0j;tg3?Vz)K_HEf`30>ai!lqU1H|^J- zW3pbPJ~^%-l!^Mx7J6iyFQ@uXI#PfA3dd0%DJ5&7LCn`?pLH8OG;6-LEAM#ulD$2F z%4z#ftq$)fVnhOShDWs@?MdKP1TEdq1~)_y@{hv>iU=SDCC&Nrkw`o;ZuCM+CNsE2 zVIDEDt)2?XnSu`5tz5xtYExvLYp^#$#iw7IPC3%dV2G?agYCzUp!;yc9Lt<#UqheG4#r z!)Z+M6qAvAGWTbWLnooN3_LoC7e`MRfG2Vr2~2j!F{5&?*)uDLi^ACgTrI5V4TkLS)?X%Pd0 zq8>HPIBs&u%pzj$a0|DBonTHG7&$7 zrrVpFo}8GMa8S?614+X#ljaxuqx)1J*jF!Ze0%c_XoI$#dG@26tsW`jI>b$ zdN0O~Z&2V;UWYE#*5Qw}!&gaoB$T~Z-4JP;x?S_*jdu)3>TRqqmRBH}n3W{e=50K@ zggFSI64NTmvCJT4r~N~XiuGvHp<8FEdn~c9wM{~`hTWSKV;OF5Yw)z$et=|-a)mYr zVnKCNU{$3LM~{GDa-z~7HZ2JiM@hYpMm|9?nF%SzYnrlCvYIh09?o>2?>}E6$>pLH z7)boo^qJ@`6z3{Cxz-MO&!OWVe~6=b+1sB_viEj<&TB7xS6os;3H5ZF_ZM}q?(?f1 z4jd2BG*C->czD>|-DM1b-3JInLjl^j0Lc^JCX$cst7aY zV|aS>7t(WAo^o^fvM)+)`MT-%x*y3jKWW0{cRj-I0F#K1a5xjf`D*u_>blZJP>JvP zB(R3#W}%WW`KhU$WVMd?ovbV@Je$;v^kv6O=bwvywTLuSW>20~VrWHHOm4X626i4l zd;$+@m3F3ZC9FH9P0-xl7XA4`nFiPGqp`>f6iQoB^_oUCw#C$R;(mh^Lc1nX3-nsL zEKT^z0!J__tA@6Ejw+*$-n#CxBm2>E+k92@bG}g5?BN}JT-EkASh}ppR5DLi&mQ5W zi{38FpS4w9JTasW2Q!8dSebf!a%|LQ+rPNzfEDRK8c_579$`S4qq|ainDPLsbFIou z0Xts~-NY$m&6MvqP3VVr)qR(@l;W;BzM%1Y+RGR|4M26A@rvY|rC3qgVh~i)(FW1?d#@w-&54OqZvR-49_g8)MWx9} zE-4nR5C}{CW-A@ShNW5DpebH7tXA5n?G}cMQky+rPvENVxZWC9G%R${@Q4|wZ`L8q z;@RycpHNbRZEMr>O|60(dNw^q4Pmuefr*2wK2wTgMm39!e^_Xl{ke)FU1U|K@J~qQ z7e~sxuivzOrNeN;%{yO%Ol34$6t&jz*4V3+YMB@F|zjd=hx#6kMg(KDStgXL&|;~Q~9qr>q{J8sAsD;2y&bb4d! zH^qd?0suv0S~&NNw5vZ?M#ut`p}$;Od%AR8A+Fh8kmefc=`7W-U97*SUSwYRwLCta zaj)t2x1*r}DaCo6zY8JDeROf1-=_HjO_jownX-VNeKS)%W99)ZXWXJbzpP$qad0zr zyXNpzrpD9(TP2O{I2WNZM@PrlX#PTQ+P}!=`o81(IjltU@^*ft6wgA}XsxAS(azP5 zztS2zHm|<95q>fE&9rmc{vj^C0S1nUm{iNnysNXy)!fzBt)5(~tF^?KfP9T3zYY-{ zEtX9M4P!Rcw^Jxhy9Hb7H7lCi7wvV5GB|)z~Ii`N1vWa(c|> zFA|-Fn+DsQPAXGH=x?(z53}sGEbMG{Y4~o;i>|jQ#LRZBC1MOBqI|`MGKnABqD1lt z&Ko;L2VX<1es#_K)YB37H0!|KdGy#qYu;l!8=IQAS;!vjI$U>M^ALrh{(+aZT#nG- zeA!Ok+A+E~A4ybDfmyN9IJ2?70E>?>t!#5~UbxcuRS74>9 zuXlZ(?h{TgDqK#udOW()%4#QseLnsC9A-F)M~m%W(Acv0NC#H({W=;%Hp|~qsNbI> z`daU~v9WQ_SLR5{ThafmNko+ELvMS-Hz02n8WM$K>HGf=h7Ht(qxaqFQ(GF{it^WA z5A&dHB+`^D3s!UNt$;Isx*iZEKBuGO;Rj~=lEhn z1(r~S&VCuQ&}^jD$AYoZ&n(a^08Im?CvSWFx)3g1V}MG1I2NoY!D(5pn6GcFq9jZD z$?KW%*T;z+yq_ae@k}GFB9?`zG){L(7-^Y#nFpM+V;je{xgVT(sUlf-`MpFsZ}q=1 z7SW4|B7|1B?jRqBO_(~6<><1M&!4()yV?-+-Yt<_3NCQge6Jzfps>WBJ8>C1wxnM> z7J9OTO9`fOwC(Y=dDNfjdly+~9Ofzc1hpmsnc@sBr0C4fwy2$mL%bt9 zgsT3{hRFWwiqoL^`I6@ZJwYP8%3iIJk^^rMVrVi_HhDf4yfOVpk!h@-HfgdTIm1Cc z2*?IOM}#e9tFV-j0PYi>x@*5t#HArS@*5HaWpZP5)mu}_4Y?w@%rvnP*o5vE zTP{eRwDhkkMHl-fvQ3q{)%?p_M3LxQT~=z&N&({}D9YH#sN~?lVb){0#iK;c!Zzc1 zQWRKq^Y-0L^7by@O!$)VU4woXtoE7T$CL>)KE4+nJ*j^-NjQ$g9DN%ZX;Y_OJnd1H zq0Oz9t6GTHM6)CkfLWml;soU*>Vr4MTCJ+i+F$5rKhK9;i34NQPp|Drh#(@Q>86YxZVmn92ndxcG3W&SAyBe03wwf9S4o>m% z$2~8AHsWM&533XqAeN%23<9yRv3?Kzn-harL7^IIYS*Y z4qtdZV{WP&d_@*hIV!1Thf-w*c=lA#@Fu_B(L_Wf)nB4;Bmfh4fZCO`=^Ao9c_;(S z(+xUne0p9ULO~ddI137r8L~KGx@1F0Q#`*wEj0_wn%{^mGp#QPbfA7c82W;vb zEg^Hjd*MN`jb<}|E0*XbjMnU1okr5W0Ah1Cu-|7d4*H;Do^OKTo_Ip2cQqsd!466& zcnKj3@58-M0$dqWk4?gY_3zAkx=f(Nrhy+?6DWA#cMkd~4Wz4|KYt!hrqR>SKUwxY z-yTN}-R3)OSLe>VR}+M{;PtmZ7~MlWj=`WsgXQyw?0yw;J%mnwPgS7?!B)$|*pK+A z9y4RIw~0`xTtWsMRX&dTd>y>SE%thzdTFt^+~r?i^H&nTcN+-R!+)MQt>JCLj$+Ls zVRS&5v_kj{5^gu0pE_w?AuY306)62>$c-}6ytv7?+>C~I5L3-us)nupd;Z06yaq*^ zH|d)7R!zb0R>aF!MGRgRJUgK|Ee-i$;Qak(<+$m(bB%s>Br8hwo_n}w@}g!_lScq? zYl*{f`eq9%uf~h^;wFCQD(KO!)cU^FR#eD*%7MsFcmxG+H*J^`PN!x*Vt9XIVj>Dz z8MqOD*tHo_kOilLW2C9H7;!$f$Wq~9AHJfn0Jj6_76L6I5HSLD&wEAyAw`zZ^5Oxtu53t$^>~}z7D`m*BW$i9s6VcsaU&3J9|$+(z*Fy zh#@Z@!Z3i-$iXW-|FoWO!C}Z*kb96{%3;X$+b1O?LXuVug)@+U3XU=~)WOp!EqyO+ zPH)ac9$TaD(D0~!{?`{GPXk9a&oLoGM;?;jxx`p%lq_a0-|{&cgvzmF;sZaUYlpon z8)=*Kb>qN>5Kf%ftCbLU1+&6+&Ubdl>u?H_@?|-Vdi6v9X%vWi2jGFo-wr-Fg_m-T z*@{#s4zXB8K=KTFJTCqWkNK|tBqly3c~kxTFgf{1<%jY_tn&}Q>}Y8x_~N_xYc|ru zuow9NG_%@8j_* z_Ezp}t!%`xX!xNq^Rcdf$4Lp+o8!ODk5<>((w$1#>EQjw^6db?%Z?+sdxB+&O_yfFoohHV8pX5eobgo;9c2pK(Nc zfNOJA6IC&k3Ww+cXTEX4i|y(qnr}r{e?$Jp_HotnrB#b^G?;)j0gR2=Q$l9tKz z6#azrbhG1T4@`p7{T5#}L%tOel?j6fA`tsSe;{6UpJbB<5D*b0xxZPRpIsvS9YrYk z;KhD&{}>YB#&=Uj4%_<>aFt=#@YjRx>HBB$n+;!yzi$!@paPNP=lSpgQw17h)-r;B zPhyC$X^vI>yF9Eo>b^&F7vS&rJ;@P1Kj!4G6;~@gCf068^x&ovWyQO4Gw`xiG4Kg~ zpcK9IF;Vog0h@sX)GYL*!8_~1kxl_PSh=8wWtXV`F23)IGDeK#n0{}5cyHzUuM5qj z{s!T0hckWtua0^fsj-Bl(SQv{vfesRyZ&MxDP9R<{u#O7gB#(W!{({Dx&M^fVz&%y z$_#Z>Z7u2ODvOMI{4eRJL3%CW+`*El$|uE93Shl z_UcUg=b9}TPW8iD0&lDL?pJ7GaOO5WZ+%nytqb*6sQaP)6oCWo>K%OfhwUBo*5|*X zp&g@tQG!ZBB|n^`hQR?O6;qYZupklY6qP5EtSvD=2F@>EdEuXs3O&z*w|;YtzGI`# z#8W4xYb&g^7(Ld7)uBwoq<5F3-zBG^IGw~IWM{aZlLtk@Cg35yrFkmQzN(Kdv zmT>EEWi(e;LueBEtE~^xX9JBL{>Nc6;+yP`myd4(dxZNk`9*5KwIdxD!ZEzauYXg| zQuQ&~W>^|z#Lq^epaTLlrw#p#*A2tN#fdKPg7i{UCO9bzlR8^}?sQTNaIPps_TQ$t z6xAVKS2b1I8fHHnx6l|^m_UEE^c0KE@nQEkNvNGHYK3+_(U?& zywuF(LU2{#AXUf!7L^I0V<*Q1VWt^oaaL1{2WepAkyS30Gg_WE4>8nAW8(Prc5zVi zum}m$KFoyl1qbh64V`yFNielgvGeEEm7^-jTc_b#7Skr*TCm9K_Puse?p;T6VxmhH zMMXt5Dy5%BI-ib5jyorK!bl;bL~})*_M0kvED-?|SJ+wED8;CDFAQTPll9fccB5ga zlX72M$XWW{;Q?61P{9^xRHmw?OH})G&xftoGppr0Exi{iYYQpSnj~e%*1G&1O;>nf zPe`Xp^CJ9;kTxi&WpUWQN=h%_ew_kH&+8=r-&_96@4eTUg0xKM zZ}*@wh!5#@&<{S$iVf3F@TEI~ltRc9D1-mb=Q&pUk}2!1MRXI+5dE zyAP>MkRIM19hEvDrAU{PB>4s%w0pHaF_}bO+&_;t+QlwKk&<}Jm4t=8KGj%UT+BtJ zOodlmeEgvm8TE+fAG6eeA#B^}dVToH!2cap`1Z#V%7;jyzp~@Yc{`u~(l?O53S2#Y zi2Qpp%9!^j+5K$V_wp^m=XE;pF#yziZ`DulH0Rjk{pk7O+wV>Ck=)PJ4+F#ny?>q8 zr}>?FZ;M`fU(^@E_!q>UZMW9*LUW%ve~o0J@BHOtVPhD7sJR&q2F(AOJ3{Jl2v&zm zeH_5K4#&rjA7Z$U;huQwx_oRjU<$k8$}pgjMM*sXhMR5j)3>4}(S{GP8sux$B8JBh zX-$W(KKvA6#$v=lE`N`#a2S=GOha3#MX6nZZI)z;mLaWGx$IIRL`w}bVO>(jIDB4B zRT?jaj*iZ3-WW}2kP$k2q;y~=CPx!e*;NJqh~rYi#oehxgEe8IQ35W=WMapQ?(E*JOx4viKU!&l%;+{eBBhJe57Uw*;Kn#1SppwK4Qs#y29O%* z7!jNTqiMAYg8PD03p!ca;?kg^IX;_`dda6GsSu?kjUU(x+{uc=zxog>U^@^d$sBbu zs01m8SL+qs4fOQ*GHBGx^IZc>@?et$j;&f0>59O!hl0OST)6?|#tuJtIszYBg#NrMLqJu2)|H3 zs+TN5{;H%Mp>t@UVDF`4s^#MG(ZEX@^l7&{;$`)R)PEr8%u30~NyWhaWNS1WL8*>(T9MJAJI;8Gs_3Y0G}1DOzx+{C-sBU=MQ?X|v(52)Y@~9mDoAOX zO3LnP_$D+xee9%oZdWZ<@0mh?ibgD90I$>{arY*80tb1`QX&Y-jYyE;icF9is#X$g zMjbq8MlDG#9vA`x!*vsVQ=a{_v<0Z@f$@w7tl{9`;u|%-u1}uowB=iJNtg=JU!&2V zUfljx>SASKmDZ+UhXKx2Or8YEH+ljnDZfx?cBgYVU7Q^+bKQ5rWKIrXyb!bmJWR}B zxHqIQNdZh>C50hLGHLVrkLBb?k~Gq5lFUR5Bnxzqmw~k=rbDhEex2Yk z=(3go#<<+y~>|u-RCmT280dgvv+m)C<5|few4EM5EW1rz}-tP-U zN{{`(@DDM?RZCw}EcEX4zWhs7kY1jO7@_{2p;byyo+?_NBJ@L@YdI7JS(vhTv`^ag zTYo0*-2zsJWXC1^Qsjg@4FqE<`+VWXw+E6GP~R#EfNBU&7|Pm;G=a& z2_oMIHOte4^0dRAN|7i98oU3KEd{_kpX4ULn>>i>gi3h4kdq#grLl;Y8Yo1b@Cs5N z?d_!+R&P*Bq{bqVnE(l7{6v)#PC_Wkh#e}d3-`gq2l02?biiv*v5fCxniKD=t_ryc(#!cI>r5iwl~BACln9wOA# z#luJkDTP>%z*?4!Hm=>BpD!h+N4S79zZKp*w49}}87su9POukhxGcaL`1rZuk4uE@Pmtt9G-#&R z{{xROy=qY+f*kEOl4^Xk4iaYq#`(yo9F8>|hvH4)V8|qc3}pejcq2907FvfdDN1t^aWuHsmqm>g-U?!PQug? zUf?tPu2GmGVIILO_SN7Z^;7l2N%~cMJO@{X-@QtNEaT+ZjQI_$x^n{{NZrTsMe87% z2A}Qw`*zo=cu)YK5{ZY0ftM>zhaWm*U4gUkV%mUzDf?w)r1ThQMbI=TAUR(rkm$u3 zl$gzr3CbJ-YPV$AhC&^3TT!O;2-IL_v^4+zAwTQL5{N1Zi7O;(^qN9Shw4@^# z5}~NWmN>Dm!EFv`Qko?#;r^_T2yOQJsAhv0)*q`hGoccDsFYHXP(WD_6gl7jliHLM z&*UADrv0!6A_bCcAFT9H8~TvY$p=oKvG8D4oL}RVFZL13Oev4HY?Toa-^3<+F3nnq z+(9yR4on9V;qx@_vUZh7-$gxxcRtOf-N>3_l#v?zp}=@~2BQl;d7StAyt_(AocLM@ zW-4$uK?dq>Aq0{iolF!%%V0yphdL`c!j523lI7m-!^PB(4=MKB4m^3GU79!Nd^P@g zk{UcHEm>3{j`pE663w}It<15nRh-DbvrQ7_JsK;N?bEdv|BChz#VDo;ykJWxD{{2* z@7<)c5B|3wu#+@!kPkE30%-S>8{h^Wzklw{9(>(BALSgk?G^O>#oz14%*}c8%6(i2 z%`UUu>+-w-b1C&p<2{ftj?7Y^ZDaewS3|;wEXHI=h>Y>@uu?NKNQuc-)^x~Sez=$t zs+MTcS|6ld(}-9hwNS`W|A61>Ov+8fA;TlX_v5GLRbbJk8J7JL7G`Z(TxMYbJ$oxKDoa*sHh6P` zi~vVZw(B>H1mS8_5DIku6WB4!nn5+zw|)PfBU5~n&`@(mYQ*5BM*T1^c;DqW+3 zb~wn>$-;uxu*Z#8kdcO5T$T%zzIOJRD9?$4t0pcVIE^bC!!X(RBS0l~`cWovU8?Os}n^e*|`pX1lRIPcr91^#pWUa)@*u6@pwK77cn z-&2Llo{&NCIlS`T3TZe`OR(;~y+#Bcr~Jh7`b~g}FJ3f~23^wdUVT4wy$%a}2ojP| zP5}7jbvWez9uA6Ob(m5PkB_&%xwDI~)o`#^#f(RyqLm(&jfTk`&<_`?T?B}Gfs*x# zkfS3^T?Az;ZJb^7{1iWq{IY8sgeIGdism7@uj!OHT#{rEFXT!$knr%MNlPWi#!JqT z`{wpM65AP6&_Kx5A(Cf+K|qF`BpVkI#ct{9iaaUf=OLl;(Zfg24ANXGNlKD{M}TDr z0cWRY8ciMG;-w9h72~T--YD5bMqW3ln-XR)GOG6j8Fc7YZyq6WYGP(7xGH1-I~aO! zpa@G-(bB_NT}8ng@ZS&+h%Ci09dot>e{@J%PDYlKq2n|oQbb6Q>ttq|SX=7i`#3XG zq{55_b4iAUqKl)mUVsE9qp%=nt^zf!Y#8tcjM|#8JH06+*kqW5*Z@8VEI&rOwC|z? zfCC^3mXTcGqV~gsr~1C?tv{-4#=Y?RL}_1Id3tw^yxiP~7)69qM-EEyQ;{>8_Xk+$ zx&V zW>|^)MbHc#6_ou2jGU&Pm)q!QNZ-NfX&*|-ok^gMTskae1l`#3B-ndB zFZsHg5BgtyS>nxVDH!NdCri~Qbaev1{_`m4ZS+50Js;0R?yDEM*nyNP_Po^haIel` zpO;Z48nZh-CUy8DaiX_dD^rPq3t!MvJr)FgiXxYD&>%Ubuq-j2P9!XGXyO1FE<+Ll z?A=hWLD#0QJwn}hga_(|C*KoTX@5%d-HDUFKGq+FqhQ)5 zOE%@}74ppI?z99ZWapJUJotUF%(n_{!zz5&5cux}xb~9ndV#HfM-B(XuG=mOG{e8& z;9~np_649p??&i%nGf^JU~e&cM|L6qQ#7Zez*ZJsjBMgwO*&*zeMSemSxD7YE(VCCe%i}ctx8p zFC&X+{~K2f{ZNR0tdg7&e$pk=R)5{`CExkx{TOm4v3fCL*zI%cd0c19^HZtKDX-f_ zm_Y!nv+Q&6=Mc+icvz`zHoFsxFpn@vqQ~QvNN%_4fagD(9)crC-FN9wdv`lQoi?eY zq!cy_|2>-hmf+_0*3`Ync+I-MEgxvx{!j8gD-~FvVtgbh6_e?P$RT#)u5lSZ3{LUf z-8TP`0Zo-fw1uG27i|`#95SdPK<}> zeQn!AkTD$Rc6dGZ6DW_jvHR)#4rr7-zSyOS_2A-63#;|y=Leqf1mFP0EFR2%u0tLW zUytegTrl}X*jgBv8wzTvsOdF|)YUVx2V8nU;?^NU5gn0)-kcS1{ge$vu|k5}z42Nq zdt+u;+#!XD(2_rjiVAO#Z4dtZiN6|JdunfQFV64ugu}`J_P7`zo-kD6CCOL;jB*bY z6g7k){yb^0rdHBvaD6%|WprY4e0qXma#B)8QdSlgeja8X0Z|qaNdjt| z`ozRdIZK8lAqD}kk?4GD^c0&F6h^bK9hlygJe0YSIhp3P)$K~`hlUc}?fvWbw%w|C zb1<;_T)y@c`cxdhiy_2VLnB;J`HhL5n~saFDkhr{6GvV#vbMH1aXclc;QCMFe*2KL zth$zFSTObCkaa49WiVE$JmVogF8(d8*y~h8Pd8Oyclkq0G)^6#4gSnp@|3py3GRK;OTem(_Xns#>91XjdgFxi#2h#6xlzI=pqAu*JCsQM7A z>KH5K!aJaDhzEt&sAS~(dhfb=v6x|BBB^41EB5w;`X{hIe8J@#xS}|9-W3~$SCcn+ z!KDN&VO_7olc-Zrkivb)g_JW4%#-N-Q^0>B94dG*pf)M|5~2}2t5Xc_fMmz#(kDfA z_~CR0`}dv$kZ6gK4<#3K5ND}GgsLuX|Nr63BDXa6lu&St{Cp2_ZHz~_J=7a5~HzV*uf%D$6- zRA$@}aGUHoHt^q5SMzxKvJ82a_=#FtQtKw8JORS?Sc%0oD%PCYL z25eePv`z*%TnzgoACZ8YZpgw`5PA4fflt>!omPQKnyU=VsBx=^3pN5+Vp$t)F z6r=jrl6BA@Mc^_i&<&sEf>U(mHOFDEPdh+9j7kO>=_&8C@N%+=@Y3|8nahr>tr9B~ zF#B8Fm-!ucjw3DSzC2#Q$;yT^9YjT3U3CUQT}Pf~WC-peH5Wwa0z1AP{;yc=iZjZ9 z!1wOKwD99s*`WG5B}GN?!CdAmjk}slbrQM24gg$q@9Pe{;}Tl>IsXNa$(^Bdu8jmj4*uwl%y$(u4(a z36&sc0()@BiH0)QoAL}JXrfG-=4iw^H54H%T(q4vz9MA6yj?`Bs#%Rmn~On^tAvh=>D>XPfPera z6O$M%8!dIl=#P2D$t5OtH(4VsFvv#|HY-)m{ASFXu#GJjff5Qq;1CY0qq3PInjU9f z{**-4+1nc_ZIY!_y`Wg01}H69LJz+p6u4kkWwUE4dD9+dPf=M(OV;YqDls#}Myjet zs78KOh*6l>y$%~!??*0SqG2+kz<>)w2t>UN9hl_5K-A@lEZkpc$x<)q-`m5SFOXnV z*ke)?he{eakO@N=3fqZ(9}rLC{Xvv1S86;NQ8%)}dl$=?A(1&{Jj0vfVcz-laM;_A ztvhDAEG0DxmIXe`a9|ht`Ml62Rep?GWBoChN=6cMOhM5R$)1A2+Qxt{!p_D%Q-=xV z>#QFJ2`)*F*AJ~v^3p6{(O=}eUXQj1?xZ6@&W}b6U%>Rp=XO97{J(69T_aEix*)>q4_z#>-#eQzAz^&j;OW;PQXmE@_-gZ+|tU!csJm${;!5 zNDCKom|w>VL%rX^i=q_~YZP%ZaRrV(FVS>tC)Bgsb(T|CMyl%bbKMSLt9iX{yo}Um zKA(d17&|{bgxqCU`>NX#l^m>I{&{;v|M1P{w8%5y&C0@TC8O=T^2CGtzHrO`xh)_B zv80Rxu&-q%Zx2etig-EM5V2ITcGu`}Tmbx-s>WbYLB}M-M#t5aU))8*-jqH9ii#Yg z!Yvybwm8txNNn22Hs__7XVSEXNbiPle3Ve}0x{Jv(DU$R$j(GY#VWS{Sy#pR=6V5;X-+PC^Qo@FKY^G z^2o^0qF`aQWE6-Ey~CH7WzRHW{(Ak|xq${*RQM}aQnEC)CB8Z#qjLgbhlN;3W`Z#T zHphgw8D?iPz51|>9PAGI_&5kMaX3ESzyq#b5GF{8C!v?`q_x69Y8sp?36cgU=3$a! zGVO5BudgHu0?=2!YkF{ z_h#qYh>4hpjg9@Y{-FqWS9Mk0dn<3|$;@-^?=o#=Gb#R!g!D{dqAr~N{t8p#;gK5K zFpV~Aj++24tsv*Et-gx9e2qyY2e>Ru*=iQrC;^I<=jHXUuzvAQJn(g5yaU4ueav+tkQ!)U4 z>mFi=b^P-$cybjL^Gzc|KzQVnda5!ja*LZnxiT#+ZSNk=n==z6N(NEpxG$3o!mB`zbTRp!ib-(Sn*Xg%J1oeXgj^_Z=i4jftj--#g$vNN4aSO&u$ZW|yOvJ%oaf zLK((@1Lg=Gek5-A2fpxQ>L7l_D^YOK|BVx{%u>ei6er_^1?yNirR66*g2nQ%*1+QW2)*3;(FK5Q&DJ{<(XKGITlE`9}~hK9tuQ5w3B5S z<76fH9*oICQPJ3CN@#vKt7C?;ZC9lkQj(9A17s+U&6$ZARGU}9f@t)5^0wJ1LhMO0 z;!w?^8lQ4SA^8)u;&PB@m)it86f-k2m=b?~^x)I(aLX^?#AFd;#tAP5gen;mDuz!K}LZH(`jNfI!YD{pjd0{&}j0 z2X%0C28aB4Z%mAX$KI0^%$l?9orlg6l51-IFGsoyz%y8nbn!GVXL_r)6B1hzt$k181Ee>p5k8!O=(i`vf$Ap{A# zl78xH-r|&aWrkeNK8LhsH>e(7K?4h+3pb z+3z-!hsK+ca~0V69`w|0^V=lV{#gkbeVdn9Z!dcVJ%Pq&!pMwoXnRkw^=GK=+caK1^E?~N+Yc_ii7Xz^lLzp1l#{BFzwwwag*o2xKSZMDrf4n_Y z;>;WKIUfr_7in|3>3I&WVlo>qHu=Wm_n33m>E`P9F6r~Xu+vHk79>*}v?0d0`5k3+n@%IoPH^${4NpeG?K@?G1e2TzwhdeFe!ZlDT`Av6b zuU)L0NB<6$_sj*(G;nU!1yf#B0|romhS6b%g`dEAhB2FXuP?KGxN+4{8PK-Vp3##V zzD-p1{zN~ZIT(7KVe!*DbzGukWXmg{K~g`Lvb-(-Yc5O~Q8HA%TPb;GEjfDG!hfxE zSxkW20rJ?Y6Jxz54+V)YQdKl25(TZr>#g9scZ_f78EF~wiv{_)XoMoR(60@&j)9u5w>hIPxGY$Xkid6Xf*vHf4T+ee_#6u-v-Mx9knJQTL(0V_!c zRYWHV=>|@b5w{MDh=E6E<7GBkG?!Xf;*02z`#A-|uH`!-gp>t9Mk9!2bH26+5Pb-g0|UzSKC@b~DT7dz0aG20HEEd5g}P)$R&fejz5u zDU$rn#28r7>9=tls_{?&|DjtWBr$IOPi*BXW1*K6y-@kTW6=i{bzv3bf~?7ykas4K zFT7TK)vS#MyS=J=T`bTpO8KEy=>tM=JKS~XrSEHv)oaR32Y?qlcX^@86d6VHH{TkH z;R>d!d?qDIp*L3Q8yboo&p}3y9+3$vD=+!YW|Af3M#;#}LCMbuu$p(bcfHJw%ZvQ$ zc~nCfJrgY>BLBOaM8Xnm&Hbm?`!yT>&(mY-%WIs5csYppooEgHJWPzTu9rzmN&1$S zq869pxn+x?Lm?|G_j%}tM)P)?C z@EX5Uk_1blJ3N~JP*?sBdi>8YP<08?{)o~PXJd(HFixphnJq48JY8Y?kyMrHOcvXN z_mR!VQKO3)6*Y35y~N_c!ZBnsp_B)v%rIO<+~^WEb1D*_tw!RqtJMu_`s!@CB`Y37 zLtE0@^iakBKRFqEWcL0_z8Hw%-oUOd{SXxb9HJ7{(r-0`i17vh(~1(kF^c5}QOy`- zR@TD&wYR<9uqMaHiA{OR*C(=mkpD5?ta$oSdQK#erg(e71HGRk9jQcv{-h7B&%0~t zM#y}Q&&f%_!Nw#YP$^L|NlDz>*#Us&>%2>U_y9nYHTLBuNBF-MR}(hgf8Aa;6v}@M zOBDq4-|5;y2dG+^g3r2yUu*MUN!I}Z4!{feN1Ow=w|~?&fW`63$_^-T{Qn32e?A23 zz?}W>IPza7?*HVwU6reTV!P){lX%7jtcxH1yd|W@KvVAVLT$&wK#=;m9cb4M%{2TS1zsd2F)r@TFnIvIUmV+d z&v2ls<@z z!tC;5?4j|xU}0zkiagbdT;Vcr3V`JyZ9j-JMd-SrgL0x@(!Ad(eQ z#aO#+d_yK-{5;J!a?H{NcYN|05b$S4XIH1KXOE^{lu_cIYg%tw$2%?%M;)*6W$k~% z&m(sb=D?Z?@zv3&!uRQ)JXx#>vMGQdp@T88LSwkzIP5p0RP$B2bO^!)UEqg_Ev7s$ z+bjEPP$-Ef(>ME>Qp(%Fn_*h4E8c3r+{d9qNk{S{i9mv;|xfHtVTR79|P7qEmQ+SKFnSeKI|)07?e0P*`~f7#jhH2 zBg{E$hZ#s}0716#i_e@jDDVSi{?`691`CU2rbM`R3HHsjIJGwBa z(DPA&eslr~W~o@NJdv$jCg@GIN8s(dza&8E*Yg*{KQ|FZcKGbzcM9T*|4p_X_wt{o z6~8qXmrh&|p~M2_4WfvBvlqUIJ!f$E1G2-Lpjxtc8s6MUe8M*tTG6LYW~9p0&x*KG08h%aYr1 z<*3RpxBJT?>4DHe5R0hH@IJS!7xShUCS*uUTR3+ZPa=pAz7e4fR^+K(bvH2&(88c< zIFfq6)PUCqrOvvW#r=|{vN_Q4pwUcnB>V${oWh+>C$oin5uNo!e;aceqgTWiLl%k$ zLX54%t%w|98mvtw6uRXaHN%q(VPRbGxbF;$bc_|%pItRU#nzEuhMIqQWQR=e25I*PzNT~TN2_nzw?I? z$Un!v3=^Lf-pc&hKkTEut~`gKk`7%s}=SkVZj&IB)tU zzVBp@SFoWXQGhs3`2pbyMEe~!=Ketth5%w~(krTCL~IoR)x`R4DTlDff083Ab*1oi zVIMy+y&3BI+T%g;PM`djd?FvxZ|D&r9PkIcsK;?(kz3WP2OCj{8YDGQ3@vh(bwxag z9RZbfMX>Q1R;=z#N7j5CogR{4j1L`T&LHvyi7}Y(m#~y97Re)|$c8$VraQP%PMZr0 zkT2LW`yK@1fM>^~IL#5)jesD(+(4v3ALUOC=>y!RRX+cg< zzdpNfS9j0@MyRRKMuC0tcJ6U4!g;PnXw4HzJMl;Hgy0Ucy0d{#y}KBafk4{0_uyWC zG?rPi={gu;KE(qkmg!vjiPDcuV|Ne(6(sEe2R6V9uIhNc@TN%ScV@z6hPQLb*Npj7 zYX@VN&3=agenT85vf}VztxQq(6n~{JEPsM z?E;P<)^CcM_uZXh@_O7n1aPmtPO)C!-Rqt|kg2W5-->}S@M+-5nS5D$Ye%G3u|zyM zoaq5u7b=wuIlPC&KBu-FbF*#WeJ)MK$YDGTE9 z8iAm*E*!Fh)Er>mF-t_yA!+%q$;#3Y=3=tL+GWWbu<=nt^LoStn??0@DMOz!AYL+mIL}3b{7v?fOLhhS9BdTr zzfX%gm!ddj_6wNa(7P@vHvP8Kkfv+e^CWi!hlF!v1orB6C4;3~F@h zrC@!*sIqz>%HEF;#aZfSN+RSM?m1#k=q88=utEgr-KJPH-8Rx^Yh?3tzg}EvHy!MgQ4iRboyy< z^0g>vjK+^KHEY9mIbvGdwVn^lPfZj&_!zm#7#gnFigq85q~e!ogx!)+luikDRdm*4hKGu z4Bj7d9wD==Lk=abW#B2YYq)Yu8fxJE&;%jIE_^p7x9}rT# zI#+-M{lB_^|4$F4^_KSd**Q6D^xT0qE&}joGeQ;6u&u$;F#-%`bjKe^{ST#m$HU%u z87rq%OWtWlMozq$@_So{g2AJ<(*Z_s?QF5#-V7W>(EyK3Yip}OPUzCf*KfUVfbt&U zBYarPqk{uVOK1zf8fZm#OUt37vm#&=?(xSZ{B>yO=)vwd`d@7%aTW{s57_pM0 zsCXiXF6=+0)a#F2)n{g5aPm6duF=dv40=#D|?g))0mtGZubey$i) ztA}aWyCBEYGednt#AG*sS++%I-UJ?09qXqjwQH-7p8r69zxV6_L@69yJIEJE3`F@| zXu~vVsLZPk*Pk8-PBb{*aDS1uTnfEj;tyTXm1j95OPe`DtxkdBF@?XO#i74*tGg^d za5#9d*LOpW3B+^d`7-69+=@ENm3lIFx?GiZz2r$1`k@?XVGr)Fv?eO+XW?wtpEjQ% zmh%zA-bwrxvrAMv_?;*9C*vVS3@oItJ5U@I zLhSY1RT>Nuutrx_6y0*DqpXeP!4F|f5GcFD&e5E3w!Y+e1O6k4sU~>hKGIAlo}f?|J50qZJ^-@u?_q9VjjS6I=1~G zf(bbCQRkh~7LwXq`nos1 zV2^OIp`%*q1vh-EABG;lJ*~0>KYt`*HAgL5qoyYT_wX>6EJ2Q?h zU8+2wvTtW)?Rn&HgB}zTJkZQ3tw_ac_I9{v;7P_p0(mP-Yd8UWnBNdjdbb0Djg=Kk zGNDg1E=^s&C?#ns#M)G4;)OHWy{xt(lO^#|R!2TkaoXTA`Cb0f7`Gi3bg&du6PFX_0Ydt2WTsJlw3sEBXTPkX%tPhAO3Cf9NGBON@7 zh54D?=PYW=qERdO5g=_7K1b0*+``aoAKonCwO+MfxvhAyHV!yFOwo}wW@+&pJErGf z-rF{2+;a!L9UA9%fy~}|)ZE-yvz!SCgvRc_#ZqFLC zKk*c%}6+GW51Mf#N)aC8r^r_bRUAsYtNFNPGtC_VRZ0owTm5=%MDf%9t|Dc zg)#2xz#xCA!&?T*4kvRY(}pid0#dv9be`CsYp)mk`s8XgbE_9Voveh$0&-@uuwlzx zT@dE0dr$`Sy+gfkrl+R?Q@*p#vJV3J=G<`jL-Y{+Ulx(yfD{|Ul$+0Cc=LKEhwxEw$H9F7PJJUwkeT=XEGyUpLIF2w(%<(i7B!oF(^= zcKUSfnWumY?0qEoe~;gWZR)I#8Qe`9F)ixJHJv=>W_l)!qRklP=iz}4M6n26F>RP9 zK@%YIS}gs9z25_yqFz|DkVbVuJiNxi1 zX!Y-VnWND<&FWJnpIV9^O8)$z;0p>CuKKQLQCzvWw30mQa>XdH$lsb4!5{t8(Nl~q zj={5#n`zODW~RKRMR$7F(3JyvmLRQf==ae0AX7L(+whPAi4~3}3EgZGQBe0i!|TZO z{as`g#TIE6YCs2)wP}78yNC$isxf;3O#zA!tp+Bpu{R~>0y^Kvve;-`*7Q{L3e;K5v zWuSU1#A-26&`z8o7u6O3%=5_KO`XmcS<|dO-NloNzS`Ak+MF|uWpKQ7XDtpR>g0vGuYHZ~0M%dxunVsa( zxL#rp;g>VLntjwhnh>nE1?JuaXxRofj3V6otMn3kM+7NGTR`C zQNE6TM(KJr`gnn48;M0)#uaUaPV1 z@#&bmXcH_947x4r1Ak*qzx0Bx74d+OUVlyc6S|3kCq43KsIyF|k;QR-611Y}kH+xu z@Ehtkd?!99O{JwrydT&-DNacHh(L2Tc3SAyAWq_IT07h(DFV1FWdLx#V3XJN-`m?` z(LG*bvNBbZvyt`F%CZ{x&Xu}AGB)*f)nXxC^Q~*W%E{^RakHz7)}m0#@ab~(A_+x| zz5}n@3GtSdX``CT306n1MWYza(BbUu<05G&D&yLMOG&!dhC4KTCim~tvcn0p7F1#; z)yT>EMl)_L5^kmq#C6B!Q-BEYbeYc{s|Ewo4-<0s=<27`oppcBYEt-&T+s}Uo`@0W zK8s}gbXjC^&bKILHgleI+PZexjPC>bJj4ymwM`5)19m9wXDNOLPuBI+K6E`8hm4M28}*LA1^u6-Fqws;jF71O(PsrO16?!T}4FKiSmQwmdPx&cTs8eGtRY z6+Q$BT8A>ym*Z@jXl_fI<4#%N_R|xpwwi=hRcK(b7>3_%Ev%D6&iE)-Yk-SwBE}T( ztD_m0MHL`5@PLLF06af(hf63y05+Z`ontNe)Rkv^RMeVb*64S&8WJ*TOP{GpZGX6H z8lA28{A~6kEgY@3Br0*cx?Jf?d5S33+i#nphrxk)*Q6&^D!ujmZkj5Y0Rg@ZKZ8b8 z8t5N(9u~;PD+Ucmhow)fN)IgUxKB>yPym6NWtIeD{4pJ!!xG{{kXbmq^Z=sMEQV_E{99V*lCqNwQmSDu+UhF>PM6o zP3cm&T}Sy3dKY76V4#+T>j%kon5?sPb*F0v)GVU0a|2g{cuD~|n=7E#4zOn)kl9&T zTm&eRLEYAzd3Qe1vmZSkv#^D3#3PjatI3Dh8(%oj5e+Uo;vf^ zlCo(d-^18L7Ds3kR!liGY~s{)bYMwCs7CeQ{mOAQ>anc0wmE3Cs?Oz!9mP`@5>r9$ zgV>ImM9A~HIh=WGHfCP0`8yDTjhXqAfQRuIU3eG+O@KsGYUFW@x@Y(R7eJ_-yu`HdUmEBrT zzw=hsBDSro&t{xj2q|IY{xhaal|#0T-EZ)i)V*odVVKtipW_gacL#wPY2)->fSuQ` z30`Tl-w0YOKOFJ0AOOTb_xbdGQ68WMY zQ@6l*lh%JSm}7{^U%V}$v&Og!z1Va*ri9uh|J;UfXj!X?c;B@* z`dK-4{ro;@U7z&|UV^ltsvLM#c|QZq9C z@b+lk^?Ui7u0!{M8LK%W_+5Q`cFugZ%+7U3BG5^w$ZECLMiij``dj~t#&s#aa5Hn+ z*;P3x5^4-|kmC)zczD`c=`w14+;UrncfO+A6PBYhb7*rq=XWcwBZZ#1ue9WOcj?yo z5HrvYFLH~9dI!)67#$^N;E%5$L}i#`>!5v{ug+lAzNe;)MHER5=iW&g#^*ulzsk`L z|6LFWH)oGrq0`)C>Duvf=+EP8k6Q_c7VXaab5N)Vc+j3ph>h-x?wa$i ziGf z`8d3zR+thp34?+wtcc@Vz`}Kjd<@@!$lk}QjQ&V9m z;nEtYYJzB?wQ};L2NTw3o~J9}=k6pb4jBeEm&*&a>vUSmn2B+@8E1rAjiw=b%PZB% zZ`IdrjN|KcJ}g|g2SOQ%pl)|!P;{MjxKucJzijp~`CQ48uf~8DmQu!FjztXZatKdL zlen*+w@+&Eb)W9Ckt}UZ^IAGKbiG$&!B<~JyLd99zE9(wsLbuReRoLAA%~AyK}A|{ z;1_;=fqz)GR3)Th=0=GM`R3UKhZHl2Q8ipHKR0W=cHeT4kBlFLg%pk6V>p8S*XZ2W zAXhoL?JbEsyeQ|S_c7vgqk>Kyf5mo!%2_Ssr`L~<&9$mc?+3sarEb2@Iw$r?c`fNn zyxhv;ekbL!s@N^vO-FTbMV!f!i*T(+OGG@r}Z0vxxm8im^OdKGhLr4=o77to-^S z5sHBNdDK#NOO(`DT&Gvm5isI!qZ-tr*^bnti2LhfBHi+CZ$HuGacg?AzZ*Mg@=n!l za<=*@QD^8_2$Su!SWecsRBwdN6!)oaaMrqF>BB+jfTX9)dw;*%u@jz-7q@)U^xFWk z8t-*Fk;jY9mjQ(t8cZr^RF=<6XKOJX&pkQzoRtc!6?ZfCT6+y(ps&jG4ApFF7fWlV zrO_&qDY;0n32t@O8>2YmfMC&Hm)8xg#sl;2)-~!^;bc?OyiTai_{oB1b|N4I%lz1~ znkInHy2LE`3-#Ygo)Q5B&W}~6w~zA{tg|!I)3j3O>};$FM-q&BOe4S0(@j@M*}35 z?_anh4V(?}#*mSxw}4Hnc)G&cT5F`RFDZJoyj*VOc4(+(u&KSJfrudEF6wau+Hxic zd3JJxGRW7jNK1w1pTMy`Txz-=GOUy?pq>eFHe7GrPlC^JuMgH`vL~US@vS1xL z{#yb0PeWBzU3Eju^6Wv%UXh}<)l_9!g^g`@%!;nIu8yWUyVfz)L<8;BpWfb~%c1Rg zUhVhRWfg!((x*?OHdbm4(d*&99wx9Ap}R!`qpH{Q1cg2MTc-KG-qzOU0Ej$MS;;JF z)#I{o_zOh|?yC9kuDLF+9t->I#_x8Vb3$ZPE08m-BN~S>{C1cO?rI2#&aQ_3Lf`k; zfFD$e^6Csli2#1k)zCQ!th<#Jat#o~IR*axDM6`Mv^;eW9`KbqUwcTq?`dBBsn=>j zfU>J;<cHWjl13n7)6}8cqPlfVWraQLt8M&WBzV_qe7qS#g z1X9^A6J?Rderf6i)UyE2wRI+F2D!RaJ@2~ichZ7aXbPQf<*jb&15Jp?T~E9UUeV0z z&TvPPk*4YRBgV}Wwuo_bbR=$QWR)R(T$}syCm_hU;K!pff)tw0rmP`*s*z&Br{~lQ zHvA#*j`sr3c#4m}r^nNfDL?+usWm~hN7VZujXfFg1LKy!Z{=G#yIbPD{k3)lFkXR3 z-pk9v<(Y1tAAe*qQX&5STBbV5oB!OS9;AHR#qFBknOfZa`T!VWy7DC!OkAi39tNK- zy!Aa1=p@)bdj^B_{6dC21i_$a5m_TH55ZXxa4b3ka`%}q%JmPjaq#1i-jlL$rr&cC zAi0`X@eTZ>0Cv~cUuWyQ^lK5yuJpc=Gvw}$alMZ1xWv`-8w!0s-uu0jPe3cMaP#t- zNbz{nH`IG&0(OkKmAh{pX#x3mgN69DSghOB7W7p3v@}GNA0c;g*sjK-*-Grr?GU{p zD<;6vtJw}gFD+FxXDgd_Ut(uMBUh2vU!<3%5EI&Zjv4u79|ZEaF^pba#;!aXB+c!>1yF6{T1Cb?-y1!@4F`>mOA(Nok5^7*=D=0^YYi!QTPyDVC?}JP z?fUs%trNWFcXv0F_s#Elz;3og!+7*}Z09X*>eE{1tz;21SnVw5skHNnzZY;n)WG(% zdHZ%9myK30m$8ArSJMUScN|`7o$S^IVOE~!)|P3bD7wH~OPv%`Fc&Gl+&rtv4EyIz z)_za*cD~>vKLO4ukel8MywcUa-%}+x=Yxm*#~t(I5OS6SXTQgM#a!NcSuRDqH zTlS%A6dm@{GW|AHC5=lfeyC-l7QN^zFS)7VI2GQ9eo5#P8Gjyns3ET(oy}nZF{*?x z7Wf)DA|kWz;%@LERr%QL&*6*hYZw@7#5y_c@7^qZrk!IGZgS*`kijWVasoYxN%U$5uDmzAJ<1rXNE<_+1V^XuyWc1^}OeIyT?`U z;`cBvLReX-ctqFEeFwg;?eqtOF2_LvpE|)yUf}CF46QTYo4u4|tsjWaNls43x9b6=<2`?IUkpm7{urlL#G6D%0vOD5btI_Iosi6Xg~P6v{LN06Ep`#E(GL;!C&6iRP!y|kMf8d9$LR7biQva46u8? z@e5+$JAM{$4otsLw{aVe z3X zj8mp1}u0r)>q4uJUg7vI3R`}+E#2Jx8y(t)->6`U~4l&ioY zw;u*?#*>VZE_0Qex4K;ty zW_x!MI?x6fA?5|(?7K5teMnVC?Isp?$CYcWA5ojJGrhr^@bM*eTI7B>2_L~5;8Xu5eVxp$5(Zm;l>I& z91y`6=5qP+#f){O)t;`p(v6<|W9r4a=TLd1T$GB3MgQt)gi7z~@~WxKpOeztFp`am zNP<#8mzYDo90ELghScGbdyNeCIa6+~eB%co6uU`#5+cyt`#$9QRs5M`=(#24Ewx9B zD=W?5vC0#9=TyE-0d_9J$vOPnWwMlE6E7OpLyn?|BCPfL`uh2K^=Qf0dQm`e#rt|v zN}H93f&xPR4#@WO_4U0YVxgnklM;DU0`%4G(%6R7*4QFgN)(uFo!(Y1Ac z&;FM)cah)&u^|OJCyI-cSlJD9tTjQYr*t$E?pw&1bRd{uIsqcBV+CDow`wc5+-RI0}4Vr^?Y8(oos>yXI;~Gu#nrvPfXq?|$4MlG?*U=*kAa9ep^yPVg zHLj zi;*7)@4)rzZvF7Jmj*5dWKL{S`~xY)ApYhydJU7`gFpOj&Z=Q2IVIj43hcJZ*LbT_ zQ%lemKQ?kzB@CR?E64Q1<)sSL^P7i7Lg&VZC43q1jvy+i!yy^TA}<#AIbbKl%wnxY z5y^sG^!A8cnL_SU_vM{ggb(h+Ti})}1=%$H!`0%f(XPYX$n!CMO2Mg3EBmr90&y6^ww=;|(B+uU;iw71V{oiyafDmQh0XJ2K#|L1M1`|I3o zMz}iHJ{-z7`>zPpixwp#GinlNSgwLj;3Khx1gl%>1BL60rx8+HGZI>EB=FSOr!=7l z7LP|1#g-scy4eQx-W`9V&tuwKBQHxph*a)2uR1X|d)zT3lZJ}zNjpqzbh-0djzMkp zvUUKb^pwA`RMRW5yr*W7><_V*kz8&ZAxr;nD8%L}cUSMYQS8cbG>4F>KTA0ysP(s~ zsCK+UKl^ntQ&zaxarE9OaiK|@1m@)#w!4N5OVKq2FR5A2+Q3ED8)^TvJ-KnemBzVU zF4SPfMIX1TA-FCs6QwW2xUv!$pb^|XpE6~rZL2Za&qrr{r}oEHB|Ku7K&ILn5cn?A zfVQ(~i>uR()~F^j!8s0KwCqP*{1w+s{?{qw9%zPJH=^ zp9k6SaS~4YZ|b5lEzw*Gzrf5P9oeFbQKa75Dz5Bnh8Nct^YSz%CSl)vugxcox~$2w z^kk(b(v1HZknq`4fh_669s{9vchziysATNs;a8>kmFj)!Jtcz7q0PFeP49^BiE>6? zkPbp<3i3+0$5T9;(azAy8S3^#!mesgak8-JGXxJhDG&yECp}-ZY+1~Fu6Xyo{zd1I3P{V@^A@(ksf?Suaj;=9Y zG~0Oe(eZv+QZ;TAFi(ZVrGY5u zQ3ZazHL=&4ll+JS$G|sJPHK>h@6HWxV5f>WSe5aUYaQ|15>`xsgLiE~F?B30S$Zb? z@SdY3ECKXu9DUigk1)S`Y0e^$a7A3(vm#k!W@&0+>uBif>uFmzP-}HcmaUUXLKETm zXN95{_2eba*5>Tp{sijB46>ERW!)^NbRJ5M`lcEqE)`X=u;Xg$%C0}hmw!~uZ`J0Jn$9FgN#GyXkTOR5<02W?7+f?Kylr ze8UV-b&E7M@J+0mFRfS|9j6f=5Rzu4rUpp=`SN861~%EO$UyVU(!MK3KgTi(Rz1Bq-vZJ$Dp+cr+A2p+FFuWz%g075D2$CL$lI|f6w&s!j4ZBpfMy;D z=@%Af0DVkJ(-i0Am1O<`WzBpiM@QS@(glbON_wBqM>VQvTw`J{RJFxDC%;-S8=QSj zt$j=h1hvyMveGgZv`O?P(oK_9i{J&K(e6gf$Is7GT@9=qG3&L|WP9$npQnt$>8som zGxfZ!<~-lO>P%}a@wbLr1%D58#eaS~&mtYr@JRq0yO@TFk?~f$HHk}(EJdPp2};&Y z>Lz`3Wp%}D!2w;4#X2MNbAtKrL>c;n+a}ktdbup~?sR^2sAsJUTMHM7kl`32o9UK0 zMV$@DlP{|7Uo?=FTi|UFB9}%V@o@7S8X%AT%N$0wYIxjY-L+@OPRX2KsHtaWxfXBs z9}AoDSXO5iEUQ}0q`b`3$Swo~k?_{1QC{KkafXv%6RrnceBY4jbmsxjsi$8Yspv-& z*y`#Yz4^-thHe8qBqa;yVQVv|V+q;$U!u_L7Y{?Vo98}i8E&FEG5fOM;>XB#JhhmgB~7A zPiC#~7nKptmlL0ncV(wP7*YOd;3MC)rS{SM6A|ui;ny{FLM!FLzL*uAaB1_!1>%yO zm@%85i4iVAS$!M84u%^h;O@P#e%#{ZCG{d)|-iy9HZgpv~3#Yh5 zBE-bx`2PE_y>aY~3O)^trh?h02oK>*O-SzKwMC?tz49vj>&C2WqqPWyzu1%@n~HyQ z?FxGmPXj{+{G4jhp{G=1xm6fOR&YqT}dY=2`MMEYDmH7+X00gk7`;jX!hgX`t} zJ$1sjMxhxLrI`fYlp_p!yD;!V zxH%cvA3WE%skGr_COJIuzuv!JzJJeiA$fS%qS_cR7W;~OGBK8LsW+(YC9AF1H5)GK zuGJE|EtA!LIC5CHzE9pt2?zXgbm9B;lg2eNa&k3#KpTdL8OVLxHn!H*UY)MAe(!Cx zTU%XRw6wER`1I-cOezb0cxb4L029+;Z!8OtSf)q6JwHDO&Fw_3N_`Vg>WTirAX9LE=;-`D7-Qc;Dd|l`yooL_axbfz&xsmY7N(rh1 zuKrHl`$@Orz0T4O(96#L+?ZT_5o5L>w@4JAQ^deFZNQwsuzBaT4GH6Hj_x67O84Cd=h;bcM z*t!PqP*2w`3`<0K=Q&z_X4luD>$%Z7>ei_MIv2P&^VTAMdNgI8+RCe4!_)@p{t{So zr3P!QoSZ3yw$pY#3b`@Lh|$zHcI0^M3b2Dqx$Th9P&v`+6**c4;^tKbk0V=Vs z9D$t6Ux$8qYRZs1S|yRFmWknE%hwB3cq$y0B*fLyj!=U-i8-~6xsJahrXp-J3)K@ z>l0{SAS$*KIi5ARVI*?RrW5QFujWrF{1qY9@wAnq`jB{y7zxyExNVih(>X_c4n46r z8Apx+_X1&f^n1;>bYtw!%GO80^~5XDX|0;J?KT3j3MPop0B-AMJj{ciuEct7v&iXdy%P@$k<~U0vC}GxhDyZ$Qq) zRCf#jW5TY=1{msC-7Zc0VR5ZT+Z@Z`EB)TP zXMfar)jn4%UHOY{hP^0l8h|qZEa-Cx82Nm4tf8-&SLn3HZhT~fb$rZIo4a-R?ff(s zmw<=}2m4#0qlMZfS0VZ7{_RauGq%IQz-~dh|Lg(sxImjOoYS{|1hM)vUtb7zxxlUnqDh-iW2WKC`Mb5?yh-_s~$-sVt%6a|6Bl z)jik9Y#^1?QCf3Wypz$#+3TzK*O_cCf?+um z7aokSH87*&<8)trV#32Iu|#vLa=Y*P451WZ^@e0UJzLmr-gP;^fUIq70`ef@XnOlM z?BA!SLUl}4(gXT1ummF?uNV>7>FCB<_873ZJMLz+NRi+|GvWGCug08wJx0&FE9-}A0=3pb4ibm{?h!jzlw8?Sxisyf6(-mVQqH7wzyky zZ-L_O4n<3GcXy|_yF+nzcPBUmEgIb2-JRk$-#O?0-A1R%7Cqp}3$uRxz0CCK4|hm~#=Z zMvvl7P|r1Ul`C!Fo7%!TFRGfHUOj_iRpJT59z(H+Q1qm@hsHA08h1DscN%BG5 z{S&GyCz^a+E9X4-^vRy6*HFi9j+1*V!y28?QKYKv7^AcEw!b}z@ycKh`-+6EfUe;TKbE+ z2CTe%m-Y5z^PK0|$qkpd<@I&Veja{+<}!b;dYvAD)Li@)9{$_y+2@p%mCy$L4ADKu ztIGLI@Wvr;e&Y;l=i&-ipTP=)AhR+J7tw^jfaux|DqIcv%IPE2KOnL3sNCIi4o~^x zSe31<&_5UNNi2d?;GKS7{ohz+!AveZTwG~sX#^8BHJt2wF)^{JJYoNn*^;MCZ)O^r z^2Wx*fgRnp-+|)f;PMpk^|I4P$bcygE1DRdC)Sc9bHhG-0TmV1s#&`ntBaA55%vKm zQe3?X2l*NcCOx_@o1-oWf_gu-L^*_5`f+_%R9oofB|h7r+iIl-GoL+k!rsB^N0|~^ z(h`>i1$)NCUYLtADe<2>a|Nz;Q?trEl|;d{xmB&vAmi%YpjtRB*H@NePhvm)hRQ!W z3ZvqzKb)z6a$486yvj+1r|z_t6scyz!f@RHfOherOgim zAmQncmIFrMQ)35OEJco`d~tdqXDDxXeu;;0TR4)B?`LeAR$ zY?@)bgq24{WhBFgugq*HQ8X;Z3A+(z;R5=d=#n8U9)y$XNEkY?S6tmMttRF~s#k7x zdw#ObF_mbYImA7B(k{wXWnmdlsnYuRRJ|ttuv^DL%gqZ3Nt$r@9v0h?j5kTW-&SSDEYXQHMVoe~l&VaLM!?ES#GbXo z&GWZ#fZS33;D$F;LsPeVp~a}WvNm7$#psB{!Xp#El&MpOVv%`j*kCCO3=*487ti7- zgY1QsvRBJb9CFn-(V8GDmCrxobQyZOTbp+-69fRMK|#7mKdV3eiAZ-vDS9;VDaij2 z9S3(079TDr)l~w7P4{-2MHOA=M2KhlbQ0iYowq69$%MdR5ZZfoTxO2^&VJ8TM zzW=S1PM6MFrRJV)=V4^yVPzX(nWL;ciHZ^(_{| zBOxKV=I?PjK*9%4HHe9d{;&ZrT&&aUl%z@$0h7pPLN%*}U#xxj;1V9Hp+KOn?e+K>_7%tn*YCR$|a zW@KojA8Fo^VEvyc3 z+N}*W)ykp#tXz%DB_F*v^55H7*k}=ePY5AfvSI}bWcsP@g{VlgcW-!%Hv$_oy*qMRYgNZ zPt7|1afgo1}%Z5Bc!|Q8XcZf3*%z~rHY&{w|Fh>7o}S; z6S$=#wseRuMX{pNw%p;WvTj|UIHB@PgUT!U;leXiz|u2NS5Tl?0AN*Rb%Eo^J1gmu zq0ETKWS>Q0Y;4UZ`Lpx%Z1pEy7Ju`d7^fOtmA#Rj8Cqt<=3-auy? zuO*|JM8Jf79LV0>5tcMjM;+VB@~pqZK3cJJ*iTW}vfDQVdK_VzcatND3s9&keh40t4h zz-#*W)VZgZFrOgJu1j(gYt_FmP=osW5y4}!Z7;izIco=&C*lS-uPB!!IS(>uuy?}u^~*WWOwO6_A1dU(xj(&|MgG}0E~5-7c<1rv#LCqyrg=u}-L;JDT-V5V z2BvQ4lIQ;Dkp;Ief}45^?oEYS``*Fq^#27}xhf+^7j1%2q&g0cx4aC&3!`R$Z2oew z-&@B)qBYv{g#P{%Q8f0Ngat@8kJ;*6X;Tw%dImay9ub2(UT!gjDL%u^)cejcEgKnB zT3d)+sj9O~e*kC9P|pSP)Oc}i3wY$nszuyNf~fG>j~hpwPp7l=qKI7Y z`8Ha>B&YXNL4zGwj==B(SM2_=JuBYQ;o{i3+V)gLfq;W;=j{d8KwD{Rc4JA~N;4z5 z+?r3v+bBBgrPL}Eo5uO^N#kLaSIcbA!{L48{4{o=ckgEAAsW{$=UYoiz zn;P2MNRb(RT!;V+Oi`p26MVoLV}{mq*ITi4Ol8p7*{Zfw(vkUh4>xW?n=|CufdwR3 zqdKCcIVnoB5@RWD8czuVM*-;_QGPEj@S5a=C{2t+0fcDvWDCYDUD8$xGBQ~62ad`! zJ~(6LU(Kj`3}$oUIZi{{!&RcS3;AK%s)K$H5Y>_wHz zMS8@{7Pm#BUq^5%gM!9)ywsDT4%}7%jcg*P9I{-k=}q&YElk|Vi1ltpZQ5a^&C(nr zkS#EF+L2w34LZ<>`f{z>Ba^>m;}K|Vqv~p$G^1STPC50oWzVV;)LT${yK}A|b5An? zrZ~TogLaKEtv!)47!6qxjYnjWPJtsy9 z-$Xb5E^d&Tsd*nYQcy$>nIc#G;WNMZVJ$Cj<*2lW(cxA>qGe0EMP*h*`k(*{F5ry= z5LnQ`iR_y&lv^hU=Yz}|TDzv@mMcgCYPj|%Id(5`g)A?yzMy&cLb z8?-DOqa^xC?yZ|;zF~+`LbKbT?RCiNEiEi`2=QBPWwx%48`GY42ypUn%x@GJNV1-7 z#>z1yc)KYMAcY(wiB--sSWaM8*t&QP)(3H!T6%dp-@NB9hqQl`!GIN|`SR^{S!MSFM<$#`63T6>gM zbAFn~ICW`hwQ;btXXWX=6AXk1@mHWpU1>2lipzQwm~*buQk`ru(O^t-N0&z*ujXoP zmFFr%h2cnH^qo)xb(9_ZNd$mbQ{OQ_jSm~jgXPK2qW7HAXD;OaY#9eeH&3y(-d6X} zgA2JC7GDgFkI7LEVZa=}W!sOY;3+(dDI>vEoKc|g^rDH@qObWe`QI{VzAxu?T4*G1 z<;vxr=pUXx_q6r(elCV@{1x)AQ84u+5RCF8rnkwn+85NUAgWoqaJ#zX6SOZIy}WaK zwt8X7YCd+WwZVHJp@1XgADNsidQE<4@iiwdr)Cj)J(0Zl0WEl5-_rEwQVpUCbR0u< zK}dIan`_6Y&SAPtk)cHew=9~%bCH_D$(Y~=E*$(%QCS}6gSodwE>u}xM~A=LST))c zn*HqDDYdw?sHFMh0-c#z;R(r9?Lm6-EzD@j=+Ft4ae?k^EW*e}i>4|b;h$|T!(-nt z+8k9JD0J*_*y~yJM6ok_*x18u+y~d!WY}c32EjuBgN!Okjh;?RSI718f`ve~%tWUo zStpyRAil@G-fq%`-utMSd?s~f5j@Vo4Wz~VJz<`sOuMwEYoFz2Vy91wv+^X6q&F5B z+ANxCYCfk-hBZ}P=r&q9&q8>?G}j-H@95K($y(VQJ=kvt zP@~eQA+%$w@UWivX2=f0#<6p)ELeGPstsXQLry_OF4C)9Mf(!mr!o&?@DJm!?&yy_ z+ol*MKn6;ZNgQ=b3==`I@y@?Skr5+Cd%}`ap%`5@z~NljF~Yos-S1!ig5NufLvV5= zA3Qo0am)&K7;sw|>z_NBszgi5Ypb%f=h7ViLS<-ITansUrCAdeixMVL%rK(hmKCj? zTg#)#!gpAoak5bbUvSttJ|F-3E#jqK6*O#o*I49m>EY%{d^yx_r~oF3ZC6hYffKK% zAKr`x>KDEy_^8~6j=XpZL=d6)Sln@${g!7kP)SDo%PC89VPD`{}~Th2B!pEmDziOI$xX$=$(%_ld)QV zNr)-5b>fBIr%D?rvrt?aT`8XEgQLQ71t`xcYwKi9=tK{eWGB~8m!`H5E2}G*S;Z9F zPMLv5rGxLRQzAwg$E^3$JX(I58S{mx$*51+`m6ZD_Nd43UD={=2OV--PbZ1i;tN_W zHp$-|Qv$T3hns;r%QzbIi}x{GZA9BGj_(Cbu^Od~*`q@#Z}@_R3J@N&Gl^|8mUx@@CQuiw| zHU?z!Da~DIb61|7@xyx=0WmYiknmu1=NstB`4|NR%<99~TUtmkqJ|i?vhj~~rmxxs zx!(Dz3Uy|h;F;YfW>m53bPfIfhDB(-an^aDr5EQ*@D&`6`WU z+^$|nFA;MGbR(eOm!5p|W2vvx&i3|Hxxw>ipCR)9K3ilA zANYb7&K17B;l4$Q`PJ`V!5Qt(@*xa?Xow`%^rWFr3d1r)7!Qdne3Gn;bBCq1ry;7t zGRdFj=2UR}+E3Xpj~^8ktn-72igXJsIr^JUSLyU;I>SR@+-cM~VGH2lr4Gzrp}#s= zSXks0YO?f#v7(!Cr0EGkD}c6wa85$hW3;1Eg8czOq1G6}wi$L_E+7{h z&!M&*l2Q*VkomHrMn1%(y=L$tt_1#2xZ$;D-GnMXSR(T?FLZGrkV(lNuz$GN3#fT;Gsv2_09 zxTpBc!9i0mHv~C0(&)Z)?s|H89zi^WU(wvUys8FFYARYQsSp<_bHAIhpiJeiDVhT~ z6AkUmRAeOdHD?s`1@?_5B*e5kKGlLJKyi@jCgLj9#!?R2PezT-77K>~WtBhDp!Noe zocAcWHfC#GkqISAR0&%Y`DG_+V;`E(P*Ad(or9C2b!4#K_o7wFRz*-5NoNf{b zP4v_b_PcQXAnF6T-dA&>1;J8zd9IqMbf{j#qZg|ciu8K+aiUaus~mO=`Sg*24bMo; zW1T(gj3gUGM8`rsi%lwON}S+0;q|&=$22uAFZ-k4Y{TuUJ=vN=_aIl#VVR8U?SJYk zm+n0}T3Q)dSu(P+*_oL^9HF8{fR+3@NJvOv2}o>h}yX z5Piv4HHn=9Ak<$CenC0h@6D-y%ZkC7W*?{B1t-ehTd$kXcSmIR3JMC~VMS&}MpSfk z@IdAI+S=LaX`yn(&CLzCKL(8)(v#m^P*9*;aX(uk!vfNPJ+%6tOv5J)hdAh3;eqvFmsGotqTh392e1}qsFXVxwe%L25M#<+v|Lll||;D zLfa;JVZxWRbx&K?(O6ZPKx1W1nIh4WDUTo8Ogc)slcQ@UmM*s`N`CK;t2$R@1-lI2 z*(1{YNj(9qz~=oAUmdIt13sQkrtLd!^H;vt;eVn#^Oc(y9H3%jzy`xShX#Fd4fOH% z$=%ToizZPnpqi%igninAnF5AE*KVuU==FKNn4%PR=_52aVAcWEpJ< z&6_0?q)h9dlY^4wZ#`NKYb}>;ExqN5_%FHxo$%T&9l6Y!ViT z_ku0%;I6$&1^`8R%9=*x>S!=u67EI?|J z-)wB_rcafGf5Gn(o9}9>M~*#NOR&C(Qv;e?pVpkLj{luL@jiDRrH&XqqfZu#fEuVa z!hgv5_BME+mZ53siocXfC9JX5@c*%*A9L?w$>wF>my7;ye_6*48>9(ZTk(A7%PY++ zwR`ZA^n|#g?Pq5>-;0eQ>uBP%WD8BHQ*nyyMcDP!P#oo~Ax(-UMVSgvxubA6IO>OL z=d{(cbr|Ug2nnrg#E)K@ikqI94z91KO{u+LH0u($(3yF;$~wKghs-VHzIih&tYe<` z&2!q&TS(Etb4NLigmQe>#(^^5>e63l(~nO89nsUgA<;GSaFIFKT6ag#)o!P%-XL+V zE5}&?JBu=P(%Cpd$X#(WzUP;E3p~O`mnmth*A+9P1yvGkyD-(AVT|sdb%M#PxHx#| zY2PsQPbx?8kdBJ?J#0bhaX&X$)_DO1m;frSae4|n!Ho&zx$-APH8C3t1u$WivW6P=H&Rv8SjtE<6? zLqR1#c`3|xS>9L>ZS*8{EwHw=xwt&h+E~pMW9GYPXgDzISBa_uP*bPF&8PSkT@u1Blj!(9G7kKQBP1wLM`p zKhn3svc@p9bm=!1Ar%Fh zU7Vmolnb5U|V@H`s?%)j2+@c$y=wKWGDz z?bQ^lX^YyF7LNad-fRhJWyp-Nf_~A87<8ZI=(go4ikl!5B~H6L1?Z$rF~z#vE+5bR zs8WH3Lem=?!(p{j-)NNmyQN8d;CxJ|pAi(phq}@3veG6%h4H(!l)p2K>PJ8{&u!nz z!dO)0&R`8D9X}cTM!Q)&=p#e69gW{qe13lGlP4F zHC9xgUYPmVVGU=XtxldCbqZq}mfu)WYu1%Lc}|#HbDUX=2WOzsEqb`z?POY9_z^hLV?p*%>BTlgL z-;W;wx=cNucZcASf?B;!Tr4c-!|{xdkB_^fDfWzUaJzcz^W!NW2F%{d&CXt5UG4C= z*}c8J4MoQ5=$zRm8-|RfD4X*<7{iJ8`Hg}bl3Aimn<5RH7srye-pQA=1YEo{&0>^#nhaQMxTu<6 zRx4w-#0am}Rgn%PtL7JA2D7BuQd@DY)%x}*c`yXOYZs0c&sqoV0&0JktLZdY!)|%_#7!qOV+rjJ>CXLRv>gVzDk;3};QeSZ?>HOU~95+}Ajw zya!mmn^;UGwwj;wNN)B7QKynlB#sg!P+cLoy^TMIAJ}SD+N+HXZXEUS`FS4$Vw!gR z*gBd@9u?v?i30E_Gu~eMA9iMTqJ!uDz?qNP9AA++ydK<^$ZuvT(^7_aQ`G4qr^Wt@ zm><Hx~*IK}uX(6Iy z2(1`YK>a#Zx=@yURXQ@mY$0F5LUS7%dKkJ$ab+tr((NmRexnN2pynS8_s>2UAixSk z$j%Cr$nQ`Dq^fAiqUq<0wbs{nKZK^&r=+xIF@Z21m;-PRUokN1-C{Dk-SsRLbbtf{ zrBSEPnIX%9%w;hgOHywIk4_pQ!GMcgeZL9xHg3SL>?6ZY7Vx|+uBk!A{Z*o@kS7%S zAj-mojl>cNi4UaM3{shnBQwqsk_d}JKI)FX`gnZHxDA!T_(7F-j~*j0oYOTYxPDje zZ45)+zgJN<$AaqI`BjkkJNjGRk5R*?oUEtOr~F7VC%r8_s=9Ybi%C6_(b!9!kf2P?lC!u8;%n3cE?jP&zAAt!(X_F84NeAw=iJ{!g z2^!zfV`ah9TY{%27iT8~9xe)$2?KOj>sOaoWLX_P7gSwe*V{iWcSrBr+4pf{}HRM zzO2jDP|4+HUtoBv)I_&q*fBrNxLYC!ed??h=~ z!+E+qGTq5#3W;gDfk_8x+w&)YIfapJVZP`4)rn3qioLm{fjBtomzR#OagV};>22<1 zw=yU)yI_ml54!$$(YoI&T8KD<28AQr`znMOcXKB9FRdL?3Yb!ir_cZ#09U3 z(f?ichbCAcDt=J(Umyz#WV$uhk32H6uy}M4Y`U+4Uf7r_JlFvvs9#*3E;r)c#L$hP z3aLzI>xq60=Zlo1U}4N?F{I9&gp44~cx`q2V)T&74;!;0*j|_|)fvQzlPh8^LJ_c6 zlf)u|y)qdn+--XVT0P`{%&s!JehBYkHD>VoeiY#U23nlEtz$2E_Sk@UOA73vI3}tl zAxDz!rH~b)HZp!xK%px40JvZ2BZMrtmcv&3gvgQu99AB|CO|Wn6#ky zh4w*;5djM#=(nj=(2Ii~0FY63G%>(Mw@WR`;f`+e_c| zeo|R5G=4xDDV$*dBz{5YlQv{qX=!OmNoXc1Az`B?!~DJRvZ4Sp|8HNlmo+;*Ja_#w zxomHb5(k&zh0PB~HUwX1hx+$%-<=N|o7bmpxbTKg94&gheQMY)2>;-m1NKEcFaTx@+|aHXYFI}UZ4)Nt6thZyu)(b*2=77 zLTlVx#ra~LgALl&_cZ}08<}C)@@)YTxYzYTdrKH=?e6vqLD#z9?XNQ<-(lvnp!e*k zFLf_TLTfikGLPG4o&7zGr(%R|G?sMS^gk|V5biN>d*=C(NaVBqJx=@TA4lXqx^3LU zhmwv+FFRKZI@V3z4=0c3v6e#c&Z;=OHI0@w$Am<(vZoMznUeG{Ry zi_=qCEb(r|V;USIQjy~5P~DQ3sG$G*2LHA8yw`{p@Hp;bDQ8^$zYJWG-!#nR8+Voa)yyk;3 zq~Ue+r*XcS`MXz!Asr49_JD`Kv*JCazutWw;$ zz6eZu3I{7|?_N?4oL-*!cF#Sz>7MOfb|MwDS`C{m=2q47j9c@2;$;SvqxYfbIz8$G z1$oeRuy&b}(|g)|Yy44m>Bo&P+Myuv`@bjmszh{S*pM|6c6Z|l|NKx!`0MJypm(x! z-oDB$B(dgNqAO)Dv7_w1ltQXWaSu;g!2b6+TnsDD;XaNaZZoVN)wMKNpyZ+p3ev-+ z{B{-srB}u*7m|m-#jmMbi=y=NwdeiMpzZUM|GRsNHqd;d!)16<_~UZv^CsFq&DmyM zyJ3)|mZ84T5JJ*&2dED5G2!3`J^b)9mN-y&5G*Ix+en^pygL}Jc%n6-qS!#hr?jW9d<^v-_Wm9aEkG@KhyBa=Ohm zdew4GI!PjkG$!Bv9WPJBT35?dqVGR9;avmq$IlpikAt6K3?tg4Yf1n=JO+N1=%$RC zr?7dFWvwrYb02F1ThwdC_Zm+-JNRIgT}vCMrT@odTWz81FL<7@jN;p4lkZk7&U;q; z?=Rz?Gj=>*UM7E(`mCrPGkChac&fI%u*Dy%myV4#JP_UfY|4e_bul}oWPxCYzeDWJ z*Br^nflM0s)c$0!3&gppV1Y9X!QE^`?akt6x_;8r(cw{8^K3t}Mt^&)_5L@K6IgIN zy6^B6^=G$l{i|f&?R3ntJ33b?({b$jEOEEzDdcmsj={!hxc_C6d#js1hOes~_&!^n zjt>|e^btjgaoY}G&AaIvUy%u?rTDn&eLgUr1fHD^a2x4?eG$pqSY?fSg zp!kB_xx?!rmuW9XSS0ekgb_w@o+xNb(Bo~N)-kXP;p{%RU=BUJ0@RnUkqy*{+akKp z?%;mdrxmvcakqXZ^RR#XL;U;jkM}nES1a6b&!<2;5;$NP3PH93l0U!t+i6WH&WVTR z`HsJ(#T^U3rr%s0L^j7bdAvOzoj(bY<$b)V+}_~jv3S}O}g0|&>H3W6dPg>nTQi=NXv zl#zVzVLyz0)$krLK5zxru{~s4sJj=uNmOu$Kzi_|TR?o|eVzVr#R+~heNs96e2MtD z`pWL7B((PC@Rfb+C|m3E1M$w^SL$r<>hbzP@`Z|6QLg zf;M4+1c6T$kHe4U`6Rd7OX8(s_}V)9?C|L|$C9Jon!sqmqTwraUtf#uGydS=E7Z%b z%{6W=&WHVz2Jc{MQWTOd!EeGId&e6hi=?+)B(+KIt_E9lx~GR1osSnqJEOx2s0Ld> zMPNbyS4E@SQI(4Xo&NVF{LZ@Gy_Q;;d%d(A>Z=!pEea-qS$|&}=M$)=Qhq0y7cl%= zZ`yNOi|o9ff1I#e=7=~@1bAa>`}URfV1w~hpAXb;rmW{VIFV=ejip!kXrCsv>ac6tJQhWT)Zp(#NgKZkNh_;xo<5*IPIZ9Wbtg#wb*S`Z84^QqU~ zqs*J{Qhwel1^1MDoMr5K$b)DEj=w8vEM~sb=fC8eV>?X&w@XM4nQVXYjcg~h{|g3+ zBNls+rVJlmpSzK&ek%r0sQ>?#`N0+E&coCYhtXn~uZ11SvcZy+Q)En(e zZyopk1$=R_cfbt5iiCOS{sj!23_4OZGK1sPlaw1zjdz|C_spz}moH(jP_;J4)k>EY zg%nx*hEUnX*4icY{CQvoNHHHxth5&P`Mx*()J*s3-K|YU82z)qV1AsiLjKUnGjA$w z>Ii}S;>i=xE}(k*45g*{kQLZGP7TqsVVJ}U_6NP{(hz>!z+VvNv)bPXZ#;>EH?VGa zgGg<@?*r2BjoVwgTNaJyk;S8Ixv2NqnrqDYG#D_i1p*PG2VHn4B*Wt-%&7|@y;PiA zic}bs=9gwt*eYcIs(~n7ykrXETTj#&Wn-miG>%D>^3-Z(+0yS-*~ZMBZ=bt#dka{3 z)qz2yXt(ah?RWWu=r2gqB;p|9I76OaXk+YGH^ksHgmR6Qi0j`wARjrATk zze4~rnvBUTTD5dEca>RtN)j53OnmJoxUwdOw&_}JSFJgTWJpMCBRA(OQOjn@n^$(4 zXy>&{7A@@-;DRnNh3IiCLD*4THR2_zJV3}`d7A~B$oQ<0v=Cx1lL_?-aac$mEOd|6 z?0BEXjQjj8Ia4PeDv*itoTore_S7y?iEZleLAjkNHo(zDNyF--SLJ zs9=mA>5NV?e1-6o^t4{y)CL8%F?lM?KEnv9A?Nm6oR)p7RTrT&Im`^zr~n4`U&V+) zBgHE1#Gb2M1aXIVp}*7LYH~fuagaj4LBGVvz1j)JGmM%xGMA?cQc7c6`m;p0Rl8;TPj2Y=Hw0S)DTi9bk$f+9L zmvG5^7F@(KvD!x(aNkgD2f>9FF48$l+lmVtDUJVEu5I`PSf*|MsDdng1TUX(9xU{7 zAoqD=D0YYyFbe4fRyVXzaz3hV)cv9HKUWAGQgP3F;QE@)j?B`hNxR#hBn?jAiq76m zN{d=6*7Uv{eHF1)C+#Tsd`UgUcs45_g5LXJe|mncZO&^)pULd<9savV;SM);Q6mNR z2J{ZuGBCTwW~YOPXtKhpAGRKdA_fKo0e}@zIbUF`0`k9XwCL4ByrbwrS@PR6gC6)h zj#vodXl#*K7H?6?f5Hs$avzsZpR_Z4gv&w71rY3a&)~7$F?057gsOl<=`#?-{|Al; z)$0&%Tp1b=lQ^F*Wd^l&+pyJaMe@~2>_{XzXBzJhRleSQ((QyD9wtSGXQil(>Q!9} zOX>mfI+eOUBF|K(F(|(`fJss~K%{ncJrl$);)`=MhxBRI8 z<@X-fxae2s|3!EDsV+XS`}`{aeO+eL-87cL1*pUfkSU1=-2?L8v$*k7(tWd98@hEn zMT%MJbmSftD+5cIFcQ=ax>QfK_13x$qhs=FU+(W18Hu> ztv=;}|FB?i>pz(^roLBDAT<0oBPsNCBUIfa_m)qRbjf5kZ!n}s1=tM+`v~RHx*baE ztr%Oh%%{*MvxUYQFHO1>B-6X?^LHTS@H>@E5|1;w?91e^aO<20ShLV?H3)9C2WKCz zLpm3jQ-P<_DkLjE)zlx8{^w(hQT4h!62|?(e%h;Rx3{Mr4F6|+(9h4AmWTILwVwO=uC1=qG>jC+ zv#lck7y8Mv9#g-^D#eXg9pQgw^@mGQ%~yToi!oQtb}yVqcTX+`AJR=P8d*YbDcg4j zeY!M9ejmB#(FU}O@0lpQu;B7bfri#K1WGQmXMv}B7P{r>Gx$XFUAHa|d*}iNw_?s) z5j|d;$b|lzvfPbYmg(7Hk+&!;af1f6l{pq_d|Y{#69Hh134|H1=?2fARCYHejLj1T zNFEXdoPE4Szx2EXeU37ltZiEOywR^x_qfb=8GOz#>#c3#)%eCe-!QM8`KdhhG3)fa z;atoaunK*cRex|dSNUaB`{z9kdXElmO$$9QEcU#GqXpem8t`&`Y6CBqYO?(FUi+9^ z-=2l%Z8q6!{pY%_DFM8K-4at*ax7yLI$`GG)5dWiC`NV@IVbsi-w>%qUe*3Ij zpolSo0wc0n#FHW`(u^$Vfb=pi>Unp&%VxgYAL=@KU;G25F)hexK zpjh4cIYS?vArpa3B)04q@#j-@awcy(18)u3;GD^cyEj8`D6=^5@HEh z@!o(Yfpe_kcd1B_7m{oKnqN4X2E(txLew+v`33GUK`ylDFTaXaW&%LwAq9bI#Su+v zWuc6LY9hm92EvTm8zP$7#0$40@i_tZ@h0M%%|(hM+_U&M9PJFM!8il!vYrn)C0(1< zQ+P;lp#dW}hRFG9yX}D!ST}}=y0|TZ1a3B{bUFI)&W233P)*{0MOiJs!U<)JmynZJ z{9(p$cZ(N;-$%nZ;G0fV?kn7N;kzfP_BqsjeFm>OhVA7RJ7 z@~tVDfJM|&A6Eb(O&T_|&)5<!I5&N0_f_}MwxC=C$<2=Wn32n$=M)huR5WtHJ}@5tW_30c z4K7D*YkC)1Vy+^6pz!JEoO<*8k>jG>O8-HmxUm(oOfS~2t{GLXFG0}ofvP8QW^Y_T z*^1h&#s)W#Ih@Y&=H){OLX0wrRIw^w@D?;t0c~m&F<~a>yn^ z-|p>PXpnq`tl6ESoQdNZ$wi)jcWFU}NKu0!iV-#zSsKV%Dr6&2QIX6TAG^|+?5IiS z?9?X1R>Zs4!L4n@=S#u_?7RJ!vR`8bRw$AYja;38TnZ*!HmWQYx`Xfyss^cV*io5W z4j9qmZk>Qo=0*JZXHli`16E6vlK2f-iyu#fL^}PD3N|_sqdVZom2@v0G!7Q_AtYEJ zhe*f#VaAPW;=+wvB2|b+RVUwdaBk|qQOX)HZqi&kA5yOg>f83%AdTo}YiCG6Xr^x5 z3D6m``@&)gN02v&d7UwllS5+L5G!JlWeeG^Ik$Qk2fw}I3`W!VD%SnyjtpUI7Gt+Z&wD5KDBLeKCEo5>(m-L^!dEhFl zAE;rn{(!5TDW-kU^?J-#>)pVL?gl`zBODe|PUxg5tXN;mV?_TxrX`6ipPXG2LG}e^ zObYb^<$!*Lthu|lwzl>kLf$0$;<*zqK+eEkR*WQ57OZEM?#NE$z6;^R>Y=rQ`Mr6# zCKY{h6bIkNf_X5CCPf0mAd=?a3#X0~W<8L1YBt(p0LQ!Z}q*6F|5VX5ZYBX&Xa zNy9tNJi5R^667{hwn*y4#xpfyNf|jix%Co|o2^3udyZYK6rIk9g%w9;oghYpg{VDI z+JybW$TD%aYA@~>ha4jZa1;R^664XfZ@z<&5Ct}GF!^SMI3b8yeZaD5jbkOY7ME~> z=ua}vKoZJ53=1BLO-tkL^n)8)~Qinp=I(DcLYSE^dHY~^QX0E`EFE@DrM`h`8q@FitrpDKC*yrhFb)vF|8^ouBjdc{JhE*pjn(LNMu zG!+)29iLW}XqVNV`N$+$xAgpBX{mYp<~Ro3omP-!8SLAoM+?RyuN5OBUB!saOuDNR zR~B+RbKEaH+I!=a$kn<-xV76c2-z`Hirb-xE~A?diIgUnSb_JuxnQ{=Fw~K5+=fi| z$}E^{OU+9xBL`uzl)c6A5$NQqfmeuWFy$39E*0jcrWKl}L|c@CK+1EfpaV?IW`yyH zgT_9ZXE$9TNZnM*sn8bQoD`-B4hi*g1~krFwhCh0eEC4-$})P36i_p`)apnR_=!p8 zKrS~)DKiEb4VP`{=v#R?ux3vIjW~Cisgcm5tG82W)#&0JDz707s=`*n(v(t})2U0M zmyXFKI9t%gn_+us=f3%s0Or(~38aqhcmo5_nZNT!SN^a==FGA#c@y?vpy>QbtB@2O zPs9c=e9)!=peD|-*CZgPl^GybPS8X2Ec|cgn#kY*5f-|=@wJdd_F#1C+bFlX2mJqI z@2#Vve80C*N~F6%B!})sB!(V_knU~XTPG{Q;!nvyvgU3 ziwR~K3I-#G9Yxr>s|ZG8NZ^oJdTdj@>y z?5bOi*`|QS*5C2^s#`z7l!J=nFmsFb7e;F}i9u=;%ZgoKh5bFb;ghm<#TRt9>ViOc zalKjBAk>^=o;lBrEQjS6IEJ2%Ado|WN8ovqh6zoy`jMnzWu+YrSn<|N|MayQ{zf!HbBrB@m7f-)eD3HnHAEWC){LCx+TGz$ z64dpNf+YTw65HNmN0kYR>l$;lqxnwUvZ%SmIa)Xh<`oz_c0SbKmuD5-`_4%TyWv9Z# zj<@->PoFX3Fg+JE)Dvp8Rp~1J@msJAq|#F3&^v~46`rZ70tQU4t^(5P-in%u=krj1 zVN0(zoOuIOkz=rLaf<<#b#(?#Rp@ z0Vqas%wYk^7WhPk0NaMm-J>;gnkLa=t>FnMP#o~|OXanSBp0Pmo@JSe!#*JgzvTEq zn{O9WqIJz0PoSK&x_X?Y3w)PbT28R8CPlf<)5|@B+i{b@+)(NI9i6QSh58Ms>C=zeQ3P%eVIc-j{gNtfPQ9SvyB=Ucg=hKHz$ zWg@APRS-0%9RTYZL(74#{iSy3k$8$}osk)~0K`m|LGSe1J_g9S_dFnAURqza2tivb zV_E!qWntAh(fNwEwR6iZJ{nt&L~7mHUMwH8N^;v@Y6Wuq?)}Q!tVN4F0m#A_jU8e` z2utUs@H#VBi@h^@ZU=mMVUp&O!R?)=xN%)w5#LH@(>f5gfIRTSu^$D-@;&i&bnn@8 z5vBhc+-}HA5L_exX0WK9a$1tCGvm%~djSE#q-noH{Rol^g~)v#2RJB;wYIO&5u_`q z9JN@cqQMJq55@^`7NjJsY#~4& zsC$=rL=76+E=@96%#Q2s__-6gKZs~D$H;t5iI^Xzgt~j2g5humRsovSf`Z$ zf2?uX;I!9m(zHRIcNl>sH%0_k7g2*`4#a($fE_C#1>_6D2|+$>g*;aUMA(%@vm z(oC{@pUv?f6|t&_W*hP+-Lqm7nX9InxW`1D+V1;2SLK882bFTEW%1?uC|jYWPR<)o zELLmjf_D@hmtBpPg*`~wtdqBG~JNnNQ)imPZR zdEH_Kj=7|RMYk&pHR>+Qh?`i=ePyLQt>TsFyX=8I?CA_HtLYNUjMkRDV~~DVVTidr zA;Fv-d1Q46_I)24SGoiJ^O2KnnXGhphL)0ndoBF5;j>eKpr7sz#8lT>OgB=8r#%}->-PX zaK*n)VHEOF-F-bIy_q$xGV_wu2&7PDp_o(Y6KzeMbtJHGm;dFXHBy;+`!knxE%e7D zFRjN06+gc2qLriZ0AslMwHvq0fTy|a|18aso(c{AoeuF6;>y7Fr@p8@&m2YJ?XNNR zlWilA^^4Wd9_wIWHXgvyqnRH40gUZMt9E6OdqMP(bPG?0xx;wvYEmy}Geb5Uh;x^uH> zX_%VK_(9^;u{LJoh?f*sYm6Un!!ljz=X2|-B}P3SBd;EwoT*ysMMqIyvF?>0UIQmi_1(X!$kmI1sAn~%hF{#$s(2*e-Z(6dOPr$jTKnHWh+p=Er*dTI!_7*C#g~F= zu8!kOIeJ5Xj8N3ncGax9J_F9u zzN(TN;)Vchc(?1?$l_u4&ziP&@uT+%i~!V`JQ7Ks&{maqj?ae*n2gJpHc6D88Bprh zWx*0~)Hx8G<;`H7n$;oJC%nw79p*cu$$%yEv69l8YaVujW!h%!4;(35` z48!RvAoQ{B?BP5$zy?;fPw;myM&7rrQfhwsLEe}UQD(9Xfg4R^hs1EItK41f&^{RL z)d8R*d)h?2IH=?8puJCljD6n_8Q75_4;a(ko;BCh6@nYp<^KgeDS7rIpJe?e3;8P+ zG(Kb`LF|`5G`cPez=*FIkIh_6h)oQw$%qZ z`vkDL0n0m7fdE4LYr`xFbS3R{y%_KQ5jdc^Jaf$GVCk6&x6#sDqgY}ezzG{vGR`LH-cU@F1X9IaH9sFGwU zsT>RS<1PH;n0PHmv-NaIl);1IxNxbI)@MDYn$O@}b4}$F_K(96cvUcwoSEen2?nFr zA@Xa@zN7{f0#&8RgM*yFp1$%r78A`r5;5KSZ~~y91t%pPQEZ1~Zr*s>^gU;p=O2oT z#Ayrw&Oj_g#ga56XRieSz~C(XvNze%bpE;^xgZOsARcjZGPll0!D$m^J9}ehpx@c=rVS!r>lnlxG00EGUR>1W?=!t6BKmG9^(N$i`~F zz(Uw?<|$^&RXE4vDjFe}T}`<&YTq1ETrB5_aV*iMnUi+-ezH~U;-OL+m&rut`)pnA z(54b0<$uGPJofB9Yx`CA22lPv8V_lg-hqqJC3D8NDNsep&7b=Xv(XsTjnlS0vQ#S) zEzpSGjn-_84B^g17!(TmV&9N7ujc%V~9pE2tQxbJ2x56#hVieX|UBZw+%0&Nn! zB>lN@Q|9`D!%pI4`$?H$FqTsJ);&ys3HQ{V=oO>vu_J$e5_!HYhjW`bYoit!eRi6Y zaKX}L)B7`T*$2&~YlM7$zjn5^7>Q0LcrBpQo6G@0y&xE35&XEAPn-E95d)O<+Gg%Bg zOBxX;grlBn0)A>7IqR0^J~ec)_hPZEWqYH>c|e~Kx{>prtRCeY|mur zR~VC+8|(7sG^q zyppv?1np@3S{^*W)$FOO5nr}f$-@?ltMU_w8k+$S7yNca4LWVNI-21|XKf>V@}(O^ zaW9D*q9ILTe4Hfgr{)1&bBpC?dd==Qs3N(>9BDO(t+e3ODGSaC$q6rd>nY_%)bxG| zoq`36mS7ZuV3EGBRM@g>`N$xm=sJ;c#y!$Oh4iar{!reh-4V^MIBeV!#5G14r2rR! zQH*{oTdoi%jMxlC7K|4VafX=j?HL@I2hlF)WqNqbC2lVFB8a1J|5O}CO@Clm$`6_J z$7lDt#;O!AvCn--=elh{8n!(yLi9k!Qc_6Dv06AqMV0PR_#?&miO@qv2=`CDCZN-s|$%R=5)J~^0ve)IY0Oq>BsE?QKX=36Gw0zg`0rrpgQCc;R{ z5lY{h-bwioH_7Z9WHpCR9}_nJd-KYZtL< z3^go|TgmP$VN&zqX<;)XzP-O>_^>*0VLQEEqmM=S-W?a?Z)Ta!UJOHPGxQF1!C2J@ zv?u?t(`Iq5Lt-_xLgnm zxGVA+QLo2;EMA?_9Ih`oNlQq;1KnKbK5RbefS|A5o+c(PkG0$EwqmuR9ao&@xX`M$ zZj_H3cF_n$Jc_MGwOo*jaOQwP#}{siR^@JXNQz%@n0G6_fi*ZWYU@qBJ%693(%{#L z6peWuk0_V$+mGZP~^>Q##j~o7Yz~d;suHOe9bi%s_!OK`k)8#vyiUud@3_G>_ zC_G59Pan-$?QC-6|90SskkGbt%@-g$b+i;LPoFF6N&>a&G<%+op*!zMi7&JwZ&p41 z5$%i~Qcqt?EF-s=Sy6R#kf+kDWQka1rD_7Xb<5WlQeNhr9pb)rC=lkO9W>|Vg|J~O zoQH|z*H!?Oi-Y`X)JNcKgd|axLEF2)jV{~<5AD!I`yp)abx)%S*f+`hQ91^oACQK$ zAzL~~F%7Q8Q*km>A@abxW85O!9&XrV_gk$m~9)XT&FyC#Ia>P zBuamI5h#=mBG%T%>H@J)ARh!^mNe!hfJS?b1kx|eM4RVbR`Qk?lTTNH#%ONfKv%O_ z<0=qC64b>cX)sfX?){&(n_wo;HYO_{H}2w-1!9dGO{*r-29qQYi9TW~_RioVD=3Um zS)aBSDRkB@GZg2&XGyckLOZ2u$!ueI#{G;#RxnX8jeFhCoIUx&{PM7|>oJ%FlB2=V zl>apWoHAEFjUv*jtMBT!)AD>Ar}SZJd+8VqpER2QxDo}t5FH3c05p8Ey}5@Rrbn5i zBg0+wxTzQ!EY?L~O)W62WRM~M9-N`sa4?52TE1tsI=$gT6G?`TxmXdGiCB;&ZgQE( zhVOB-9*5t$K#07q;69q|VK$zj^yVOOkH1Vh6S1(q7klvo*c?8dTiXfoXzBh<7IjWy z0Vr9a_md;Zl1s$?(Rv^SZI-2N5`1!^K{I0XS}#_pL87T z3&KC#r6*`447cmbY)MYed8(62P$33b3y@P}r5d548nbu&C36CpQOIM_eFeORpiT_j zpPig>%K_cGR?m>;)ndN7Nmm)m-5d3l`ZcEVxmpE97>+%TnqBh#1++OuGQU6#uNOB# z`&U$EKtV%mQRp;uY5*5+$*^-8&70+Gj4-!a;dy^$j=>M)0N&!!3s--`TmeXYzi(lV zYGX83GK!MT7T{#8%865*%686S)0NNVQ}l1Ks@4w$rErO3&k>>udy0C?cFzFHgv(lL z*Ll2_Jhozock~zUgfSFI|5=?PSi(RBk#&4D-2fBEWZi+4XaLMjW#08m>?_lsc!ZB@ z`;`W5EqP2jMHCZnwlUyH;m;vKK{R+IfbnPtUDCH8`fuvGZ7Khu4KAtas0B;$D>ynj zi#7&5;JoUQ9*vwmdEGA@HIEfpgpPB651JU#!I}v!n+8%&{Svq}-@@j=%}2`e(cb2W z->9lOXwWN#u!~EsQ+E*;HNyV`FW`#wED7uKdinT!rqJrK_JOCiUj%qZi%Q|g(HGg+ zK+nXZ0eMt(_dD9M7_5IbtGYUR4A^~%qMD!S)t1FK0yPZ{g7yahC*)P5$goP8Y4Eo( zr)lc{IRQ&s>j;7Ty~rV=zybCF>P$^qt$iEB^dV?&OY>ow6waSIytkyu&F`n7{U<_q z`IGx*mJv;E$`&v3CJzpL%<$2@eW_6jx8Lt|}B@$J0!HIaPJw>nAx8djBfPzW0HUbMO82r7~f&gLOY9GcApbMWd;+nR*z zSQAW4(S`rv*tGOMzd{*9^j9vvL9TfkoUKi+ zu}Sj@h8t_ngsPd03cnW{$oEAZHF@#jW2KvA8igmOyk{n-;+Kwqb>@lvFA?AL0NOaf zbg(RJ#mx2v_O0R@MBWrF@vPq9=ea{sPz*EhUi2MRIzi|CQVCb7%<06h9j+Vz7fC8D zPPXiLm0iJd+0CxLvIuAY;8Gpg%vMI?1yd%q#=gfyn|PjjP(5zP!uNC%MIhKN{uMbc zTdr2;_+qm(Q({`{4S7q`6&>I(cH}sJ|NR7E`BQFiWQ{ksDGwZI)M$-|B`mSP>!4;p zpU1L@RJaW?k~6Ns@dz5huw?m+`z6Yu{cwO>{gzENdzg>3DJS_V1uc*(%XVnS7OqJB zdaz;G|CYi{1}tmB`?2*N(0upX>}<}@$`pOK%>(WFv2Hf<*{trbqW$K>v}b9q)0Xs(-jz|d zCYig*6{TOU7xe^86MrgQvhAQVB7ht6E*xK9RIE_j;ftT63#ijZ+oQ9DO^B7kB;&>XOE&4YFnQQKLDaO=kw7?#R5aOEQm-p3bCi3 zAcSL^+sLFL<`&DwDMkje0>QNL-|{5Lw)ctsCVvbwu9V%Oi_%DxP_bZaeq6E&jkkh{ zx4&bIoX5j#Ve-}lk|Jhxj@mqK3(WERcY#@e;x;xPTLlJJ#F?7Cg7@RRJivTEe{z z6O}15g^;SCu*z0H8NIsKY-sH8Y>zOgUxWXt|5cuLfJslDwpe>mS?0V#Hn?^r|960A z)U3>Q0y%S8h`tzkl5-mJ-`hR0{R<11+v$wsej&f5$JX zY|I&2Fw9OXz{i6}kMfBE1WTwjoxI}US-R5L&qS8NjyOyK0OdDWN-iv{WLLn1`k|v} z$Bh%h1dfk^9m*_ZBV*=8q50vSem{-`z8d#fz$HP{i+K-$!BDVfinS#DS5-cjg*xn} zw`q%;@gX9Jd5Uy0R!K57hpA09y01Jb0BSd`w*^^qx>TaarfdT96lD*i;Sce#gmEVH z%;eHP)4~OB4Xu+&Q9lyWfgt~ zj^xk)v>~Xkne7(lj&<_C{LXU<6kcAS3J`6&^41UV=B_)N_WrH@24KV{!$7B| zLC!C2%H-~mwoY7Km1bA%G_j5!wh*AETt<)(S%${K6aZiL6Uu#6%?ONip~I)GoTb4( zwGHoY>j|6AnkY9tZOg5CZ2eGXiy5z@Q+;^Iwwm|EI3F!%8*bI$zUWYQ@Bd+|MVadU z3xVxjmX?|SF1a20Zf9>y!sgA*dB?YCJx{&O-+pEF&!%NPSXSAxq}Cv={`XJaJ3@aT zUBpRp7YrS~t4lW6?0${mBNotVniNJKh2-WUp^+F#?}HWa1{I9`F^Z`Z#vlRePCt{e zg}an<8vDxyhoaO8B)-RqN@jLEZXr9ok8bzq|4&sVCk!K2vIPk_iFul#ApTw5ZxSa6 zrN2LU8jks+c{5#;Gqb6Fe9f9CF#WKn2+VPSTsb-oi-d9toz7Msh?IW0o1nxJre=>a zs;1BjvQ~Qxo8oERU%|}dty05vvSe+sG4|ENiq?qwJf-k3<&M?OQ<`=~wEM_{}OAx?CKhW|Bn| z2^DrF7QDHm@%1Wfk#AalPA5T#Zuh83&=@lhGSKDLrAe#=T|0q_Fs)r!-pibYN zZ-=0A1s;u5lg4sOPe|*e2=T97(awWJZ|F?4MNeq_=v5(pWX5lUf7-mc=M%)nkmf;r z!JVUFMG|GoKM7+4rn8+rdlh|S3E)hRPaN&l;GN{$NEi;ldk&_7>rEu8W|(qwXHVXw zM}v819esh#90e@$7Qdaia}0T?1;e5(wPm-QCG@OfE|&`Mlo{>XDV>GN#3*rT?ZnAN z2^T)Gzjb~cQLYtC*)C%~`oz53 zv_5u};KdFF;8%ha_k-xKvv{j!a^|d~?^Oc{&<}BV=4Sh(L&e{wFo-zGT+4V~K-b*c zgSKY%q!$mqO~UkD>A&rP`p{1N4+epDp@<2FU8VCE8t95zd8f2LMMCts#PK>}^UT zu%H5RxK!F((m>r_pp!Bj)+z~@URB;=)`B`@55`~IHVsk{J$B|CqNse+vMlNKibvPY zum;x-RId31)08VSAnVn&1S7;4tucUanm1-VOMFHeH;OFAKVG?#BL~yUGI(@$@q=6} zEaX0ZSMF?)0mP+$-9)5FLalkS-EczEXCbLT`P>>7Pj>=xN%4o)!a-a6EwFsni^ zX;CbgQux?A)QLRu^&qT!A_g^9vp?1lFG{KsL;CR-1mMOia%?dJIxY;z8aJa z1{l23Kx^0y0WMOR&x0dL;>z)>wkWhJY_*2drN!?-ZACjOT|!yrWPIx}>RQ{#@gvV_ z5$b`zarR1vgo7fC0NIj3w$H9?U@xA~%@H9VmviQFW{G;$WIgY;ObhAkD9E^sN9;rr z1k}movwRj)O=d;?c8To$5WnKA`*t_oyX%Fd7}HyojhD@i-3YtHw+1`tWS2q~f1Gk} zDip87BcL!B2QvE)zS9=8B`cD5?yDbw(zd=!uQWB-rrhdT#-k=~8@ zd`4LP6JQ`D=4*BtBCtrSe7Lk?VxFdU;0D97od~aKMeLJiPi{sHaxmcyD{$8@TQu8Z z|GDL4@RwjD88=X8Vh%9j?4oyI;)Wuc7Y(P=Vh;C3g+$zp-twb*ej_2xrW5I^G2xqK z3mIH#i7{9+0vXSr0>V}v(&YC+SvU}&8kPc%Qu+EC%VHj?tL3$LOcb_nSK*V!8Jbt_ zFuD9$8lU{_87H&7S3YKeGtQ#I`Ej*Q^U0QigvrVVrF#74#NEcN$-TcFyE0>dGVh$1h|?eY9-AR++NnmoD?+bM(Tl%} zKTFx8RSFax3bbjNUqM3UxyqfPo99h=5YN!u5!>ebayoTO559Hz;S#nptr)$2_c#zF zDNhNQ-eP%Z2Pr$uHv~554bp^s=*xc=dp&HM1|?$0jmkjim1~m_Cs{LFH=e!18w{`g z)@xXMC2&Gb+(Gi^#F?bHzYPxfQi;H#QRbwH4}?@H?YVx5mUHeKts#Hbrmq7a-)%n9 ziF#X+t{!FG9!*OelqBoVZ`H4spy65bH2i3InQmq$;_ia$co(x5QIO~qLYq9{F zbJX;1dyOi|(?@;z4ck&&Z1TYlnQIk(9bFVx1+ z#?WEsRTe~(FOl7~%-0srjt(WT8JSL(IO^~$nua|{eBRUsO|5+^S1`JhqiL#^C}zVg zk}m)!XdZHejcs`vA~!cez8Mz*PdcFH*=$fF6VQ0?dr7(x6}ego8BwI)W2-!(7h*BJ zW$*_KsTIE0U~<1XcM&uG0~!YH1`*9H^ZeC6bXOH#1of0D5K%x3jZ9ZTPbrWhGv~ql zagO_!*NTrVOintw7*kLn0Akg8d+7ew68dEI3HM%nyck*fWu7^?))eeGnyAORNGp)l z&^zX&)Zn2Ofb~lTkAGUIM2qyO?r!m_=u+Bowz*hqJ^wQ7MrMe&YOk=wWoHTb#Oa06Frc>Si{TOB9lmZ zcoMwZF_xlV)9lPx_bhR(A}VdJY^5$xyhcSZ(?i8xNi>^3`wCP9M^uA34DwaD3#Td# zG#iZ=r*k+&IdQhXdB6SW9c?cH6{`3BS$ba}Ss+bj^X42*lDc|ATcfS^9L%C8iEbzK zsGH8xji2WGMsiv-)MyyeKe(rPBpzJ7bx4R4BgYyynWX-j2_V3nNU-jgnW1g{k_LbJ z9^`~Uuu92*n}(mkjW=7oZWJ@FAK{D_VBI>5>vX?#aOpV?c z)+~RV#>Lj4s8VK_pbF|&Y>v_{gGl4+)SQSpRH94l0DvJ>dpmDot%)ej^Y$n_; z05I(+sx=yd8jqP!Klw(sN539YEcYRQn);P0ciaY?LPzcle~i_LPw_{rtRv!zemnmI z2a9g=fzKZ4kMz08U!M>0u-uJx^fCud)zhB8EnB5c;U-7!yXeHMvx` zm*8EU#(J1BFriW`z%_@=5u#zA>&qa{U?EYW+=ttZ6)v)d)CtJ z5mh#n&6YkdR$}mODlrpEDxmbt#6`*FxTL$qO}>M_DnKOtIJ3 z;;Am@`_}3Ny_@JC1pBl(ymxF+@g$UqZF+wdQw2;8p`HMv`tr@sEf0w391+N&1x#8Dc7d>(^2Fv z>X~tW+nvn54tws5Q=`?{w}+NDdx9_#B&P87R}x6}jiT*RwIkI}aJHPor-uIg(O2aP z8zB6_82&QRE?Z|87j;19=@Iu3vk5OvAq`*t^5GTCe!;nA&(|zDsn6>?I51{wDA2^D z>VwxzZujDG&^t2!Dm=Da&bQ`VI2{`N_-3}0&|X0)#rL;TZp~fj z1YpuWD&w22bmnYyq*CCLP+Bgr3)Z<(;2oselY7rsJ6R&eQjm#2zpOAXXsL~1rL{9R z(rm}HKm)e(fQFehR?UH|Y$*W;#s0Dj9Q^II>1+PnX)hSdI9R@sqAB!xQz7JQ z+}+Fp;pXaHdxvx4)_G1{wucnN|EQuQ^j0%8=uTSU?{?rM9^8Z6E9r80K^r&g@2ax- z+;5UdP;G=pq>gh>#Mev!m;T{F4k)Nq3Kt(FX62ei81Q_bNY>xP<^4G+9!?}Wp;@k# zBafW6Rr)l1xJXcA+tSwBl`y&g3}#Qfl7O^$0?gZ-U=OPdjbdppE_q!OkE>LR&=yb7 z2U>w#z@Cn<4&mv}k{QQ*xmX=Gw`{_fJ1Qfq+J%*}b;eCE#{;D0$vn>NB?XQ<`BeCe zENvGx5|8!Dd|!B2a9~@(E)!uo>BHz4;Mvd-h+5LuxJZ_5S4dB1w1S0fP$RA!0WH4y zmQ&?grif=d8-A5Hf+drtaGDN9Vv*P7t(ij^^ZDW@S&Ff}fpCiRqv7S**{>Tp%f?=> zIKfEs1aL<6E-cy|XwPDfvqyS$I58JOyM{iDW9*L=?rzeJhZh->p=+V;;??rMFXjp> z3*hY%?KYu>v$^tjjS6==q+#nf$T+g_HTbPo_m-=tujX}SYyq*4ycU<86M>L?R}1*x zMUBpBWo$UI#cEg5Iv7?&b+in`kK8IQM?$MCYcgJ`JUG@6UKY%rNQ6;DO=?wrgm$iy zCsc=Xz4~!B3Ix#2rIiqH4fAHpWofKIkPNyMo9EgkRW=*2?O0t1>ytYQ@VII`tA2}cO=DpkHc!k0R&z#6|iqxl^b zX+7OT)esWa)J#z9K0()bJp!PdZ-2jNQkyaXVbKBeRRv_?r*58ju-u5|ok4hOIeH43 z12?{yv87FLe{WB15H z!GTr--MWW$j}^Y7WOwvzB{lTEY?HeiF;A>7TmpyJLA1@b@@&N)zlsBPg#+QtpwjD3ZOY##y!0vE?gE~F(t zO%;hpt!c5RaoLynKEWfoD}cEf~aY+FztJHP0I<7{0)Y;m~#<5ieB@0Jl z>T(X;ncddDm3|;FM;dD#tSZQlO{i8KOz3`)A)^24Muey3MYAbH6=xePIB+{HBn3A+ zf8MqclAg>c8D!OQ{@`BOMu9f2z}PBKa)%_^oB>J&6iJ=lGT&q~-ZbOye^fx;0(~j3 zD~?(eu_5^v*|Njvpid^q1~7lEYd>iEz?nO77GN-O3gTiX$QGm~Oc-rR8wc-d%?8s*DH6m>bTsx`EM+-qG)F>HEz9D`WfBYvr=9vOTY2(lCr2|N{Vds9%FS8&Pf$v? zA@V{w8gfH67+qf%h7N0tVIH zvR8oTZF#z8FVmX_lGW-ybBCpYqYE_?`HKj+5SCX4PVw)oDh z2n54dcdsr2hxK_#t=K5iz4?zxIM>21&1%Y(c{1Ppwkygo;otLTb5>W^Bz~8*pnQagM(Wmk>a=%|kAgR7b$`8#UcHQ}-d^T=qfbpvD2r|9QD-ig z?Xskqps)RMfKZkteTpeZvS{|B&wUOG%}OSNR(c>C%^@LYf(D&Vg_Av|96=10G(`f1 zStl1uhDLe9GObN0J>K}lileA|4Yv*Vk)aQrINlH+3x><$9;uMC*j`bISiUJg$%~jJ zO>2KrYy<1UaM@d14hDSH;qyxswqgyXcH2PRz7Zl?{PiZA=tdtSb5Z11UIUH20)m_D#Y zM*Dp|uctxc7ZnX2yGIW?ESovR-t-xltJTop2id%A*M0g$8Vi4-`SvGrV{4NTQatz| zNoK=C^{k_kGc=T3kzAQ2^s9<7j6uA#qu( zbK{AM>b8cc&6M!_1^D^#3J4a1UFVMq7(0+~XFB4%tOA*SDJ3|0gUi@zMB~!6@!Rhi5|NFpLA*qqPJr^v`Cd3<$IWO4gw6l+~ z3P$MZzvY2p3?>3xyHG*pwt|^_L(8!;S|2xcXjR(Wu|@Kw#^Axl;AVI8N?yEbDbK_r zgye9B^r{LWsV+`I62qP@Z7112W^f$dDWK$dPUFC@sbY^G?};0QX^!`!w+kX!pn)4{ zSH1f!F5Yp55${)|U5OOkRSzW&YQ=i}UAV$L^M#uIGgAk_Oi?o?`OYOsN6Za#BBEGx zw9xChQ+WnC+qTa5hC%3yAdkgM4ZNQ@)3ijv$^fXZ;*1t0dRXNot@*XuMAEKi?X~-2_SdD$H88^z5pjS1tP6hr1@NAO zTO3rlJApqv7D5+{(|7eov+2aRoM-Wq1U+JhJ4pv;6(-fDkD0+RVknvePWuq$C1L)$ zEFg6pd&H^3)Zn-t;rO0Wt1w=6I&-zBltd0SP%VAK#a}mRJ_Ha2zsO$C=2a#nwEOZ zotrg1IcGU(v+ef0bI4Kd9z7k3@;7QqXeX@X%a9-H0Dtf4)?9J#Jz-+>4kND)c_0+@ zVw@i(l*<+No4J@aku%?txM;HCqvlmlKhnNzyZtokvaJ!(AYopbsZ%FtbNl;Yp4M;K z$NuPvmz1Scm1PbW2P9kJvR#m34V5gAQP;~_hgN8QgwC*gb%5=&Ji$9J3cuLiYwYEU zhJ38cw76~wobXD5peyxD-#yViA(kf!2`VYLSwogb`T*=AE_MErRGi1|?SNbzd?Phe zrYXBRm$BrZ5)~km=^d8<4zb`OhMy)ulB9gQyhji(#CX_k<6VftS~Geu=%JV<3=DdU z9rnY!Xz^WT+GPLwggzcB#@@PIUoD~Da&UStQBE>7cq>=oucftU!^PyBGpCP@3Ftfp zbIsV>Hz8#4rIu69!4UTWtIyuug#ftz6#Hv0tGbbeTJes8-(`8`Q&OG077T92t$i!i zggHXfF;096fH|^?CH$I=($4hngS^zfkY+W{Zx<>)#VV~%BeAX%RVE2Z0JtK@zE)d1 zqtuU$a?Ad-X@homDo~N?n9C;9tiB|Y1`I6piNPn2L+TI2bf+6bmF%8Nd*Wt;XP%k0 z@rsOBWK<5%2BaD^W~c+bT1WDyD^BQNH?5hUOl-bPH-@vBaCcn5Q~(ZMD{q(r%(YrK zAeq%|wdh%A?TiNbNs6y&>O2{xo)V8I{PYxfA8_^l!Jg|yK0qA>n{+(wY`FZf(FO6+ z5=%xd9|gSdSZj1yK)REg4DJg<-BCmZRss;;_WX7V{M>!v>EH5U{id&d_d}~RtI~O$ ze9Q?E?wxHX%hqv72wNDkGi5AJAk&>_FK(IafG|cID(Pr_NRor@V>Kcj(&X+hNxgar zO?~Mbji4R7dSKsfbc(kW82N4H6ET!Q-e$mvW$CmpL7?5wgXLV(!~OIW@ks-guuuH= zE=l1$IH}_PW$fBK9S;kdr>tw#Zx1DJHTR7=hEM*~}`*NSk|=X3P`v@w}}r0iwTy-w~frU)ot5jB3w zPY)qfiwcf9bT9Cw)#o3}elPXYY-tcwE_-?Y(gx!0a6i z4CE;jDcw4Sj@(j_y-FmRZY{wo5CH!%A(uIvnKiR`=HM71fLvorhGG3T&I$KU(@tUH zR!%O}iaqt+tJ%4#d2%H#>R;OxqQ)>~hc$Qx>5`Wznwx8gDiEw%*mD{YhVsTmhNM^$ zfLOwns%+bv+^@hwStg-5B{x=~SBDfnD4$J7t3aLN))+3~PSXmu$1^eNSM@?c4UeD~ zJuPX68CAKHl+);9pf=fF>cxnq4`xfW<-HZ5yjZWp3AGxr3&)pv2Kj@On3&X36EdBp<7OLnR^K2GWQ~L&ShKx8gnpR2gtPIj!<|1 z>A$0D`d?6plW6d10_WBkjQB+>x>Z!{NTNNev@ygFc+1wPddCKU0tv5e=qVs zT4Z#`!@e$Rax`9Tug&iJrNcQV++uUW)!An=gf+&R&zL}&nLT%5!mA;h;CPhUXL9As z-zbmnJo(fMo&4vhXgVbR&?he%l6>?SLSlm4aBruh6G)~YS08i9YeUP#=KeHVd2QPJ zhpa5eoQftD=7w#sl+01$>;&|%3YT{#P4AnNSCy7!W?7;>mF?Z%+3(B!X~|?L-(iz) zi*7jg2Whv)z`aO8t7&|WIc)4)UG0IYS1vL0o7GntLgYsn=vvudH$TA^4kwaEivc2s zyrmu6%~?52oLSnuZMoiJ5dHlVG(DxX|0kC4&)2G0|BC=pK?zM6Z2pJCh304zrIhMT z&?d&%*JJ_WQ&Lhw zll3S3!bZjcTfu#Wcbf`fU#rj)5nQWLUza3eZmu3DV*lsuaj=Dh2?uq4patgWQ@mE; zZlClslo!KQ*)YuCy;$U!(sht|ezuZ}nw%&hx( zg099)t@Q2#AvLBf@qQ*ICN*h7ROqf+oPjgw?%|7Pq-p}{f75DVjPg#5vuJcP%ss2N znqPLA&o=}=_*0x@f48~P8Z_!077XK(&NO?HOAJIe+(Enf&!WQohtAmA6{*qS=4Kaf z1jy0oI-Z_;HTrtZE54!y<+r@WEb?MQ;pVJWUp|+p2bkW3v~Pp@=iju<2G{+~Cedv` z-(xjV&T?UQbk@GI+PqHD6HBK3W_C3?dqCqn;kk1W*wwJ5-)F#j7$o3c7T)8qrb83e z+{%8Q+L*V+_@99O*Ay2k^xl#lB2a;jj(}9L%xO-_W{4y$k$Rc4U~XrDc9*3f1%CEt zgM6uc@TmQeYfIJ~xRI!d^`ATPzZRGb|KRn%8|A-p?Z4kFg7Nn%{NGo{c<$#%q0((w zAF_r=#RDS=tftD|_eI(pwTr%9UO1r5ie*<1-`=+76j@|0rgh+i2++)w(q!HZ=>KeM%@UyMF^-Jb8W1>i|dAZdu z)P1#kHtdjEWE-Fz($D>Ozy8mPFGL(f`@j_I$uz}%thFpy06X(Y%NkQbN&;&8=D~){ zY4h{8*x;_&4ZRN>Ms9|{*pY{n8r1p`=$qm^LkGme5jJd117#!*^8BQz?dc%jX&K6f z|G&AKOlbIjiHrBpS_yxQS;uA3^o38^gfh1pi>Kn$EjYz?T-1{GIL)N^~r`U1{ zWkIkI!E!?aE7{}Olq4y0vjEgzH2Y74{_`f+s-`g?Lb=`ox=ZlfB~Jdk0<~KWuJYP6fbm{tvHBqFZe6lVQzg#GJ|cuczg-E#lZg8%)8{|d|h z6AAxEF8p^({CEA|oPW3#xEW=Oeot~iYlYghmPYR!AYK_Kx&t?BG@1E7y_x>M@rZt1 zAYLD(Fs2&bKR;Q&>I~xi`3NBTdHxY5rR{%yk^w*Cfd72t|NjqvO!NPSm3|Dc{A>Ha zzWIOV@oOgX@h+O<$(&lHZw?dvwNFhJ{L3)l=T^_JpFjJ5d`txKn7e12-20I7&mzcy z4xoE`-*p~B-n~hmJNyH!mloe{efVt!`(_`Rtuq&nJq|ifQjQ}rI?&ct{=f?}vNp5x zns#A&FX21z$<<5PKD!xOY<-M>p>VsapdaR%74{=8ta`>Y;{CGj+IuNl& z8(>05AIVb6r3lCzGPu}@d)RQ4%lv1-O+R3YF(ipUI7Gj;zrVjXj)7U|&e!W}qtz$h zz#YezfxKdsRXf5B`sVxD)CV0QV>?!2-%tCux7Qg`nrf8KK?|Z^%pcdkKWD9}&T3F> zTFFLKxA^GF^zCde-1M!!zoNW@KgJ&0$tUTZSzkAG%BMBE4IBPrb@SD2jn_W&ml@cu z+*y;3=n)BZh6R{$qIW-1?@Vjj$Zo$qy`xD<3;6urv)$aTTVEDC#h;fibdu};V(mSn znp&g3L7D=BpmLQ?R1{QD5Kwv|qJRiQK|xWPNKuep6OxDsh?K}hL|P&u(z{3}G(l>p zh8}t+p@;Mdc;El~t~K*zW{n?QCnV=QZI|CJXK$;*JjL=kWdUMRr48wjYI0&dpT$K> zN9)}1!D{+@lh;nnk{splvoit37GD@qv-6@!S;m&%AjbJ#V->?=A)o z%UBc+HkC`W%kaDz;nGMI0Ou;S_AL24NR6M9g<5@LGWZ=8coN#4$A48VI(uF8V7G;5 zy#^Y%J}(4|$(z!37Ps`z43J*1I#NzvD55+CO5i>jX0U4BH=LdF5SceG+#oUt#QpjO zUe0Nz8Z+_SAKe3*D@A73Z?d|qo^gfR3}(DmJpF;KK8-11an2l}y%{fjh0z3}>1Hfz zU9u?Gg5DI^-J;W(%GNG% zXi_@!tzEP2_B;T0YBzLWuJ*hM{$j0uBp|is_*Y+Ff(5LHm$8IqWGkhooN8phw`1pX zO|9|!scfJD2bRPopmb@=x({n%{(1CSl@C_y(iN^0xzr?=r&_@N)D; zDRZKT$8$ji|GBn~F1k{~=ceAEjAecU`02<3t;DOOf@|O&r<`khnr~R?867z|9tBv& z_U%)C{`uXtHoPsEk|Dva4ZjC;bI$p?G2uRP+sum=rm?&b}b z6UbQ;m(QH7Ayjki^&(D}PSC)6zB41qn4SZs`e#sw;=t{#z||@m|EoRx-}pY!d!~u1 z(h>qqRhLRTRzg46z*5-5|B27(?;pH&(Ocr4>Ap;fR1ugw;EF4NIp)mWIz?Ki9ce51 zUh1dLjq@66yKjyR&VX9Eoj(+t`A+t%C#Lr~m7I274@HyfP1oC5)kkVwIc*#XIG9cq zyTS!bkpJ+qFyCPb6o;B(XywNR!64z~x#UqK!EVP*&^Bn%hoYQ#?sZ0%r2QX0)o&2{ z?A%y1H($5R39M6o;i06jBY|)d=RGCn$;*=j3Jti<|64E(6hCLPnLR(|u0J@#kHW7x zb$x$S)MD5xzIxf4na?hQUj8O95;Rd{7xe)mIwSB+gQc8|+AmfG|fzxok{fPIIZ=SEy*W054 zgB+ET1@BGT7AU3j$J}xf#8~@%P@!Js@Ui#PN`oqBS>{hXe^kU0QGcuxRgrkl;OE(< zz7R@iM61L+d|bFjJbrkK>X~#Xh&*3dLZev*7vg~@fu|3a@L-?{MZ+&mC)4G)}j3gh=0dW{^4 zOIXTf8JUa%^+D2>b%z#&1LxT1TpT#CPog|u>(UIDYKZ?nq(`tz{9|tD^k9J#3+QZ! z6}lFw;TFQ`@TdN8v#|_o{fyF%EV2&#@>m<<5%uU|Dw@pVjlSsi)xer|KE`I3nFE=; z7Ctz$)xN*vL}UGht=nD0f_d<5$8G}LJM+t6WrKtywapLrc+diC{ywL3!8g0R361|T z402j85#st{Y7d8YNFZDWq13Sju~S@8ZF~x#!yg{it-l@5Gpx6UF<0O8Km!J3}2$ePX9UO@d6??+LdSwKHDB02t0I|>lKY@h8E z^C>IpD@8YK`7Jq7pfhH-1GpS~_1mS_WS=@yU-*()*)Zz$Lb<ikGq0-$}S>)6voL{HmWtz~$#kk9QoJ6wDrfY1gt5egw^6 zHC^fcP;`IJJLPo1c&$SWrfj(u7IW>&VG;B~oLxYAZYLuRH!^#ODTK0TTi6X#P}#?X zr%ZP?nrVW^Z|t1u*b3(WP2Wg^#4adsLRn{}g;cX~yxNjRfndnx>eS-P0aHC)@NrL9 z*Hw4Nx-?a4Z?kgb1KG|Gf@Yzm2}Rb`e$kf#CtMu<83cr2{wxNw^k?Xr-cBy9M0)jc z z{LZUbU!Yg18O*P|@_-CXwT$IuaQ4(5;s zDM8C=D^XacehZ=b=2c=>MV7(?taSyoBv(1-{q|d)WGr$2c>_Hi-L4Vh0n=KRLpQ^gJ)~oiSml zMNCQK*r^v1j>v#|IqZf7;7qVE>hYHcq*E>L+nW|DBzs*;KPY0Q{<$d~KdfL1TjjBT zauF7xuJqm_iRx>!?$!wp^ab)RpREn@hUQC|BPZnisg)_Z^oSx?H%KS%`MmxdM%`=8e-jlXGF;XmbJ`c>v1zM&q1mE15 zdx>3e96VaL&PLh?jRrGp`VUH5z1hCo_#qOOqr_r>Hi^J40pYTLw7NZOtYOXIK}5bF z*jgPm7}2#Nz!)o}zVT0|%!LR;2jJWJmz+>F%1QUVLbnTSFM_UFDuB#q*>tjLy5P z?dyx+<#FEn>%gthL4Xr#lw;5_?g`t{Glv$z%Ts8Noem9bG^7Oy|KEqWz!?*<;BBBn z)qc26(?6>4fKG1O5^5J$PKdAi?&@zdKZ%_F#le=^T_ zl755bk9#H1Gu5u-{f4Wsq`szhQ!FKevM(an0zs6&`mgad8$WkYsUtX;^IiWvjxzuO z9&0}(hQpV~YCpepZt?r?oW-JHg(zyHZuve~IvcH9hM`ttLPGMFKRGoV7x94-kV+_S zecOTEZe`wJhS|=-7WrJ%nTMh^oAx)d?qyRbAt08S5HS8)CnUjl*FenLA;5S3(XTg{ zph6Y2l)3w6V~pVQ#-gTrHye88iu{GQk3U#+ZiS33KMcXq_x#Nr$R*3;@CK65(5|;K zXn&g4q2bT$8WEJ4g1m15K~-To1PtR(W(0BDpoZzk2B5Rcy~ZpFi7$;Fg6% z_QuH@H~Hw<^0X88*sClaJHqEn+Xh*9sRF`=*p@AK-#bu=`zZ3gDz#G1T8Qe`BrLX% z)A!BLWV+uK1RQra{p1lF=YzkotoCJh#=Luu`;w0{9G`PrPN41pb+Ocrzr}f>91dPn z2PsJ81MBfi|MTpL%Tpc!`~BbeV0%;HAj&6OXY&7y^7pX^#^C?=|7xYb|1a-Bnm?ON z{XP!d*BlePpV{_x{{Cl(tSv{>e?u&$zUEat`0M_>IsSjUK|Yde=w;dF!6-f6lZx41 z^{mksqc2BtiA;<^59ECmt7GX=et!Nd63#_^KJl!6sO_ug4~=K}WVI(F+2k3G`S6LJ zo}OQk!v2J@N>;}@HKQB}#r*}?6Q6NtVTVF4C_YuQWu4EJ5XJSy-gNgm^8Dsphd*(m zcB|z}Y_3J2ls06$A%wg1>S3?$(Q2zQgOmte;%VT`);eS5;JF(U>s|M%ShLYh7AV z6(;Zt)=th|$u30r_~c;<%QMUUpSwOobc?nVMMNcYJ7JY56l$usIIS+6+s_@$iq1d< zfQyo107)6A?QH>MjKI;|rsg-n(My2=K1{c>w~xIzo7yI+3A6JF@(SoKyJ2xSEUZ;8 z>^HFXmJQRENxy5JP9Iw%w6(>)8I4=pbM$eoP!ivFBRP6_tkcL_ACSg3ABc#GUJi+H z`p&+?)wsB~C&GGNho~+}!MH{F39|-QeZS z!Tv9l7dt9nP;d6HZFiT3hD72C-7@t(<$S_d>QCR3zVR>__U(glO%_a%`p>CwySILh zl&tlN1XzHd>^4WJ|iZ!83O)SFBgj8mFZ^|rV(6g=^INDFw~yxaTE2f>@4G_P+2K-OiVC-%mh zTKmnO)5Mcg;7aQ3LeDemfLU968*$lf5e>nBSuBjsnO zi$8rhZe#6K6!3u$?x&tzY#O^kd|FxERP3gnG3#9ife&|M>Eh?)wn@fXq8q%oUNzJT znWfL2VsS&QcNUjO6cQ=OJk}hOUcGfHT=T?B@F~BY7^53|i**oINl`zNR)x>p{JJf( zHeCBy*d@Ns*Wa($)X~<;@xVAXe5E%x%TUZvGBD8RCbZH7+@TfP$J7FrPvmiw+<8ar zF;Jfc!nCek)l%UKRDD}1i_EmW`1x+jblZlezq?>`3^L|kbnF+{qm(3>((&H=FCnMS zi7qv9-EGU<^e`S zufDM0VDFQZ>)|)k1}~bd-o2TBUoOK1$ZWLH(gFgnTAIAZ zXpo8)rt6R(%4TyHBesE2$7tA?SQ-73C-A(w<}d-k*vpjp)Po+qw&RmjbnWhHLqv9K z(Kj1~N97qh`GbagQ3`+D#{HLD77fn7ju)Ct&U@t&6}x61_rVjalee}KBJb~2L9%Xq zLD|DFit4@(FAIzee>Z7M;E>O0$=1(TmHi~Af7d6cK& zMR{-0`+MMarW9C*IunN^z1_)mxeZH?d*F3frXGh>RV~6)_j6~+}QJM$ec@j zRy45ZfwXEFdNi8Xzx4U&la-1jR*ye@zl`z%>NW^uC5uZ!T32Xa`y<@5r8;ok<%ebH zThj3Ij#cZGh6_h0)UB$E8Obi={r&a_5=c{^VDHh0Cv7sDPZ+386ETJPDr{aAD zBqk}fxFRkhRl}5oU8c`Q6LdC}r`n3sCQ6URfm7)a;ohQX&kU!aXN#xEyzAM?V3ZMh zb<^GT*lrZ7Ct<+Y#TVv~_h1xIvaH1B3RFiL zuk&4T>1H*a>-uI+YUB#=@tVHTDK}Y_nVI=9YA4LLHDe2ZlZUz682?Ro;M_G(DrzFt zZ(wOuR_6E7CBjnT=OCpaZ{k42OlCJ6chXzM<0w5298Q4W&2>tth}qZRX@(s9iQ?bB zD_X5B%@lvRZ?;E)r~|==`8T`maqg+h|A=Y{*DY=889MEr9Ecg1?az!qaglK9HZ=?sZVTksF}f0TlK@T{@7lYo-v!Dmp{-lhc3A|7b&H;udlDusU(}v zY#k$N{)v2krgJ=PVg>KI7vvk%+S`yeRUFYuR|S_m zQ9CB=BxL*hv#b>O*X5g`nLcg^S8=nWSn3%^mUM70*kuXK>cOtvZH8>z%$$kN;W2M& z_Zn)#P~(UTnXnf;-r5}%9dqw|Ej^^af99EqJ++|pgPvvR_U~PxxHutQl0x6|b;-&; zzHFt(F3x$RcHGKJa^W^eySx?q(Ey^4egK@2lptUNUygoyB}^ELyY7BQ;OS?H^9r-y zYfiHh#6QC|3LM!>@g!6+?OPkQ5bk4vv*M+AGxA%FX7 ztu8G|N}W-#ltM$isGZgkH(>7063-;^9DH1BFbOq-hw_9WhtBt~ZHvBnnUR`U*2I;U z0MUyN*-UBAgOUi^Xf|EGIV__urKpPNty>w}%eMy%UPo7J zvb3DK8434F)@=t#nwT9daGSnJhog1U&EE|HV64V$$+}=Y_p6}n;lSyZA;snyM)t-T zWtS!l{Y6u}zVvK(E{q=#qeAYiUe zo#Wc40{ev1nJG)A%pn6rr;JUhXKwHGdWE*Y-4%)g2uIzNwzn6G6UunKIiqmBOxD|< z+Cp(dy&5S>y7+($gO`0SgXlITu8f-@(WphQKgGkf_Fy^uWayr%hUd&I!G?iEn1}iS zQI`;VTAU{)8Ba3*z}91HPMR;gL7Xt@Us(AmNg?d+Eqd56Ck^mc*K!L`XVwFPOk7;} z;lB|S&cWnA; zKYPAs#zdokby%IeH(1WD%R~E;$@%YoX7M> zjFbc#EWKf~wN8L%Z4hJu zaJ-kntybB#CpUBsy^EZK+G>dc#6u@_;bmojc4~`E3pbStfk3#!TffUfe|0_S*51@?Trf<9K|1o}J|k@@|zjks;{(f#LDb)#{G<;O4<)Qp=GcfaR9k+dZ2 z<88aS5hrUls~XT&ca-16$V8`%NX)$L7Z4ES$}iI%`5_mor44h`hf13Ds$SorUxybW z-c+@<3hn7nEWMlzkGIWjd-5vQe>O=>G^g3p8TN7Pz3g1IDT!Yo`Ud7p%g}ER1aoq) znM>WER`KZ!=UjmRvLQw1B^S#estq|Ex6iQq))YJCb5~F=IK)4zs#!q1KKwkFLV4Iu%`d7so10RcK_n? ziT@(ipM?LL&^xXQ_kg!Fa?rBuQAc9S01ii8oC?t&*H)-8tjH`E{1ng|oo@XtGt=GH z<4w)rpS!WS&|3usn<=*nI8H6e;kimouX8TPju%kQhb?y>n5(t?2V`Twk`ZGd6)zI) zOx+DQ)ONFP0~Rq>(7Q3!RIRD>%ZhHFE}EHb&m>1QP_5LTQ5or+(lbamo3_ljY5`OQ zY-8wq8Tyt6_y$E?QPE?j@9_oV7%Zz0vA(+01od;r#`}%I2K2|T2f9AnG;o?M#i~kC z2;H*=`0PT#wc+81iz8HL+gV1}-BhwqfxSO|=usQdAj4k@1P`)(zS>SMg=(6K;}DNE z0+y!zTf6ZUs_Tn>PN)lny=7~Ee0|UF^xW3UryGNW4RI$yr@N!0`R!dk53%b*@ufDh zCz@Hcw8AL_z}`#hL@oF3Dt&om95n&O2}-DKW+6OK>Y4{8y!n6TD1ldztf?(MlTH_` zQo5RG@N~p~NM@$pxb7YH_;0`YkYGtG&9`0As7E6&%DG2tHOeZTydYlBHaF@eqxFJT zUt)jTGJAR^6AMXU>7Hd#l7unQ>)Dt(B@eoRx&1o7v57!*l#OO_X=t~?{46#uLmlBZ@2P{uKHn`ACnxZZ(Zct+2PNdTlWpS>CC>B9lgmpbUOE}G)QetKO6)oBZNR=AoOGmsD;`d1 z?3y~WoIV0jF)W~j%Uw(e!t5yv*|K~CjZ4y+bs8FqDo-!&6I4(2(F0@doSZznUSz(~ z*uHbfQsX}=W9RiiAefm|*7KdnQXlR5@)U!6z1PweIL11mg948*|b<^4)Z2?_jf{+pUY)9zl7;{u%Q&s)n)UtAYpf0540y@mSZ`(! z4`^aa#R<;Xrz;A#r!i*tL>_v-d?xY!(yOC_V552oXBVlka4Pp<$5Z(tQljY^x~kDS*VitmbT-vmv8nhF3vV{`8*2>;-DyL3jfRSTpU{*YTi?O zsKov9;v-G2?kDALEN9Xpt7CepuIjaGtmR!acx~tA5QO0QcLIfy$|}0YtEjS3RGnEJ zo)Yi?RY9HX9oN_H*`2(B9~39WJgo&iVw}$zj=z5mI}Z1t%!ly#OO3;NV3=xZXkbfr*RAlrJ+Ol|5W`lvlTwVF!u%8zCE!&Ta@rCbhEL%Ad zfRa^dA1(o+jgy94602q(VI9gQ0#_&fLL0P|fS%6KDsLw5@0*$W09VSazmM(_bK#;R zO;AiKN=mcDzjZ=7Q$HMfuG8{K&DL^8q#z`mXr+mmo2NGrH1Q~mhQ>g(yMAkMx|6I- zrrT5Xt-*#utmLTNpPXua8ElaEDx7%iT#gVDJ;CrJCLuu=rRun%(ez8WWgbw#p5k2D zsa=4e$j(yX6(dksP_l}OmJ&UnIrEFVUHNV_2$k}AwGLWV`ammiYCgXdigO)6Tb8Qu$5QZNBaebF}u#x4w`R0m9r#V5zb+2c`Ko-1~Mcv-V14qGwP zF=_o6XO*OzY5VysIfKiO+o)z4i> zG66|llAv|NS6TfeC)9#w8U{O5SE*Opm1KW}yYT}dBA|fYO6GK%xL_DJMK&B_^veud z2zq<_dn-2v2(`z@YYuZR_@S!G>gZW}>s<}{f~MhDGhIBm>0$Wwf zzlRqnC8_4+Iw1Vr_u85ldw%b&)3=_=zKA$7ByCT5&^^Ov}j%jvaA0b{n7!b z+V&~=w-%HLuhM?`DVdYEyzbgi;6kTV*#y-GLfIII>!mK7g!p3je3Wd}APmz+VwYpY zjgpm?r6xj8H(#coWk}_cY>0Wt)r9k|z-OCF{b@QS#xEbSeXC&kC8MLGK}<51)e?vQ zroTTa?5Owzf=TD(7SMvz0)m1hPE0n13+jHNPBw(F7Ic_{{ZwRzX?7izP_2)Y8pj|2 zM}${TEY{U!*SR@t_)M?Tq2uGIaVMB8(NCi8qXzu8wHDRGXD?aEVwJnVna@c@-`xl9 zPtBDhQK^*7Fo>&UCOy;5s+zQ}V}svq5^i#Gn-xgWge;}iuB^r;BRhYY_37fOy2lyw zExPz!qNy;!SYQWT?$peve;8EWZcKB`qK*sO!h_BC7z$ zB>4_^<0ao7f)=C--1eqxtFDFp5vQBcRZWsDjRo}p_}ZWx?MdXVM#hcB&N~VYDt3mFSJBhT?ao~Ug~#8 zuKJXh1#P!@u;8DwKRR9HOsek0xZ}zJJHA|2muj^oSgK{VbFX=}tly?gRs;R99O8a`cW{GGpLA+mN>Dyvg+PCc zt6NwkTS@lXClHb2OcSS~F;NI)YkTTB;Rb2k`&8~udq^7UuFb1_yK%`BF;TH|+_T{< zIWHikl{NVCZbo0u!(9Hux=M*EiAE2?_?y^x*BNvwajeq2c6Gih*#@>V$WlnQ9H@y3 z&;8sw{TPYh=K(rbf~A(%)O{F#GN9VhAuzmkt@reN`j!O|RZYrTV9*DOb1Q{#F;)n* z5gaS1S+<*QfvF|i7Gd18Fr=Z-Ckq6i*eWqJQ@CJU8@AF=Dd%4>POOE{{WezDg6mL) z-5++a<3S#~o2jM#Qqla|skH&h+dG502?T-311OL;{QCxfN@p8v_DNZ-OTO=l> zqAn(;9ug{A<$Gyv+`!D0?GXA1kiVv!YpO=|nMZ)KjEsXYFZb|Kn<>JtQRefeJE;7} z7eyt+mMZs%tgM28Y%?n> zD<>=}G-4t33SL^Q{TGY)W(@q;owaci|))I z58_dG|N4{9$(=r!_c2K3L2N3L>u*ME+T5YPpkiNGvQWZhg}>%X}1&3|^w=E24P&2ITG8up{+|9NQE)CfBJkB2;Y5aT}o*Y-Ks z*c1@}pm2a?O0!_oR9JYpP2yo)jvxk&+}+)6RqbcDzZ-nchtAd8+uO%O4rVAf7Q~8= z)B%47r^y^-0G~Sc-`qi|fim@+$_Fz(^y941WJE*+f#CKzl(pevVUkv|5;SLX{03;_cP-3vXHm9^MC%q8YU&olLqi(z-?)|Ec6PjrX z;p})xe6xW;tc+~T$O3k^1?#_S*FdKiBSuMp9jv-hle9Ema_M=l5e^{0U*~nhslEy# zHGv5t_cghx?Vi1BdoCe)l{&?s46KN_B8&!LBw(IN~rt7D{6Rrc1GeO z%Zb{HnJo!iYuorLIIH5n=JU{ow1x?8mI0>~NElgM%!7Js|IOT*lFN{_%@<{l{HEKRdKrS6aW1Uy;lLX9or3-N_oZhr9JONr? zC**fn6z*>CHeEpS@1SXvTv#|}DI_6#?C@Y?bY!MKVHi;ewGH5zm^o|$(5|577N&_S zBaXuq8xt_vb@sTrQ9-I+71c&^S_kPcg!uI5io?y@D@$^M;ec`efVEd{$kCPJ^2!2#q_uio|GYq| zR@JDj%2QV5c!aQ2I?q3M}tn-GftASI^6*?loOjTI{PFPs1Z>c7M0^>l8MnZ8GK9Fb%kwVUwF zt@hX6oI4!b{~a4-rBWq5&I;;=gp8MC_0OhJrTgv6V+zI%L4H2qS5`CQ#Y<3GO`QA8 z#FBWe|H>1>NHk&FZn2GU!$rG^LkOr-+HU=Z6@0I*bt(TbCYoA@aHRg}ih2T*_Afv= zx>}u_2n>4W`uw>MZDU|yalO9jiN#zE1f|Ru8C0!WTz5z7h>&K8ukj|TxGfM}_voJ) zGo=69Ys@_+4a0mPlM^h~SPZZ~AhPk@@H`qe7s@$Q+3_tY4$k+IdDqaf|# zUFT~U=ButQZhr~L_(WWSe%P7El4E9u1R6z)|6P3l>K)ig#m$}A+Vz3vZ2#loEn!uB zYf1TCorL10h`JTyC+2I_T8!<94PO@vo8?fWnWgRRtgzw9-$6(F#aia?+4)}-ucdhe zLG~zNJK_S?gflj%?AVxF+dbvw-!sv_lg)*=6EUp>#`%Q?7GTglxaAE~men4Z?$D-dvD9{BsRUq_563aV+;XjB|!gy46`W3dSc&NJ@x^p&%NttpO7$ zoBr61pIIZe4XuKhd^;sSpN|2fKbrdc@z13V?-a?|J3T(3NOEpen1-HVC#)?=iKTvq zYxz-z8nSSWpI!8!st zv3f-~bVVfdj80;}Ia?e8wqw_v^=?&*(|3?VDz>8}@lA4VdI&wf*YXl)lf7U!k-B07 zauZZzZZ?c?&wy)cx|noCE!gD+Z3l|+`t@%zb5q=6NnWB?Gd>E7bL~sES||W%S-Miu z0N1g{Jj^WxhEJdmWb!5s%4CfGbDY`4-0KgWSfbzmgUR zfVKK|DRYfUcQBqwLNeAx&CZVhBy_ye8`9`)1*q_hp7DlgT{VFbjxeLaCaL3Sht2aW zXJ3Itw^Bt8qqQG~i@E;CTLCBnp*$}tD{eEEfK#^HEPkD~d7%|FTVyPI^jK(?6<)r_ z@A(^}N;g}tDq;(-qxKq&9xFS;`Eq`wr&|d8U9TTL{xfXesC~TDx6Ra-~Dk1 zL|w3<#r%0ns>TPMo-aaBw*=j^QNY9!8fC%8ng|H-6p>n0z?75t`J-dD$Nm@&rI{E! zYrXdMdo#mZ5y)FQG%&#~l<9wHWvNr&zF$|caOrL1J@`VM>CJD~Kb45K{0w_u@|(^q zCE*d#W29*i1X0DTr%zDHpRg~`-oUmynx0R+PWWqj8c&}qsNOy0PJ|^`wf8}Vcy?km za=sW6C3_>;&b&Xz_3p}z(`UX>#iCEK{HcGE^LMG_o|pJ7ls`IF1?)Jlo$a~2>uGSY z9b;tiP}jDk{EEiBANtj=s{=tRBfo-TI@gX?Iq8```|4|~YhCEnaIO4D$-xU^@31R;uANeFDh7Pc!~czrcii$w*Sp@t!LmVz4-@305+Sq#FxXX&kT`*t!MG!ydYQWVj4Td3YWWoq=L;;l9*6p8Q0ZsS_wR_kUf%v@FOPA^Y(J;3 zu6OcE?o=$~n=6@Sd}&jGv4UIvbR2`#RPBYXut-u$Bj~)0%k$14J3Lh0Dgoh*5`pfl z_X_C)K}MgJ5WbC{InR#?Bw!|Bd)@Gp~SQtO!7 zsM_p$o?R>DGaJ%(ti}(1tTVvdO4?!3vJ*w#*iIG}kks&*GA|h}W_$leb?JWaHLnr{ zO5;XII0(;N(s8>JnU0~#<^=Q-PNz(?pBjDJX^ z1ht1YA%d8tkqagWzin4voI&DS$l_!J7Kyr2urxBZ9RSN6$a1dx*+sSBK$#Hh*p4&|$^QSbbTlm3#C>ER2< zU`v0V?!2qvv)GU8wJslg-#it6QCk$K5Ef2k1ek8bldztb2Kiev1;+z^5u%NIzB^p- zc=d{Se{QqAeS}gqD*10`4^mr-r|i5dDxe_#7^3=}kQ<`HPyXz{ClCK3`IVL20E&a_ z;3YrdGk)*APgZXWM~3}*7Cd(n`w8pj7EvMEZ-?5|GRb^hRQ#s5S~(~nb1dz66XYKa zOH65SQA~JWxZddjhaj_?^5#4!Nj)_c*6U+E;muG#PMV2*Q0K-aDWSTWg;mkSdq_V` zsh7J)RudoTuXjJII5fDm3pfoQ3KKhWMB!~!i2HDB@c7l>UY?`&0m2-+L9@C~xTw$V zIC;_X@?A>Xe7oNj*1qmtn5rF(JJjBK_@)2z^))`1;^wpyw(kh8q4(a*#cS)nb?+HR zB1E!asvW|~C#u8MQUu(MDn8wN@qzyo##De~L+}lkNbrr*QgR>Iq*?vU_eJf6gUe?7 zLnmzaKc7DKj{EOrK;8|GDAs4z&o;jNy+ob_e`9NMk7%6<4*2iKt%Bo@}r7`9`0w_-}(GshM} z!GLk&pVT_>(&~5Np;-EPx~%k1#{V%K_$OPra6f#5$n;YAw?fEr%)_U4s}p;6>*G*k z(kmtr5!YN8W?QdKZXlvqEv{b|b&Pm!jWysIq(XGy?yx^dD=UZ4Z~|}l%aZxWojH>l zqMA?>@K$zemWZNkWxo)t+xz02aDs_sl9&l*z<;b68p{rWAaXfETT)+8A>4W36k{&m z0tKg7U;>xQR_+|yLcMw?U$MhL+EAUHH*)(;2zIi}`B(%QiB|q0IrR?HY8ySQ1$3YuUVM%J-4mVNglp4wc)0(P&WVX%P-$@ zWT}cPvf&kA-8W5RnaFjN`ftYIorXxXH$3niwX?X%T(s(6AOnEq)?JE^tZuj{?#IO^(_r<>@-<>(ZXxxM1&tPMueXfONrPXj;-kh{T?2Dhh>@a^39y*ra5>m5u6m|AGM z-dq=Y^-A)@_338eV28V1;u!h{7S8C;w4whl;rQjM4}ed#y2IQAdDlzq-=-uUJ1%K6 zqQw?jrqSSnrQ;B^#RTCK@8ajewm(XgdUH-c3{~;a<(-iSqq$fhY@>Z= z0nIp>%g?;H^9#W2N1~{abd#HuHE$xI?k7R;UuniR76Ws)of1D(p?f=sf-8Jl3)y6m zLN&roPGV*Bf|-Z3biqRLx4Wp+ouz^;ZagCsLAG&+d1U=)QgUB2GJHq;siE2ay!cLK zT;!vIy2CIdSIWDt$Cui$(0B~BS_{`BUK!FjJw zupy2E34uTP9k_;k%sgUFR_8`&^A+mmp`{kk5-Fl{1FZwbWf#R2?k5edr7lrFV+D-O z=i^)by2MR95jmyT?&dHzkFO;F%n-MhJ}f?wCXX9>?l>h3v|Wb|-(TM9GNYgCvMIc{ zE4z4QxBD~i9Cz+vhjUi93e!~{BPwy`|K>yzuki_%;B%7x?SQa4w25$k#(s-W{jQQ} ztp21#g?c5zTB8#VDYu)_^Fq_Tm%)0m`;xACra4Zoew4R$B5)(!<=CYRJzA?729VUM ziemA8Npg|zc8?Z ze<|AnL~m0@q#or82@VBY)8`xvm&R@k_cJ%Zn4mSG)*MaB3=UYQcjWMOfx6v}1Ym_k z2_|0JU5ieGE|k+W%LSQ)1qFI>9j>INc-X9w(gvcZoEfyH&H5`KJi5!s@h_Bry1^+U zM1htYS!xT@NHn!+PmF6k6VGZOO+?#}lP_N9v0$!W=2-PTTFdAF{3w~Ni5D{~(aeom4SriNS%J~YRM5ZA7n}dS20=kH)0R+@1-6WSCe7b& zjpx?ceWl_lsJOF)Fks@a!&pg2Ad8C9aO^E$lXWafv&y6h?(@{g%{3?N5xlg+@@AG{ zQu0dsb-i+IyFf3~SYtRV3&BJNGEZ5dhE=V7-q8w){WjTUpK>k9A*Tj|X_+gnBato< z-?PJ1)_(PpBWgBhx<0)>_ebGu2QQpyD$mT`YR|f(zjnT@F6rXQw9TNEir{;mxj`RV z^Gtd_Zz`{3Nh`O^bfRCMoH@#;`tMFB+Kk~n5c5~jtxewpicCIltRz?m(93WczMOqyD}_u(bOL+}lJ6^B;Rd5; zGxugM9l!ezzl$uqaE;TJuJYCk=_VZtP~m@6CW%S+pxS#`x() zY}F5&z`0ahy2I{o~3WI z(U*{SK#ZbE5a=v(TUjiRBAPd%&sc&l7YZn&s2?d?$Tp1HEyS+kOd@?24UejYAI^Z? zWVB_n?mt6c2>-^Uz1v2kP0^IBN&Rp&jGSm+Ni-VH71{&ev1>q*%;3dHS}EtY({3zc z^UP8!`W|ED7~KM3H%NB|%q8@E);`L2?cWWRzmRDx;OwCxWzF?WVT3Qx_#f-Tz4=1S zO()FrrDAc&=s&Ye%CK2USZ_~Kbj1u}Z>PHT``Fahw?C*VR%#c9Msr7#cMuqA!q6JYNgFQMnj+>KAv7IeYKQHpB}t5 zox)A~BksMu<}YZ?_JRxITjK<$<<;<3Yb1Hh)PqrhW#93~Erp(zCQeYg6bgj?**n`~ z(ZV2O5f}4B!#qk&_BH?r=BhFn#9U4;uB>rT*wtqjds;r*7t;Ok8Hcihpb^Jl6elKmYxL0h zp(Nwh%tFSrDlt`07_^U$rvbs=@4{v0(1O9%ro}k+<^J^%aYp+zt6bDb8NO&ak@KSs z%n*KrqdIpt?-xfk(dO~a?az#DzzHVlUB1FtxF##e$igi8zvHxdPfdG%FMGS&-p?d= zBrr!*qpgag_rZ0u_6&a5QM4a)2eI44qAwE!bo4S~qsR zb>_)mOpg3Oj9`Omp(-mY*AD$AXYO8y?E)*$Fac?P7+}#SaxD|e zh2rj7ibHTna44<;0t9z=cS^tXd48{~_sgGIH*1}od(YgNz4z>y#gKs$S@0S44yL9E z9U47youqe>Vdhux3(k99h>@*c%xC1~b&{h>|C83o;r^TDhnU;h*;!iB`8l_@wA9uj zd_VOfL4=nF;ZBHREUkHzcQtEb(J!O^DHt}+QU56^pVsCGP3|s^j*p9`_AM-qBy>EAsVcthK@n$gF#WJml^ue z;jSap{B~IuzMS6KI$snLG4?x|7h)1;2|*m!eojYHDvBIT zl;7Q>Sp!wukg@UG%$8Z|B+th7M)$9jk2zT$3&r&PVJz`10)kuuf+4Z5Ucc%!AJb+F zTEW0ubNY37seh!fGZec1{W`eCig>nXhKB0pjS=E+!hef3{9m_v@GKbT#JAes89|ai zjv~#DAi)3edJCBS;rRqhwU+aFAykB{q;}CjGD7sVRM^&`BbY<@z$y&A`yR}e5W2lj z9G8Y&tur#WOXDJ66rE0C$RXhQaH$~m?#6nc;H~b>eUD2_2(65pg*~}AE3|U*tp0(yx-I1xFzM4 zeMCB&s80`uLI%dEMBEyDOcpGw9=E2Aa)yp6V+X%zZWeGTmPuqb7NrqMvkfoSST5G;^wGMzVEl^N$P}UZSYjuI8^%*}FvA^e z{b4uQ%kv$=SImDQg3m(#9$wUe5PXxUz6-dK&vKjhWmnKku+wT-dRSN(w>4zV4ngwO ztHJFHxLB@x!T9+iO;=a<`1m*;xnszZi*(P?$jC@SLgLGp^8^|halse3=560(5ZSsq zg?hC#Z&e8$2Gko)4N?Pvper2-yGz=!j8Lq)i`+j?-@Xbdl{k?U4(c0=(c$j3bou^@ zzrGI9c2SUkTfWPPMQVVqW3A5))CJu4+k9~MJEaF{!na#mBy=9r$m;^`xwo5XmLR_( zqPtPN`nc_W7}0jYBg|j;Vngn~qLG&~;?b=+H^v5%lspN>qGK{e+#i92N>K;t*t&o=@%ZE5*{@iqQz*-5K&a&dJhT;}w0>`37CCW9qQ z<%2~zoA$JZ%5);Djo&d|>-G^u4G2Po#aR6nt$cm}L8O|FvJ+am?SQ+W5_{;%>4U z$ann^FSq|(opaj!Vz)1QgQOcA!>LwXBnvpJaq>mQd9iqx@tyKC*`a&WgA{Y7BEM1i zxxLd=_&KLqG_H2@PuLW>Zvf&V@93V$Ya|v{p;{0l$yG^T@6GrFu}oHPpC&8_`%8kF z)5HZ*U2`M5%W*Cq!Wq(=zb!6r0`S=)xGOnNsi{1RL3yb*%~k z+Mt#82*N!K&Gpq4*MxNl-%4w4|3Yraetjm5sxRFU_1o?&LYQ68us zOthGp4Q8U#@$3$<$HywB`oQcf>=7t2^9c|ACzDBNy7=2;hv78z`K0OH9srI#Br3xq zUy@r4+`|8S80Zl5d-pnwY}b&jn!)(usEHye%JB$6FNpn^B&c1#=XU$o{LOK@nXA)q zS6d^iXxt6>_&e5jc0^C*P*zur3x_CjzDEM17ajRv*iK3IdQ2Vo)c4$fJ8?2_6>M$M zCI);iD*I|~809qOkmcrA%SK}0raV4c{dI~DnQteI(H^1Wedvcz0X-}2$kmR1HI=`3 znvQiFmFCY5Zm{*dM*S;NEK^($p9L4EFBY^Fp0h$m0&!MNNP?E1e<^pA2(LRFU^u+K z^>US@>U-QCR}i?`mN=|Rm@0f|Z$&qH%x=ydW5OOdB867t-TkyQ9=XYNBJ=}#+_DK~ znb?r8Wc^uWdN_d-E>-qEzh@&fKiq$NJ~RICoPKklYx)?^y+qJUgZwYJyYJVDJV&E> z#=x@^KP5VCL#xWTkb2@#pkuIde9M|3cXZQVx8%33Z1O!fO;kiobFgHbT@n9Pn>(vl_E8GFt_~jC84lppmyB@JE;zOAs5{dab|ow zAS}Nz)Ggli`Q7V9p-gprb+|1&zL}YxkP zQ8%H^L_jM1dy$y{y|Nn2yNU7ss@8Q%*ddF%-LkiP!{PK{uC)1Q_%JRZx#beHYM)i# z7o9V^NpC1o>-P9=iPG>Tx|rrHVA&{-=|_}4Q_8)Yw~2NATV~H;PRLJZ{x9iK44 zWn-wP+tY5l*ve^2YRgBoow)6AO&7YbL;1(bS7uemiC0yFVlI81Yio1IqqtXqcY*;n z)3~p|BwRv<6?}j&;8v1rq+w~xPKQw|2>k-HM!}d%%s7WMxC!}%qss}x`(Z*cAEp~} zMqYb>H2X@nJ>5b5y~VuK+C^3g{SJ`pn6VSRl!-Yq12EA=;h9{%+_2}99U54DKpV7c zGU}_ZzNto8e`(KU&Pl@KLejp2h7ba9SHuupg2eXs7A{q>sZUpyQWJx;JyWBggMO`3 zjVI>-LBWQf!(nEQE*&;@uI_GLvO}YZDKKJJxfIc=%K46L#Ml69>(c6qRgE0^!beZU z(5to<&`oyXHyEU9sc`XOA?yh_jeXgBkt0D~s+}P9&;^l3$gl@ge^#V-bNA@&FX7>V z9X7^Xqr8?`tZV1Y$;buc*6j$<6_l2P#~9R-XB75&C1znuCcMT!S+?*F`j^CfeI2P# zwe>>MyV#CzDwT0%pKkP6BMNX%nl8EPcKN`lhg(vXO4}}}RsMccyt1YW%#Bcruq6#+ zKkkU|-&i|e|AP5V{QsRY>Id>;xIo{h!uG!qm$k6j=`-r8IUQCP5SF(Hk$bBh+i1HZ zC}HpGd;_lJb5iBCG>N3;q>6GLsu4i#7KC~6j0|tX6Eihu|McZ(%LATfc=(XYXZ)IL z%ZenanVlLl^koe)nmaj}=)kRwks2!D?^m+H1o66d`Rc*|s#o=kYD0pr6VOI@+mbOD zbp$Q@ppmH^=jX45IGt=zG?;B1n3c^5CEk8uZ!~xQ)U|`D3pB^aKHd1_qjxa9v2fva ze6Bvr@4x7su-ki`l#9%r(S2}mU{-%;p8C}c+XK)r^Hycny^%DOLep?B-Pcf@kwZVs z70tUwi~U{NwGI;n2&51VyDs<;<^3 zEA%RomwsMAehHCARP2>z|`oc_j@hT z6ZAne$s!B1TSSMgEU}H^ zoO-gbVV{X~*bO0LWNvpDEndf!2RvdO8L(_yU_=*|mxcBeT)X!cG{v`R->7MMOgpetDO zs_Q^!R0mS_vNwP8p!?dCexPP5_UzUBsi7;4I;EaC#-^B=sery;2hev?LXqGQTl$5^ z;M20Om6=5TNpZ=$F)h08Wt{I7(t&u0L+;Vf7{=ES1W3bfPE@? zY?O5}^7E{?l3r2_bonZRlr{CbEAf7Mci>^ilg|oe-|eK--EWvrcxAQ_I*SQP!B4-) zy}5XjoLP8!l}3|Eu}?pBxAO}!x7Aj4azlaGBjzwJuSn(DLeebwyIuhWd(7ess%VmR z9EDxR(gj=GWa-g*?RmsG5SqM zX(tn?**)(3IupdS^7M?8H#7s3$~#FJThu{P4NW{-nqejdyKC0x7=?J`Ukzub(;|FT8)_>lBiNS zatZj2oEQEc>5q-EcC#u?>V7J?=7aLvjvTrHSySrO+N;}`J>l19PB(51q&(;;`7lqJ zw|Q^Lu*@7TRlKObEkpYVN76(+pQA6wrfmckZfeiE3tqr;r7uqZHyi)oU*?>4zG&4> z-ELzsb${~>%(q0oaz^@Ld|`Me=S>+F|F@p^4t%rPqMlac=fKu>&tl?-VOkyGuODL4 zb!MzxoxV8@FRmEqUw#|MeEd;-Ej+ez&aXuJQbsr}dR)ImsK@upzhTGJQ0py!CylM3X-<%c(In3qx5U?2%cGVy z((lND0^kXbq#C%8b*D$oLX4D#z?~H2!j)`n9b)3(6KjLyst4v}Si2n2jNAo%S{3i* zY`3u}S%hpogqwEiJ_`~Pb_bu#k3DmlQYi_Yq+?{=Ls0Vi0LL~_Z65VijfR8Ukjh7U z^PL+ZB^PvC05C3IDp-S%>s@CZG2&%xL=^-yy*HgJ!A;GMg>9(M!{R=o(ypvA^+xQ$ zwgNZV1IInJjDXil1SLq^Z(JOXvCP}!K~^97%%IFsL)Bl|jW1O@^(=E=o%rLv*f{*J zT6^`7yK6-gAw*+&T3Wf?c8}t)3O0B>vs`=Z2{)DR(M+4f&$aU_&QfK439C#Op#@x%Vr^3(M{i(kzQvg>R2VJ3sH15Kdb$0 zYHBT$EadXIbrVd}>KkptUhMCd6%C@pvcv?DgdS}yl&xH3ODYBqA@7T(%8};H0uGK2 z$Zx{vvkkMjwyh>Tp2(v`f^8>8X)IE}`UfKfndLq)ic7pAn)C(b0H0O>R!im$7pZ=s z17-@P0a>}Aub?A0?r2?4}?zrc9i@^Rn1R{?>Bj6`LgZ~WO?YfyvWa3bZ(}dGbX6Cp%oJv zHeDwR&Y8k7^OZiF``dlrh@ZF%*0E_i5dQ1Xg><3{)X=|1-|1YR1q{^N=cJ>v{{^3K zL*ctY6oou}1$T9_;;Q{XprxS^SU`pu1_ZJcOnN=uIEc){EgPWZ`pB;wXhtn#CTExP!#c?sxN&WN8^lznT@7l>C0~ z{6Mcy%~;DGZc_9^TSIE|kI&d7&`h__0N0u%2Cj9$oT<$1qG zXA!%6M*tCikX)}NcH1>#5xVXU{qTHivNf{c%6>53{)#jQt-8DXS7}<&dt+RRfc)S6 zBQe^>!7V=;o(I#k)s2i4{U$%yp?Q*=WBu2=f(MNV&aXeM!4amV)zv?{AO4Uc!ZE@h z)x5mCZ@WxN-d2#s>^xi_desdN55t|=i%LpPS35gfTOW_+>(8)<(IYX2(F5_4hPI}s zHOe&5sr2Cke`f%m^&c^FVnz8dcLx(_L`6kILqj<^Ir*JdqNAg~9nH_r&O0+m$#`{9JKWaCa%Y!4&_YtaMt$Sg?k=9OL;Ew{{@Uf*&%^!d z?sv&A@r3a%xd`ZlL%omupcQ3#PefYY+(!6$UI@`X+JP~<#z_02QWyEVBW!Jh!Z(tA zMa20?u2;-SU#dAi1W>sN#a}=8L77!(_HGpsiJCJnm7#l{;V6iN1bB zXVEhDK|3gKxq?a`Fv|v>hRM)%{bBzLV&i!ol$CU^y2Ww+2dqSe1GKGm!-DNzkF)g= z)v=*$U&GS4*EOAGowc1I347YGDWk@vua+DKmK^IDNJl~zxQ4hU;i%);%3ghh!>ySQ zOrQ9S{Lxs5JGs2+wr6h0**#akC08r;cOcH^k4};t`E%ZDdLC5VG-(6aI*~ZZZB_P} zO}er2k7y>@L##d)(mbaujId)#nYstfZ`hqj_B(bW!kbejTo_0*+fyF^0b3*P+D5?! zxT}80bfsjNq^(F~XlI6JrASSG607_K$GGxh zdtJX&-Me~eM|}bw5j;Hx{!!uE6Ak$%FY185p*=@J@Yas+<5v9{gA0R9`ctL|n$Zx2 z7xnKx1|rVkhj{pj+4n2_;d{RO`9iGmqOk0pa9U$+I^or$hx?e#)lmONu~_b1PGva>7hr(J%Sv&Z{&YS2^>?u7CWzT}4i zze}m8bY1%O@8be8a}yF16Y?m$lS=maJd?R}vhm;irj98XYxfiRxKz_<@w^uI2BcI4 z(P%rlTXEn^h(;OgJhy?d%R9~1ST9nWT+B+Tn1nNeX4xQ#oVVuW`>T{!-U zw)XG&=WmNd{5^apSpNn}*0%^9`c&yJ#{HgV!NcFR!8;GRf99)u`yKU`_LKNGoU-p& zf@mQfE@9e&cm|XYTkJA99VR&(kK=jS!?B$=&!L}Mi!Q5A+bY;91U&A%9KlA|29_sO#)UC@zz@ZgU>1cO~j0(v zkM=ps_~%xwvoqO{Oje$?_4ZLrK3Q7J_0aE567*g;>5^EN$<~kaAKrsLVl@~X?V#~#d$tl+1}NPIIoFoYp2Z~va+%9WsTJU zoSkdnuigB7gv>8+f(%Zw#Ky!(sKSTly={-5GwJHk;UOEFsnDjLn4d43+W&zhi$Yop zJ>}g&E*cKP(^yp|0z1hDf36H4E)vZmBj=}Cgvu?1l z;KV`37bV2HoZXTrMG2dKpvbz?R8VU#gEZ;zSJ#D&z5P=!^x&d9+S{v8Z)m&Xpwgi+ z5*izeF6S^yo61)+N|Qui+|Lb7LQKiujvGRasa}J&Mz2`!uox3#X*hD^gr=0_Lr2oi_54H&GcG; z!#tc;hHmp2$h~k<(nVRz(qG9#GSc6+NOOR_{J`~Q7Cth3ILbmv)VvQ-tHQgkKyMai zidSo+lw)|6oy;|bl-wxD?IkQ|Yiq6`E61JQuegop_~rWGr>l*Z&il7R%)*ZqGf1)h zy90W54q7FxDr{f|j%uV6!E zwO`0Rj&SF8aMkpIQ8DtdZ4Ju(1zFPlcGKO^ekzhbfXm3$`PXUcxMVfrWzo7C3p&*1 z;hNj_fR+}^Q4M-i;@K+pacrEd5lazOIafQn5866>yijGcAr}A2K02(ImD_IlpaSU} zy)GQe%Da^8;JTXxdP@G!78H)$by36b`+Wrcyem~1*$&-e_-dsN%+SW?rWws&Yg*2X zj&AKt-tTurF7Dq?Vfz|6KBwFHFL9Ys9YIFkDk=-RY`lB0pXxI(^S_mCjzkT`X_(dk zdzAH#LQ}CxS=H5Gp)=97l{@O?Lagm$+wO+HEzxtUzL=CYYm`?fPlfyC3>j26k!9`H ze8!cFo}A3xN}pz2B;aNTd)n)&-^|X+ItoDEQic&ILR@gU9pie%|m7h zt&5!`QZitB^Le54H9Bw1=8jcrlSN@GJ#~~tRs-JUpnr%c0as&vJq>e+j&VWM5Q~nk zJ3G6;SWl0oTIMG>CXHLKK-TW+-zIr)<3#K4iumHiIz;Z1ga&>}NjeF5LdVQCKwZ+W z&fh09A#M3XBL^qS%Q*$v@eDUM*}W%HW9LaI(+qEL=xPTge|y6MFqJ%WR8z_#sQ8Q7 zl2B(IQ^_`=ox5VH$x4jqgs<s9vsLTo+8nzFPfin~Js>00MEV_NY zIyfnG9)jOVDYt2AJDy&uP z`x7r|Stn=Y9_@VdWDT<6?1TL}wW!cd^RlUaM11{##lih;*O-r^)T01A5E{rblH}IR z@Haq|Gt7VfluoM&F&9l!(OCeS*$&Y$kJ8hm*nKm%SMxd869Iv$wZ;<3jy)bt>=<*Z zgEX~2e|-m}!a{-T0&gTN|2*}#_313XkfSuTB>f~Io9WNmICC@K-2FtWS{tjBKd%i2 ziID5NhRpBZpQxbo(w&=8UQWs$9v#@56T}0faw}u5k8@O@GZ9-? zZnvO31;}3R4FpqzvzH4YM#ag9XZDp~xsaW&)Ytr9Z@TcZ>@1KKkL+6 zU|j?CkCc=zdzi!;i^s*5jmKG;5^6|_mg~u34@-z>(}{U$Fz9?jp4_)hcE+TMB|Anu zbr}bIJie0FNQtE~kbv#63~-z8mqZ{;)MSj1VI{DWVuxUJlC zXkKPVc2x9QkYMHDfU7c4OouScK3*SSHIv~fk5%0*W>E5@9^1CFk~+0!gi`rRUFR^aXK-xf5i#hb>A z+`WTkV*va`A9%x=UKhZYt+?#z+NVEwt_)@y}j8& z?&!&N1qC5P7Qy5nYvbYgOG#B#?8x@U_Nws@&88;wP)QrYE6Q@d3`HbFgo7Cy9**3J z)vGHvKb^HGY#$`UkQZ~x*4Ea_%GmJI6XAc=93oBJUEu>6M05%oO9V!DT24v~oxqPmzEoHG%q5iGmFQge*D{Q=uv$rJw-@GPS@An?4S_yIC`)-B3u z#g%xsUhj<)?r>WCXZ;w_c(`5fS(M{& z^ooDOM~Ou2J5MjyY@ZzS2Hab_ao`yIu8}gSBB2NJfR=Te9KGD zgKpoEHJT*UwK%L=QWdxM@bU5RKJrEek9mL|cniQL8AU`LgVHuO*Q|8d5hdn4FhEO=~m(D_c+Bh~pTBBx1Odpl&oq<~ySd5qR zK5i(;sat3p>pSODRDrz^xzjYHJSRJ8R`}!>Sjt&=^x0Mgo{Qssmzi_b`lr#eggCe z>KOpk|0a~Py;7>KE{wOZf0IS(XeHn9d+hq59KuDaq_&{P^bX$(-WxvwBqjoo5gBTs zD?pd+6~}0O+nT&kcC77bXnH6l<=uU8gqfRN&B_c1Sf{^LhprekMinhYOd5TW6TK^s zXJ=yPt|4_R>eu-h&x1W)y@28}HMK_(;m*f%s>9J_bsC{0TRT^5ZDmNq`f!A31TN#_ zjnXS;AKoo(Utwj7;NWU4WwK~+_f!yATK}cYq~6fhrlF}hZ{##eSJx`6Z}v0EN@UKt zk_{3Y8%^MPNl56gB+sNi)6^)Ek&wAOvz&uRKE>C8WD6V{-eSp|Jyhp#*-AM^K?v>M zAg*gxj~Wq;NeTHFLgDf}I4aqyTF&ZZk*Gd`x?|XLjnrb}ZObT3W9w`dnVB^Sn~{RZ zZ$}j=#=3cXbH1l3T8&r^r8@Ig( zjE27NfI53Qyd?6lG8?!{9MaLz2_8$Px*EfefLD*np1!6UgPJ(EJc)A`eSOG$F_X)d z@3y#1QdBe9s{wf2vR1olmD#=1UH#|_ibZhSF~pcY#h)su!s9@5K(ELr`Oo_lnThB_ zT91X_#uk{nZgSOr>VP>W6QtMeztbyUvd7l!waFv$=ley+u;%lX zVi4PFPC4s3Z+hV=w7KP6F6Go>kZ!MqA`8nculDWrbq)F*+jy$~k{Okak{lCBUS0T{ zfkB`){emmkP*#>*beloF>n{y9t(kO8v&1fvmBrsHF>)1_rLAn7xg2lEA`^%x4NLWn zTvD`WwaB+9q-HjPLnL4#~)6eEOcfSe%~vqB>9XFdJvPgVV`wIX~% zYGrGjeVUboPxh*P2TRUWA14foiihm7LmD$Q7-73zv2`3Wc4Vj3iRZjyQEV6qpY)fy zVIl&5L-Q@lKWg{8zafSdM>fzOqaXr}^lf%FJQIgVaK>?R*gBPSc-&s2>FqR(5oo zz|%_AQrHk5_7Qz&Y1TRr8mpIj+3U4X2bTi1F(9NpB8(% zY`*SdCWUa;i#SPpTFaP8MQefnyW5PCAy$}3uBod>GK8h}ieF_8eK9#j+FF<8rLOlJ zfk9s=^1}nD{33GSR_3d`;_+J#Y|?LntT{YjfwYulfWARO5*ndWyFFjNuUB%S@x9Qr)6$&ToOz_6 z_s`+4)=s)sxi8|%n0F#Z6xAso<`g$noUGf2mW(R~^NAa0Y5Q|h)z=8Cj~+W=@9c3(etqeG zg38MZJY5|nXHsi}YvYZVmP###m>zx~#s>S9`{0gjUP{*k6KPwlz85 zS9D*rpHKfT<1igW*DHN3z)@t}!1KNsUUM_|UiF?Nl)0E^OmXIt5zmN4kl8*Z zZl|P#((&6+)2yo@Dq)NfO zLTq*D-^I-XMYz08?Z~m8o!hgxY@veaw{8J0Y~JP=!T=-$D>dCsSpLO9>QH`h>9Eh@dknC3%n$BJZF+ki$^ z>d2Ss?&nl)0j@4;_1aE0q!2rGN>aw&97-o@#&I4l)#`0Ka$hVpJ-HEQ8~=%gawQtM zS*>hFFt>fa$fjY+m1Ls>z(8MbS)<4_@>)HqM-fz5shl)~u#U4;Y_$LmsYK5#ZqsC> zWjGl7h}9<&DnU~?VmAhgRl`$X)ETlqSPT(%J>O?Mi_xMR79z~pZ+7*qS5AIkLCL|N z>b#|?zA1{#1GxzCE!TYYk0Ru}6e&IOe~NW?lsnX+SZk^3t=T8@B=Y57iyGSC26wP4 z?lEv2#s~WI+xRQe#-jqYXo2n1sln(`uIDQZK^l)EK(Nf;p81WHzt#VLL!d18z}jkQb(On=31^Tn)|z?}Zw{YGbS-$(_tMd6uDJM2#P@K) z$a7|z{{#ud=#A!pzv^*Pp>9l)#~v*1n<2R zC~e)nteZud7V$|>2`!76A`iom*w@p2eSJkf6xbw4@Fc{SUHh6J)nHMgGi!XO3Mp8W zu-gFJL#a-2keniGg0WDjT}x-sj{MblFW=-U8{UZgG;dA_OY_$=#(qK8CEst*{wq%I%HB@Xw~=-ro@}ld!oSSI%Lw&n@VXx4vps z%E`-7;ao#!i#w0v!7unNW!4P&v5po=kuNyochZcP@u^}q61golpHaPtHffMy=8#~4 zEA9eFJlM)Hl!DVhI1GsovHa;x4qdSmvHvd-v<Ht}ZRqW&@lW`)G1!1Q;& z0|f94UA+?qZ7v)k>Vp*O>fU@oo$bd3uj^#!i_t?_4sEotlTL42E?w)b`9MBh`k1^T zdX7`CJStcxH0fnoaos?v{gwn8dnpTH9VbjF`BgE-@kO?K@e}plYL?j4W1#g4ZO)mo zkGyoDGcT3Xn%UT5ME28l-8XNkQD)N&X?CbzGqx9cl*)gKpN;W4qDNO)nE7GJ4Di>- z(6#-xuhI!_C*L%uIo_6*o(lhb@;%H$LZy2u!Gp$mYnz|em zf$Q)6*_f%Tis~!g3g$NfnclzmU2d&pqa_sr#=Beh4O1iU zG?Xb*{4r2j(Glzr!&@L z7#Jrbk%G}YCwO5=Nx8~auUI^-z?on-b;f8(+w)XUbykyYRj*|}uvI~Cpr0oC=oC93sqleK_% zeVmpR&%FE*QOep|nc*%z?e*Nuj7G+)nQ6K;+lyKpuENsRZlTdau3oLgP_*I*VPc?< z^(B|H3lar_UE7uFmGSfu6viDqF2bO8bP=%{5-ZH>0{;5(E;Ml zHeXKA7B^@qFudGpq2K~tN6l^Z$KH(IjnbWhf)mwrgw{YHmA*_h!VtrSdeLQX8X@oR2uS> zhSVTaKE^UjfGbe0Z%QLg-sIzKSD5mvoh4DUkI-Qc(U&F0gD@V7JGshB8hv(>L1>>iTs(1ba<&tVrYL z4w8}j^eYTI1?Ol~*x}>Lc3sk;<95UQA+)HKV=jcUpUn!xqi>uYu(g?oe!7U1Ie912 zsCn@|56?$e!ApPmo%lHHGJ+4*%JT2y%)AA4diTmm0VvXIDK@9V42 ztyb5z_!W%~+*lGPLE9wK@$e2bL9!BCze8UO`r4~eRDKX71&|hrsGcs}W-{-obEPd2 zujAk*%ZnEiF*VlH?fZjbQjY7au&8~!JWudUWdDV}toTo>B5&t+IMC#LVZ8-e<5S%g={2$6V`2~ASzqLgd zjw)x8&5^!y94x66x_+V;_M@p297@APwGU+aF+@$r%wOR-sK#IcAMjOdwZmFjr67jzv^j{8d0_*@z9VPlqxC)ydIjc!Wg~X-sbxL zm?>*NeIq?eapsJNC2qt6=S1BVO#fk6clWQ~^=&QI@VL;$E zZ$S^jqM^q^<0n*98KCpaoagq+wg~tjR#6_WV{W7acHgT1Mj4ZGP5F^mp1!21yxD+} zm&bj^HtOp7rMr)VuC+`Gnb{HFA{5$fqP;7>X91G<#1GP23$(Q=O&Fd+3dz#Oegh=a z$8wyDqZF9~Z+T+#5|v@9tAktwwM+Xx)0}EBhPs$v?y2CUKzMO(xl2c%pT*dscr7@s zi*fl)4ntDGbL}@U1CV&Ng#y{=ujc$|dm;;>9V?y&5V3{jV#zLvciBv3<@6P%C&%1d z>WUG4=1A|%{to%qtWl(5FM-6{Tj*})=BcE!KP9A`PTp)l)y}aD-_C$E_q)k`(Ee;f zJS2Q>0{xX0M=8>=goGRIZ7pRQvkeWvTYE(u_v#?VR=fP_{BN}1ASlA_2C+cLvB{j= zk?gESYdQ-ooqjKSk3U@|wRKJ4l8~OQ*w6FU*%+?s1tC32@qNM{5_7ZHogu2O>HvNH zQqqixRWbxs^%>Rj4HCVFk-M$ziTlg78?vb64?Oi9?Z-~MvKrSt%;qVmv4*$EAw7+4 z_s3d_E!i{rLKR8-Ut4|_DPNMicoy`=&ksglnj zWkkfpe-=A`lgABIl$8Z(*4EbE-QK{xvf*g>^Hs@*pqHNR?(KIQQQqF(Z}IpYmjpbH z(uXWA?)~EL;A34MZ%;j&4VY36wuX|pGT=0yL5rKMn;Q=|_oX9QwD{Ae2opjWCDq?9 zqqk!?Y^Z?185bnIqP3c%R+1wQtwV=V}H>6#~HK)P4xa8*g@l(9b&j zAKy+)P9mf(!eAcofwRooRen$B1NiuGHZnUfvA(X(ak=IC`-dlqw_U|pw~xQ$@fvP6 z`l8@^5Zny-R5(gXLseCT)jw-3Yd!GR{P>IRPz;kvr?zux0D$RJux#FkfM-X)mqAU& z@P%T3FhTmeQm4Nw{TG}!y;wsc>8Q=h%5oRVnIUUApd~qie-011v&P^}b4f`_@VN-_ zuc4SYIE(gkW9vcUKRP?#B%6465NW>>Vc#mR9-!jH65oL9hY}KAGaxN!>FJ>tV+Bo4 zs@i;1P{4qi^!6b9Z(SEt7x|%Gt81SZY!-By?Rg2TbiD7dA|gF4Muq45?I7X#&n6A+ zFt{XL0G2GXRb5@V%t%ucxf%ni&sQC(WII9uu`6*A$b&m}o-+Z#605M{S+MV6W`Mi< z?N`A+3qE%f+%@&>9p^JW6TG)M$q0YKP{}E(t+4{a4k$g=W(6s}ZK{r=z~TdO@YXp6 zggYu@l>DAqbXt#%dYJUcPPJ{A&dJFFAn*kz^He=fZ7|JITLS?Lma(R8xT;ygo zKJv`pwl6`OIjY~joO$K9P|BOx|H1SaW9VRuk946t3(QhcNY0$CKtq`BePOOWPgA9Y*#P2>16j5^W4)%q!KIypyXQ$NyD|p5qwb%ce$01O+p9H78?NcdFj&XlD+;~kp_ux1kU%a$o&(PDv)8cY zVxWfZ4pz)gKk?%S9>PQAuH$%yt*ER;Zpe@&4(N@~4>?b~<2%02xiLxc5dL#v=tun< z<>5eIcS|r`%~Y7$(HeNnbI&XL=RqU8Sfa0oNT;VezgW$bZgu4W2$FeNZ;Ndk6s+tRZ`Whf}eWt=h9HE}DAVjEU9LVCPVedFL_ z68`a#nh}K6ko?YOFfu&M8{{e}suv^oSvv*}ff>SBP0zGwZ(nhhK6=b-@v^1OtxKb$ zX3cGFBO~PLsg_i1Hc6B>ZwvE6`8kQyE2_BU)#tshxuIWtWv6KA3l15tz&N)b zf(rRhc-(H9U5j@+Vk$-y zYgmH&TQ_nFxIUj)9Bt>svI8k<16296{Ja&^1&9$L`ZvnWsL#Eum+@RrRWjTQ0}>8y z!M1CuAB4OGi2d1-@NDT4sbn-CWs{xFJC!AsR}orqq9->E%pGJkIyWkf7FqCTp{e!P z^s0V1z|VU-+3ge$rRC-=Z3s4Y_D06bWq=%^%PY0IyB_~C;k>l~|8U7=QguRY3< z7ETi>D_$NJ5R*8fx;o8JZRd^2YHXjz-qOTk{Bopg9nE@cNkT^6{9E(%RdaE3;7dAE z2sRcP4n7;#g(MGVaO%*<%Ux2`#YaNYTgFBQF#S#wFVH71W@{Uc+08quT&=WBJlo)K zyyNf-{@Cr{uqM3VSf(5qovp2gwtVD`Kif`gDCq&^uW0*`y}{#@WRx<>(yPd9d4^0q zY31^v(%4?3mYOj`qt*yJ)kQQk_-JC^M$O95Q!ymQKqQ)qF5=}V#~YteP;Hf*q#OZ2 znvdP#&Cn9uDpD>P6qyTsliNgwoOnX&54x78X(@%|taushC_07NylO z9aEpynm0o=?_!6dksRcO-*NYok|@nDjX1{4n(Do?ETtl zuvFLXNYPe;g?3XLoh1}pzS_F0iD|;RtljxSzDQ|likVg!*ub&Lb+i9FNNtSV8+RzJ|cMIx7|_QLZy-c}||H2j3)34HIko z`rM5mc!wb$MYO(~uC`Yskt(sTV0qjtZCOf-FBLV$J+mNxFVD`ul$$ZF^HTfPaTeSP z4xX)HiNgZ(K>jxRY}EshQ2o8)PthgP;n z`V9tWtV(N3`$VQ}Iklxz_h);7DVWD1gMqw6`yy-cpW34yg7-E<3dA#gKF(0R&%S=zY($d9TqHNtH)W$8X ztT3X6F)%s0L1&IC7fLC9q*PTC+*D1PQtK{aP$aJ|E%pDB$z??i>Gt_ZDNoCFAqUPj z=N)znRVuHsTB?fH@(zz-$t!IAPJitB80&O~z1`{&(2|qT;H+n z`+1yLadcML42Z?rFX~QEUH!>BFWBC2iRRpJ{f%5HdRb&zo-kjRhN0+LZU&3&a-mbA zBw>-6t=8n&HO8JHyDFkk7v!9ss$^#S69uB7bx22-gnlH7m2oZ>Q^;FlEQ8zfsT3F^ zl&J+-qdAK!wCH%$tE8b*o)I}EV2%;l`5VW3aRB-oT8#Wt%QBSV0&}+~grR8i2hYDKmwg z$pUe)a@OX?VseqI?ixB0I*G*h86vQk^@*zkT-?^$9G%IvH4884$p~AeX`{_j2@Ae| z;NZl+dU_$Ef9W{@QNNNQyDBBLwZjx%;vYbFb#t^Oq1*0x6%X;Ooa*^!fhr5eazi2bk;0?nc(Z9dB%G?6T+ELyq#{dEEyV23&t!?LrZl6Qlwu z{|_5d0JhdQKFN?V-~^eoxcGu5+5d4lef~z_CwaP`K&&xR1#Uf2!i(7ue&K~LsRfQ7mX$`d{`xEEC-NV*~lxGWdo|}n?2r@eRJl*W; zipo2r z>#{pfsb}-`ZE94*omz8mFe+^w=sWM-+S;|6?^}aLkrC!L1UiUv=n&#|cKhbY?xmDv zD{UWsef9(FU2f)T`c%*(JKh7msc00-lhSOeNvP^*Gyj{;Pzt_)ve3gK&-fO+2 z94Aekh0*WtBC%xH{%F!JgvaR@HxTC6IJtlI-^>~3b_HIt@HC~V5ki@oJP z)8MW@33GRvJ0FDWtrE&=5kJY*^)fcyX+irU6X~htC4{ljzR5+lHJ|$B5H>afc@SXB zVnfv010Ym1L|Zva=p-I)r{xXIeN8Q0K{riU7Z(fpt;44#adLte+;R}QHXjaiy*lIh zxPY%OFS{KNMsNIncLhTtCQYm*CkVf~DLe|7+|KMda0z@qDwi!rR)Guy?V)?%K<%|C zQ>Cn}X+ZUBS!h_8A~gzuc!aY7T+KY7=TUsmGfM*;Qu;EvSPe711VS)sGcGrRtEzXcG`W>)asEC#aHy7H5u|s@k z=LIE126hYhi_jqhk+RXzQ3G^6kYUg+Y~XKv?Cjtzr!Jk5kX29xi!c1=;hA-JklvUcdMLOZN5;@**3MUQFkx zZfy$;+V!ViX;uYm>eK`V?~fZ`5Rq1H=}e%Y%go3_#1&=I7@Q<@v~4>-8{~0zFlJ#z z<@LI#qDjK0g^@COP;#i0%A2AMC#-AE$$7n1c&3QX*yS}U#5|m{g9y)##pBS{tEOJI zgoTBTeq0+C&t)g)*2G>CIclWzIb}FhEK5@pJKXY9XKLrmNt1-dw}BXbtPV5eN_to? zD>DrZxi2i)(@_vm*P-}P_I(&$!jh&?Xxy+lCV)c-C;Yoed^-wxf0^XqZBqnWIHd*y z#Tl>7JO@jnrhZMCv&`T{a9&XNQbX+CzJaPhm5H@)M^jI#lq?`r7V}}E^vt&JN4QXG z2*mIhg_#R)_dvjyU7I45=E23l)tMcOj9%e!l{Ni$ z5+1(fzR2kk!K!P>ta2$Ojh)u>uoYTi{)FhKruc%0?G%#-DRo!>b-kIn8E2N)>dkcL z;crg}Z&@#F)_BIBn2u8on_TWTi?g#EM&fez^ZcU+6Xq0;MJr>3Bucp!$^@lZ%S9rWssVnh7Zj7g+h75&5hE z_VQIWN}8NZh8+nb@uBN&<}m1^gtyDdU|V>aGCmIB7!})rPOXmKsHwxMMp&DK(ZpE> zw}CrNHuZdKTDG*_gZvRPqF^jDE47mVt`!$XoX6PDDWGzi~L4ZQd$LAvwm9l@g zTFqKg5;8=WVYNcJ3=U!lAVkyF)|Mhuva@3tcNP^D1;DW`F3mzj0pmG2cm(mBJUm|4 zTiiIYX&D(%$3BPS$n#Utn2aLNzjwUr0E%Tm%m%5)UZH6Cun}_#Kr(lI<0+1X@xmYU zHMsY!M5!Eh19|~)G57n~Z+DigUI-&-YiS874t&^h;KmSt(L#6*m4tv{L14?G@F*!O zgBn^;KBh>Q40ZwB7e|8)McO+%abj?yK-Oo+$AMJMSTYO7L<;KxyU`;?!VUHKGBPs1 z+5j$&5I8H_+qo$zDgaEjBrr$6!>Od90U1Vx3XLSOytOq=h)C$c%iFuq4U2~)5eg(9 zphuZ7K<>uB7kQQVf&9_k+e^Sk06|z8OlWla&CHAfZ%atLpn9)aks^W(<)#tc{_nx&{F_ z&Q+{$!Ks`c_&LmNj<6%KPft$7ZJqeMoUoRuTYRGL;|4O^`dZb>(r`~1zQD%1Pau(v zDnH6CSSrX5?}5|pJ6Y378?_-kLX*P6MhBo*J?w*#6c)D(6P$R*F#2H+Q~3))TB+7w zMIU&bhiYWw%9j+YYc2B5tF}q|wLP(+MRaR|#w?hg(l8udT=A_4zAOD?UeFvts*FXE z$3f0Mg~hU<#+;CTtSp+0`?{w1p;$|w2%YUEq225wmrH({NrZlzc1*!C!8UhX88PG5 zk;8{mQ`^hH!O^hWV1d^3xcs#As3Ircl#v7}+Q7FXP6ps#Hx`oaOVcs1Lhv3^lxL7* zdD3ZAL}Ck7rcV%fF;sk{-;2FXyHlyvva%+l;alEF;u6ObFQd#%M4S^YolCvrJYI|XDw81f?eke)QkkX-aG^QV{%#|=_8i`lO|1H#D35b)RtEiZGkme*gMq?8PdgNDh* z2{Zetsn{XX2SHP_CEqV_aFh=A-zDf=aIo_^d9l_|=BbAsG~SPAwUA>1AO|`{Q1N&HY5iY3XQb(I=k{j79kn>YA6RzNdCjcu$~R+T&RvR5&lG z5}R6Shg~e|=mwLwU!`Ff5&8@0?`b&DmcTt6rf8`^jVw?<{#;M3xQpDT&%y$6mj9@ZCJ`V>6hg*Of#9ro}lYyEd@+l!2R36+0oMAbF{j@JIrU4cP z5+6f4Y*9vTE<6FO9kg$tBdBtZ?>k2fO$N6Me524%Kinz+`X}iJasdNF#}LjK5D}Ih z;4tJHI28UGfFp)zcJ}hZkpKzS*?$MwNi|S7+{3Kdq3Y%xL5LAIV&(6O_ z4IAxm4bTB_Peh0FWa9{?gESTj%F3wCV@3@DOrop>cova7A*&amGzO@m4MgYjj%)h` z>j?yZQYAq?TK>^zD3JWyL_mLR`X!)Oj9mRfx2m0%=$bI_sy7ZJRYXl~^=l|4>L$u} zoJ>8%?xQD|JRguADkG7j&liXh_yXxU5AqQJlnT-UdIQc4C&^Fe01VL+xQlbj{sqep z=$LPi;>Y%Y9dPFbZ)JT#i0^4ZV#b8L96S_Hg@}Oe5eLs4xcbu!Z-u#tfvO7dzWx2B z$JkH;eq|Vt3M6wuE`U}eN}K1fAQsy{GejS!fx@+5dO5Mvv(Q#kTRAN_b2|5tuTTA#RiZR%7Fw$guD$jZV5|ohSecZ zKW=G{L8A*qnJ)cTBd#&)&kA_~f_a2Tw72N+!l`=LLaF-RfA$&orN99Di~mmcp#Xf< zz_)A(gjgh4on636B5!>yydTWp-1TRFqpvN_8z=OJ)F09;2YauDu7fjBt- z!>|Cb-Tl{U0375_WAMl+RhryRKp(c6hK?@f8`&?oh#P8=LZtjj?Y}mmo8{^{IqD&QK?Dge#^6Q;)sM9;^7L5g?hF%FAlxikYb(+%A&d;Z z%M-Ql4LEVH)<>q4skIg4q}J4X4ZPK6whX+wLWz>GwRpSP&RpDN>SiM@w`k)u!|*J# z9}wuR1$a=Qo_yF-R$uXeYC-(W?udd(d*_yMyWqT0G#vs`lp zYx=`O;fGZ@?ak7FpWNMghd7184 zOc7)Bv=+&JY(hg9%v>#2tpz{?zqq-0e|GO=rj$<9C@z~Mi}JG&Y6~J5TEs55G+rb4 zYxIJk7z`u+weA39Nc{%<@YmWU1JLvkU}1T@U$p_$XxMP004Xq0X=y11Cnx5x5FN&! zbM?L;@$uC3bahS5v)}KkG^v12v+nKq`1tbDCVk4ZMTXl^pGTZVjfmQRaZB5`IE@fz1FNnR+y;55d@FA1sgV5*6m?X;%FG<1%+;O zIo`M`ivs+!sT~`HAYZU+1Oiy%ceAZ)(@v|-{I7tKEe>2PEj5c&r?u2=D;c|-VU_?> zTiayWxDPi-h9RJF>=Ye77XJntG%XNo;+qy2*lrn!lTx)-A@D+^t$yGHo|#jS7s@(& zh=rw1H62{NZ=h94I24i?96|yz6325XaRDtNCML1y)p}-msE7uA#hLURb~mzWv@0C- zlk#P_AfL5QA#c!70r;ZntRkfSH~EF`a-uj;i=Cxal<7hl2O<+ro0sitlB-(8{7VA8 z-4kbyL5(6=8Cuhn2e=dk@ro>L$3AD{0k98xR5jjaa)xeFkPV~7>~d#x50SANna%Q& zGlwi#bR~<#gidF4uzNL>@I#@#tosA&ne25g4j5j*)Q)&|_Ih3TAVq=e=M$#i6j^u( zwK);6Q_V2BSljPnE19vXLc$_3#?G%g9W9{89bR8hQlPQHKUpctaJBN50@w{^PV#mB zzP2G9bs#!Lt7zsWl*t)E3re7|8Q92<56@Sdi9eaS*Rj7Rw%Lu1N^G?Yn?AhSNDt3Y zK_~!>EFK|1^QAf*pRA-YzME4W%}2hnxrui$Q_^$u<`@3795N*(U;UsZT)xsxDym(_s4FTu8Aw$xx02ZS&mJexeJBdPzrUPcdR7| zuwXA{Ev|0c)>zs^Zd^iQjOp=St?vD}!Vh4+O_he2=C1)=j=fMCgn zZGnzPXx)I67&}T0Q?pYAP@=c|vSi!uc~(mRt>RaF+Z zub)Gd(K1yrrlvfezZyWpLq|$l(BG!Yomz0zM zHh2Ik->CD`Q$VK&0PyA}CITSX*jK1dGccaw}CN`7G}Y-QOf*$so40Br$q() zE)?41gg9S7_WE3ov>hVqk6&H(;^qnP5W4LE+z$f!w&!2u1ObHw zO7)F2Q9v#P9ODPk`Z_Df?d}09)|&4$V#8lkt_a=hbfBtbs~UNGwo`WU5s2X4&dQ?c z0(KmD)zl-2o|S^tK^mxZ5wh0S#@0@hBo(!k!HuZ<#*M7Xtjc?(p4RT_Y8a|H{<9%;f!HXX|rjyHxH)Pn4ZIH@4*#@CVN zwh~9+6J(PYbp?7O<`BSzSg5ck!*7=+%{CvcwwD@*dQ{mPz}AUvi^z9j$NBGY=ux`~;ehLZCztgC4JnjA(mzugckg z>hZxu!Nf8z_ssxNwG-?7c<)1^!qw5$+S_d#Ha7?h%TQyPr-z5F57^M+#PZ#>t;$Y|bx@wH<0)Gsx3s^Z5aNPijK?`G6GtW<^JwRhpAFREAKZmfr z0~eYS%Q*NV`f~lZhx&WIu$WGp*U4t{6^47>&T7;JdcbcGuhD4)??08H!J9?OIk!ND z1%XiZy#K|I^8u`^{M9#dsk%2MgP-o+%?z1){XnJ@)_wtT z50^$9=qg3UrTB)AkkAl$G?TG$H`t3^ug1sw zEz83IgCtt=n3`hjw8-4RkG~4Ni_^gBPeAX&)u4fvrMW)-fs%vDa9$xE?LCcW}dH10f~1-AzIj^EQb zpP#6W)nf7VWe`)t5P~Q$GZW5j5ExQi6=A-cy)Y&bwm=2?xS$K(G%8IfGuYH}%xpe$ zTzS|DYqo8J>j8Z0E%@Pc;(z)87EgXU0 z8cGLb?F>+Yh1&=R>+Hd={x+W;PlqUUNpc9M2;D=sBCy$)w1a``5}PnCt!^;5MIm9( z^Y#`@0;a!r{{lu0Q=ce%EWr#s0RLu6&Rs6F&&e-s#;d-k`(EujKMd&T-H#}c$j{F_ ztZ#kpcXoP=ekh4KLsa7G(tn2j&l?5aoQ%6bZ}yw*6tBj*)7%YyNu7ra62@zT3r<9p zg-5XIn*P)Q>dkDKlwmcj&K`mHch}xsMfl0oSUM4}mAjD$6+?Y=I|{lR-^EZW{UA{9tDRp*3`mGtOhi!kJ>0E>W$m{O^th z{RuYVpd}ngM3z;kxsD4o+5OplX2)qOS>G#fEFWo!~UE($K-6 zvEko?E)|hoVs`~;@w2qoH^MxqxLuCd$1dGOdXVz8e;>DPzWTCu*giwN!(4BQi#i`n z5ge=q)e~Nbi+qLv-X#gTwiyhb16&gq-ZHgT2@DRR0iSZI`P|NgEs=@6&VsR*oMkTh zIMs4H!=bU$ys#AX!YilWe@7U%4to%rC0zxw-do4v8^L&T#SC>4Wkj7R60~^%K8&6l zrH!+QM|XjEzdy3~XWE(hc`|%H{0B?1OM>_c-8jh)>BbF`BrNf|QeUScFrkBQmnN6_ zb7Z+asjuk=ZGRl-ep!f(u8&Xm;YGiG{>ngYYm}EP?s26$A9|op*sG&7(icPmpY-Jo zhG_}k3~X2bUu7%^>_vd3GeXnU<5&2kJdq-M2N(>@F`a@cWn0EpJ?wcG{5&9slLvx#_kipZ}28*I~N0H zaPy^N;eCuV7GgGRuJ2uJ|7JMY;@tOdCJf-+K{vQWIUQmit1IhqXM1yp{NeAW1ya{1r)ak@?m$b?Si1NhS2*vaUE!3 zYQ|LUB-{qt63CO)=&<8ksTx4lqNN;MR0LL}uCqT@dbJ?JI?dKrhM&u4fm5illdtoP zhB)y$t{)ZEuyg~|RomC04v6DbQ&EQG#h&hto<0wxLC>paSkpD%k*h_!a%&5MY~jhq z(?F2|jl~$=CR3P3&Na0H&szjdx4BQi&0d&0?~bH(dUM%{`LAVWozl4O$H3J;iZm;?)!Q<o^JYYvoJXdG%WfZEaa=b|N49Xb6+Y2GZ06| z?Sg*H>-7nueJ=E7XNt8VZ-agy{wJ2Oo4PGk@3d)Cj4-yofQ-}~gdhpHo6A@VKpXa0@P8zjr1pEVRoWxe+f>Q&3hM<;<2OSRjAb)=>8B^LTK& zMnl8b&~8}%76ijWSYUbcW(u&eOjs;!?hs@hZcdu^nguRK$q9jXqbspP8*Tt=uSGN) z*xO%b?=&%#kL5;2mdnxG;W2X*pSgcW!GGF~`3p9_z(*Ca6+p-F=gecvo00$kl!t50 ziXTOgvE*XRfcO#u95w$33G%{Z1=c|SwpOYT5sRq1WeJ}+XYWSznKw{o?=^EmE3=qK5^N6JYP8GsIkTwhI47& zZHb!;fy0ny<}R3yJi3i1QUQx}2LXOffF;ATS#0V7)w~`11Eh$6HhwyI?7XuBEu^fu zJzJedU5-$nVW@d8B)xpgw?@~p$lP>{{x~xk zc3d!{=m8jyi-AYj8EsNxrbYV-e4v7{f^FIqjIZHS;u!&@NLWl*zz{h^u#lih4bQk7 z6A1`A%&71dKEKbx0RaYhBvi|)G>ur+rtSA^4fkp{pi|79NR|6s8+>Vmw86U%Y8b+L zo~sES-l=T87i|jqwN>4krrGc?REo_RgVJY@F?r)$1Bj$om7@#HX$!+~u;&v2{&Ms8 z5b{wj*+q%3>j&B0GVr0V?~0K86}_A4J^RABRp;ae?G957^wPP|w`2`v-J-<@p%2_a zWcE9;<<|(WB?0$*%sY8MR|42urSC0c`OzKL;0-iW*0+E@)_+e;fO7N2a!>*GIlFj9zSAXNBfafN=^}ZgwumyblC1KoM{BmoKkmb)G>xtinK1o6v~Lg`{Xeiq4Eah;Un_Dxsfm*y-2L3i&VJ=PaRd=$rN9R0LS?!4@l1qtjI5 zCTN2i+UxRvdWgP`pv7`++s1Tv}?t0!IRN75x%& zw@I~5ECgYX;=sr}5FHqJW$NTUiYu~Uwqifgkxr)%KQ(!aV&#@C8IWfvot6%Z@Q+1N z?pTd#55etzucB$$2Brx zE(CYhCBb9%07Y{c6~+btPVZv>1*k#p07Cf>q>SG$YHhuarR8-a7rVf=y=~aVNQmK* zS!f3D%e5$EfMGhFuS0?Qr zI5jrO=L#gJ0>X0gunDtM^7GSEg$s^M#mP}kLLaM;??${x*NEeXOqj5d(;3OjP!|>( zn^+rJ9x@?*6pAs(#>wn8V6BqaRjD?Xk8eggGMCNiN=0;dK06gFSyL^iZ}lPz@1r+F zX13XhZ+H4?m(b401MFD4d_UEiM+@d+;tw1=6FC_~2_sD~#>wEMO%7dKn=?dbqvB$F zkdet1EuhZs5`VVM=5fRNa=U+7NjnYJgutanI3G!*NLw>uxq4DVo1l=>9H$kpDJG!% z^Trym;Y6o8@uW)Aj&u7S7YWr;v*S!~Po&rFPLIzXG-0LJiC4CCro5bLCnA^4>B+{$ z_d2{v$WGVj;9%lq$PtT;kRO|wnw%`M6eL66mC5JJ$;a^f-)X7Xs362rnkJIin_Iw3 z_%_h(pSKK>)L)~lm6mwP8Hu2UPPDsz^3;7({jQgnj+332i|cvkGh8#iSSC+la+q%6 z8m~iL_}5$v=>HxZUCrOGu4$ow`3?ZVR=D29i}zf~{~oIZ_S?PO3ahiQkmqAM*|>cL z1-_zklR1C6r)b*LwAThM+~yaz)ZRuxoEF*7bhSSkRw81{Ro&gviZ)i|V1vBLFNY+m zZ|H%#IHoFn>(uT98mtq^=3T8%9 zWFsRZR56yzkTNX>`H0AFM^X}6PC;s7@$#jpwc>0}(xM{ca#=N}t(x}Yln7e&NH({P zt5ZG{etzm_H4_shuUeJC_{dJztNW3N440ap1wYSAbYM<%zK!=f{7TZ%O-f1_G-)y> z{jsRD!1AC;!+hhW$JFYNBI6MjbZTC9lKs(|H4}nt{ z6Gx9rh9xB=#3{^=WkS0%#<)$W%AKn$! z;=a^{*J3m6Xb)kjLNhF#%`@fCJutz!+w$J!p%~ z76u%ZqZ>C`3J7vbDJyK;jqS{AeZprhNWAs$uF$q_KBcAsiw8cE8_{!OehF*Ag_=Kvc%@$5c zGNrvK&DwywZn(N)hXYONq-zS4D(<&o!}`93nGXCJN@E&i?m9X!;I3!)HX;g@s7jNe zQt@h#2(JqSL&DV}oDGr;>j!aHyTqTE@8k_Ja?6f1AF~3fFXv740D{!_Q4s>Y&IdBq z4RyzNv*d@sKqpApMpm?L*1DVwp6BK8C`5*<>7*U}t$0x{n79`ju1@sDY`_Gd{>=Xu zzGu390;x=ootvI{veL6wEVn|guzHzgXya(*+Ei~Z!G2kpp>hA_o??dCHOAd~Xz5rT zG$UVaVd`vH~WG7UikddDhrRW7r1*LILh3FB3g$ z&D%H7^Ix87ZO#sU+kmd_N#qw`gpsd9)usOY<`DvDO8M*pp0_Z8S1jOJ2=4kDNU_hP z-UYWLPiPN)CR5O`Oj?W~LbgLIGVf#g-kY7FwBplD9 zuYG<#G?c7gKYa6Z1idME=+&##hQ)NaJ>TFGzf&D8GUoDn9&fSdspzVF6ZAhnoY_1h z=dpEjdWL?^D!`nbJCeH)IB?e%IS~chrF($}R5&^wqi?nNlEKMSsVM{t%l{iVEPDL0J9rd9`!^ntLp(5Cn4?{L1 zQq+i&A{RmSfXM?JPmiAVpy51hs1lS&4;qX(iSlVdWCSDVK_u7<@4w<32q*xLAo)O% z94TFL?!v>hr>Ctg3OIK@uq7z&^5e3LIP%_7h&KH=iO`I6$8YVq{YUP zGxZY7^b$+;ym9q&Q%kduBpLdZ^TLZ?wVyzLhos_?l7VzyfU^T2GX`v*mW+ZT43QN% zVk{ESn3MAa2PKXPKJX5Nwt-{r`f@QEo<60Hzd!K&F1@|?wyLPtK=q?}`c3dplLyEX z5ZW7K|47Dt`>9HW=HT)~AFk%zkuBO_5A3(`3zER^xR2aBQljkp?eEX0Si!HOp?CqG zKbOlPIZN4fz4!O|0OfW(B7sayx8v<0x|Q(C8EaV_9+w9#_pSj`h%*Tw)CLvY2X%)K zcqJXfRQz_X8{t{Q<#l`WeYf57mi{c&Jv4nMRmV#m&1;V9p5tnocS3R(Mc-512ijY> z`^D)LA92@njGnEV=8>V}Ar6-jtTDdZ)pj@gR+{IT8?C$Ks6%zIU|KweFc|bq?dghaBjOxqqF(QTl1@F9N^az}V=2v>8Yd zkR!$n{lwC65XP2J!FpvsE$-@n8uSzP1(GwR;lze{TLQRjAwGhB&R?IXd)Y+&26>s` zyD|2+BxG;edvy`V$R5a_r%qNT_gWX*P0w!Td?P1x2C{ zmFXUz?Xj$D`9z4*w@GeB}x^) z{8c^J>c>2+*hh-yZ8&*qB*3dgBO8jAtY&g)44Opv)IbOv!+WMYFra+czen_F{-)?3 zDr~7NDk6c}i9{${hX?W=>JlneDhzPD5lDN6t%tLs!nnAy+o_`kd)XLtS3V#G{iT@5 zG)<$Kh&BpO6NbEW?lM9X`i(3MDaM0J+rm3^)Wm+-1553y<|-P@eXtAqxpuH025QV_ zibf+qO$gT13B2`IPP3ONhjU2}jt_$o%&WKUu*cM=0g1uD9%=Jc1XQt)Ip(u_=L;JCrL8l(r(0Vs2}BDqQ`lCrYilxsICNH>TfSE9+U0$H-4Ay-4jMJ^mtz- za|*HBUyjW#mg0Nkc4K~UoZo7P7~AV_|2bavwKvQ6puF$To{qkuAoQcX8`o|C96o_t zv*CfZ5WxGT=f!z6uf6)*=V`i|9g@HS%g}@Sw4NQpdh<<$((*vS`(d;!LuQxf1>@#} z*Ie+!ceu>{>(Ayps@+&D?HuN(PTftHyQ_OoYuBV{I^;wWdnt=DcV6NHR05cA5Y{(` zyc6Vy>0c(LhqaZx7d5|2t~Y`6_%hSzwbLFnsLemrqA0PT#4gu(fqurVqq>?Z#{YHm5)u8FTF6&~oM3`px{H zL5wX+WAd$Bmt3hLND#W)Ibtr=dDDNN}nfLxyEIFyP9XW-VGQud-Q0?@dPq)TK$# zmE(07$~2;6%4c6LM?44-b6JW|5TIzJ45dF*=ujd{N~`3!C5I30#ImyBHr=oNCZnHR zZX2nVHlCcw@JOiK1kR3?QqHdV=1ic9)M^^K*Q`|wQ%NW}LbfQ~Zx~G$A6laglMAFb z&F9`-zwRH&GU*BO^nXq`^lo){xna5D0`i2(jIYihV(wZu-9o9;v^TF-m`!-}FQ2@* zS#qV5lS|+rw8NB&Sm!Tv0y%A0H*K|b^r+f4*f|K|6VVo}m!(rn&8zUH;vstI5@!`h zmd(URf+A%Nf8c1(;WrOkaHY&*PzFDj-TX=+SsO!`4;5%=D_RS zjHu9xUPrAKU~_XDmRq}cWxG^MeQXW;7Goqu?^Ns>a?-I8#B6goilMc_-u7esn^J?2v;Qc83eSJswaQIV- z1o^<)*OQ%GX+nc;1v}=z98n$>eC$bQtP)0+gg_=K#VjM$hye?(Nre3NP?&3oqY7_0 z@mTDZ$>MUoK3ATis6oTO^Kz-346Zn-K%2>H>!?_=*nm$m`;&Tjc0mnM;15?4P0FNC zlV(Rd9NWfc*m#MOWy4SEhf5pslL-ss?#rdAWiNi2VxylH_H49iPC4Vq;-j1RHogxp zvtx;}9jj=h#B6IE7oKcBz`^>U@$GI+(;*;%HVxf5u}XJTI1N+qV+l+~#ub+?OFa)~ zxk@c*G2pO1HQVL=5ppNe4`%^%7+7(~fK#JXyWFlpM-V9n;q19mBVP19LdBP9n-HN& z_~}658sP5O@1{x@OiuNrkc%0!@~H8;UXPMriv$m9)Eruo4|)hQqVV6cu?V8#bDwW zVnvIT87-#rTyRFX(8#27?6Gs1W7A|)7RLMZ2wp6Mnx7bX2lxqjqV{Lr#zGqiaCkrN z3U@K+*BXWm?;o)o9IPJnWw(rtf%y#TordWNK0IxD{ko8QJviZPC7|WD)6y-dTUYQW z5qLW}C_T^{OB%zE&m4Qa(2hS_g}*fquuh8xztx7p=*NPC2!3V0OM^9-a-;M7I{fMZ zlLF5Z=#Dt)+4gH|iO^_nTj)Zk$RuH40NK8)-nNN-vkfYBkwXyh&6&YW{@DaJ0u7#3 z5u5LAMUp2?wrJ$vajr%n=z$lDO1m6Ht8U9LH-gHi@8#namzSVorE`^&)~^GR-08k1 z3z-O89-bcyS>tBUk*hLwc_d!Hj{E<}dJC?&f^J(BhhV`yxVv<4cMa~1H?G0mT^je` z?(QBSxP{=s9fG?xk8|$0=X`g(AFz9jy}PQ`nzCj+bWMQ(l6XUB+csPd@P&jIPG8Ty z!W+23(H{$?`*0M#5%l&m9!f5~J{T@{PUFR{=miHYdm0@5IHs=b+ zu_7=;G@IeZgg0wWR3#(Zigz)axwFQb*;Vf5Y~7@e`PZ1I_*V1-sW72^?3>Bb0Sd4} z+)`F+i%i&eIji>6?tD)WK%n#!-%{LV`Jx$d-GVylF9Gyrl^P3E1QR;@NO9@t9bQ#VX3kE~4 z+SG4d%Ttcbp%rsbyM}0ads-HFm`R*ZjNRxBA{9i9#SlDtvnJGuzTpiPO*S@hWLK0* zPICEbjnp8SrD& zgUzW>+*C5?&qL(uY+cExQ(Zdf%n;yCm^*Rcf4V4-Bgb)kBt@;RQ)hu&>*OYbKuo`}`Ek=XK$@)iZF|*puVvC=V?b5fF&oEFkTaFHAili5k zHDkWTocOID>Goc~PO`LP@pXLlkuF-pr8^T421;u0Zns0F&9U$U=nn+VV`gX=zP`oy z(PqjQ|MqHa*z|#PoS;Ej{^X$yEWr4|&l482vilC%eSg@rP!1>rAg8^2+;RyW90Sje z5HeuQ-Zs3(8pxuqi5q}M$5>ZU8IGrzE{cH)+{e*##~dO)4%A4_fRh zbgK>jgr%)r@?;u@rSjLP^HadwiHdGGt=-xjj&(0k%-(6i>I4}_I>z*iZAV5`XUDpC zWjCM2Y8pqLlKIr7ptd0!eifRmu+_Ns$$_u%l9JD9$8YbBReBY80@Sp}v#hMjYM!Lh z)AD*pE{*f$a<-A_LQ~^Vuw952&Qu@~wKY{05kZAQlVX~lJOsuX)LIgJSfDEr7GqI9 z?(zkfpEJafYkf9Mymlk6h>ru?7wPMA_JV0gTEaj$G_H6VUe(uTPoM)biv$nqpEnvk zQ+q4l+))=d$1ZrT#fc|9HIg;q+R}TmnA-FhLQhyMo~PM_Zr!PLTPF%e_B^@hgPG>j z8$NF^6R0*_;Rr|aXxRftsrgbfvDl3xnR&r`w$zAF4-MrUrfpD`i}|tvnhMGuDuyMb zt6}!L*2L2_kE%!r~efi|oJq?Qk45=)9?zV(E3SmL9U| zt&v#;xDoSIIzk!yTF2Y|h~`1+13ks|M^^LM_d+o135optjL^`?ZZ~aHb=VMzIYoQE zBcXm-13pqM-Ut#*E>UUS$T0tb9!aO|6E>wtLC%7gs*zwSr$`ZZFN7Zr*J8Wbcjm+U z#2tYG;6oSIC~lz^ldIpH1p%6CJwkI{!B1#nIWh|1iIn)eK|1-W^0MBC>IG9U*dbv4 z>hj?MzK#{Aev%DwcVaeW#q^l$C%D-(LC5zHLi@tWx9d-=y&t_7c#!w# ziyr--9vbza)pG*=G8?{v*vQdWAYT)5YcMpcPhIP;D3;oikfIoZIxk+!KOJ3}F zy@f?mqZ58=*LO*_^hjsJOSF3v(eolf^;YFiZQ9#a#X=nWRCLfArtRU=`?Kw+&d2`K zKbW}Q#RDFLH$-1clsfpMwqKB$)@zw|tNk0JIW`Op0d|~AL8~K+z=B(k&m(P@Bj2Re zp7blFvU`USRnSJa`sRoT`UQrJJW1B)4tDeJu$NXgk47J0pOJEf5s)e$#^^@*8fxK2mazY_CU3wN~AAU z%~@4jt%3xTG`_HEEX5of3$_>ltYI@7Ek;kDi~%in#j4xC=K+7j`ubE|CDh+mDAqae z#A#C*(zL5ucKIurl}3t=P0_r6{ZTbpa9!H9Ajg|$w&Wv@FGFb;7A7(gsBJyzdp|Y0 zTwmal`GgRnU|%&+1u@>UdqAVe9>oRWvg#|z=}Fu~GmDj#77e&|1lfKE^tAqTSQN%CGNNL}658KSD?W#41Hmnl=e~2MQ3=oP`#iyeknj z3#cf}3a6FB0vb(Ba7<`Q79=pF%Hw33F;47b-HU;n>?G8m*U#k__jS{!aXlH=PNv=v zt-G?i&+iaB_eD3gV^*vLr6vZx_;3>jD{mDVC2}XvIrS#JGWnwjFg|=84QVZyvD>e_{U8Df2tcE9uq4^Q)8E;tdNqoCs z`V#xr8;Fx!yx=Lwp=irNIHfi2tAkRehV9gdu+c;gP^2(8o@s5}xVYPD4-Ao7VfJ|| zXcI`u#F;+|N>u3!Uj0(w&NAUL3EDcIcf#w9d+uqemY7VRcmnZ|Ei2OCMf(JdQZuM$ZOH-0sW_9z)&t$|0(j53O zXTJ_TiMoNsxqKc2*?KOvOXex|9pkpmiY76DZoS9LzH4ask5fL3thtXH{;TF@tnIMi_d7K(DXkS){rbaQ zpfcWkYbX3ArZfxtZd{LUXUtQO4|q(88{kXI0GgkZ)bi-AF-t}1uo4_w($A5P!tVrg zvZzV1=Gn%Be1xLu=C5>23%c&Gq>9Jr;`49_XmMf}PZmt2bY{XEWC6)VbQ5T!#P#Tt z%ai;Sz6EilPs!9S8j0h=zRuG)jSZe!)mJV4eH82(xxIp)RrsPA@UXtCT^UyU-04t$ ziNXE_>8E9Tzr(-a8Oa`8lp2>c5cIzcWI{382oTI++u5F#j#w1!582A2O={>cJ!{o> zjd5m9qixFB#?eT&9q&NREUSnS6-=Md970YkB~ohmeX4O3JF8pkok}oZ=OLiNP-IxP zQk|3cBgNCum^Y|&^=)|jWEOOcx(1oqG)f%%XsZ~P!t+nC6Gz9!tN}_TW|)`K%vlpc-*Dw^b#Gb) zF#6{}S6kNGDt4W~7JZhi$j~U$Itm=!Tn4-_HOPdFa;B*;Ml=f!_AL+6x^$5gHOw~9 zx@}Y7nLm>X{KBchnLsHf+DdyW%`n1qh-jNShB-GoY!1j#8g2w6f1{JO^+Q44Y!wUq znpNYu$2_Px4)5QacBJ^d(fCe{Y-r#wS1fVrld>6!^_b_nJ3x3@4heK&$L`6i%Y`Jso{}>$Iw*U}9xU z*OSK4u~f=*@eZ|6-i-c~7PD_IL#ixiMFt)w8kqZj!C%12xj_+norxH&#?`0q4vr#k z3Ja9>^6>upSvb%C`SwRuJY;v6J2ld>slo`d#)jN-HK01`iL+{dD^1SkpgPB(g90O}uh&^QaOJef8q6!E8>V~JqKUzFRF6GQ6O z9(^?P4K_W)DMVFXB6v|CdhhNOpkozl1hw4WD2O_3TGdr*uSrpLZ|K}9ji!)mq2{K; zH);>%1DP2K>j1NqmolU`QVyT_p`aS}L3}a#h9K!SREnNE!!oKi5xjePA4UX26Kc zznU895HSFh;8LriIae7$v|`Ef>f>gfKn1}M;?V<8PZr>YBw2}OY0+P;PQ~u#NgL5g zK%Lm3#fu$_tEXz;bJmVq9KQ@OXxRv==x=DD!0Nxj%w(V)9a3=zdXXUI!WHb!1ZJ2Ys%{3^?+bk)3$SB8J+aEybAwIiTS1KhBB&>dPHs z+JI2{twq(eG_{pXYEigu64;eH7EK5yP(QKYY>FsR@f&SNarTC=?#`F-v9y|i(R9f) z1+|P=Qnd5b46S-0-d{gmQ|1^j$%mO~XRXwvb``-#F3D0SS&nBh9=fd9^d!=VIUnFN z$>C(oi9?%2PhyPU-$QBNM1j;6lxh>Aq|H(fL=9tque@3aDJN&PG>?^X5)ZB`zEr@` zHw9DMw`0}mx+`s2+LrvnT`k)8KTJ^w8xZ$`ymmBX?pbTir-&mADaTq!jkKU-E=!RU zfN2HR{V|`VKaT%Q*!GQXBP!%qZ+`M7nn;3)H2kLTX@$Jt3uT^Dx%8@L;7k)*9Fxk5 zpc2R>&b?~h&f{d^3RQ?|wc(aiLaK1?z-a>$`7>D#R^~rY3FE|fPE3W;runBImR`e+ z#JIfzhG*_w`}vT|i4lh2@(0USio?Wrb(wbwHbrY`3zs|ZI9VDOKvU9JcH^(d4dU|+ zIAErSF8g5enWf=Qo5 z=_h_=T(5==44#YN&eNxz zz}2>A#by}?zF{1%Q7+i-_Lr3+pH?cqF;uL;SBzSK{#vz#T?fqSmwyrMuC~4atT9~A z!Idc=&7=d5h$`JW%=lmx7S;pxT4o)vCaX)+u%PmO<()TJHj&S}Gvy2My4hb00eAaVTZm1BHs~LN0 zjvjz;G??9kNWgM_uiYBrvPF&HWxRU7?}x|J&Z-9oIh>L}f$lYb>lShCI~{kL^!QJ} zuFo3C(H3p4f9>6}IvTLOy3{zUcDVn17Kx){68n5+QReu%Jz>D{Zk(@)3hPQW*d|v; zhBq5p*=+O2c0}Myt;h{{`)S8#a zEZBS{{@S@)WvLAb%i6bZ6L=p`Q2CUF&|rUyoVn|ZclVZvSIO`uQjolx)SNkk>$th#hvT&}*&$Bzr&7VTZPyWGGE zy_TIuGosRQ^{z|@lE2<#xj1|x-84Jl`6^uiZ_Y7^D<2-G$f+4+c6|((JBm|Ms^lg* z0vq*jeqr@>>^^^-VGYLf6(JLXx~KXa2;KXnzucKogs2{J$KxOac8>d2RB=QfULFD| z#{P%&g34br=G$Ue$6aMzv$APqAVyOz1gjKX7=ixefQTEUciDsZa{eHYu*#$x2BxZd z4M!aeG}vOws=d8QM0p$eB1Tj}^&X^iIn{LQT~wQazWfhAL@BNBlNq7AKC^+hAnT;VzoY&6+`zrmWL5A?A|pFr%)Cd>KT+hoEjNRD1_MIQ*`eD?vux z@h{`}QS&k-&x}{nQ3-aKm0pB+^-q7$a}-#9;KzUGV+$AW4^34pp`btXzMh8)Q};t^ z=gILR&+CT|#3ArMxE8E$b~pX0JJ@>tuTX!ql17rf-J89fJZNm0kf-r^J$_o#y&UVe zZcd0nL~3O!o+blY82+1L+jv)U+yy`0_Q(`yyaLiJo3_jHHvMGx6s|q~u^g-gZJ9#H zet;2zN&Ekj2HIWK@j{I0fwdarg&C+oEP#xpgm{aTB&;>3i?cKG)0_@Ts{|n>W*<^` z^gaR*W-!&hB%=h`?(w!*SZ@ILpR-P1q*ONU`LUeN-mzp>ElSvg3NxOd@_dQwCFR6o zWeJd+Kq+))@Hn`u@Ap!XB>!3sO5R_;)zg;76(A$t{hH9O*ZJP|{Dx-=vQcT|fvLbL>&cc1lG_LUODUXhPlfOf_Mp#WZLx*Yk_lL z`oxZ?C^Qg>sg=rLl~x?q!BHoh6$Q&r#qA;H-EFn->IEO;nyW5_Aly}6;{CIcRh z{H}@lkM1R&UWD=^;scVco3>guZj{cdJExM2I@T@f1qwesy2w*@8$c~T4T0gf^J_j@ z+^JR%2oEAJ)qhWLQC2jfLAPEz8jhk-B>o09h?e89K)gr++elX_2yU zj}&_~q7c9R4x`k}&rrJu5a4InF=|({Yqa*44O(JGuaTjrHFopz)%~$i&J(t|4+jbA zF)l?)#@1;}&nSE52HfsNsT{y=&#Fnqzb@cd|Fxy5sCKY1Uj8LGDPa18xkDwrXn3$- z!<8bddxuS`>;$7AF5OPS zlSMZ1ZPY}@Yqx~JncOdMjKdm4uH2Y(oL8RC-5L(07O1AKwswVc89RbpJRx+-xf(;x zylLfHPj-plWLV`Y`!9nXf?%$7II*Hj2-Aqsx`JYwP&56V@nGQfS&LdazdK>!qLjw0 z6XC~U;|Adm%U@m>Yv4%)#cTk3`Tu=T2URU%*F)B-d&mr&N==GEOxG%69i1N+@%Saj zhUygjL`fyV>`>f8V7YqTNm3k94vB)~>(^>jxQ5bShq*TDIH*;q2*Aaqj}mHD7Vpm4G#QM#EHHZb6Us}4q|Y%U zP1l$m{N{+><^%7`yHcj&7E~xE(qdr-Q~pd>g+VZFr2Z3ZsT>oW5j!&M{BZ~K{DyJD zH`Orlb4nZ*PP+g>`B1j)c40qn))aUrpPHY!Im4jKy+!OyJN}V+KxWa3A|T-~3mwVU zQJ}mDK*z~fD3CmirD+XNkjffYZSfY$o|=eGQ5YTr_HO(e?KKugxSIJdxu6A(=+}0; z!P8!dQQyNh-2%i^$N~5(sgXJC+xh!-dY`W==6awU_p_UXA(+(vYK|@7jdV<-?ZrTU zG~oVN27m5{dG_(6xg~2GFaHD}g5`W;5Sw@4cgZT`#Ac&Tr2Xaijcy?ByuYGZ#eS*d z@0-uVwD?t+U4EVjdjKp3@B{t)mrmKivf&PG*EQ};fG#r*lRnmu>(|`(o2bMt&0`nSyC&@jrZT9Ah0n;5+JB|>NH$gBVFJbYZ-IJd|}n3 z0+>oa0;O3;igzu^Nfm{pZZOP~i)FVsm&{2edv^InP+k1(`v>TVKlf#@WsKA+Sj2)W zm@f}4EI!rChioQe&CB@gBUlmOr_D z(xK1xGxbH=NJt@P<7r2(+<B><9JmxIwG$`(l^{06bJ?**1j}QO+%Ta#>$(OSUeQb7$4K@+OR?ng%6%768ZT zbQ{uQrI>oxd~z%V)3DlKi$*LPj|Wnldx`w-yOfF7A#Va?Jf){i2~FM$0&^$67t^|;fAEDhm%!TR-#?O`5iWyRZ;uN$xQ=lupGZ| zlZK@OfaaumQlX{?1Lm=272V5P2WPx;*Qlv%sma?hiiu+?)CQC0D_OmSzapDe3Y(;I zBMpDu1oz2{#zkP)IM5|UW`lDSBxA&J^$y`Evc6T0^W&ffbCZuR^-HSm?)idMBQ?IZJVk+B7^mhDv z+PZ}7Edax_tV!T$)%T?z7HSMyh*~_d|G$7im zBR{kgr_}|lY0@}hPB5<6v*t}Ko8RBC6RMWlvCb{v(&bEwWopf)8Z>ombz83~%JYA+ z2HOs?kxC)osmjP6GDJfw<2M1#+iu{U0F%i3s2{O~s=Y!2@2WyRxZbQjv)j%=PaoRqP8YJVuItb94?_M!KebNVF@+GT19HN)|(qLOt@B zh3$3LZ6Z#-?j;z*1sukr0ue4y&Ue(tE;MkA^s8*DE*Ay0^^r)Uz1`EEIYI!+!3CNp z>3@H1-a%+M_xL=|G1PD4s=|AZC=71~s1xqSdAl~CcJ^*-d}rfyZ9X0pfw?UG=31C7?)2&JN9KIO>??zBnrv-lYFv z@T*i%6?ho0^D7hULl(Q`S4wlR6(PJ^-8 znS{~bN%eG;Jpih^dHYEJ4^7@K?InjE23S$bwmTm3Hz++}CZ2^3?OB2IO`{9DN~o(hhUAK|EzyU%v% zEvz;Fb}FG4-13=-5t6tgQa&~#S{qXNnxFsWEf1%5gdhVIapZ2x_c-ws$xvW?GjwAy zrZe!Ll+ji~G8Y`pnw8aK(ESqM%V59A!7I&dUCo(@^x@~T+Zimj92ddySMLNvNoeti zg)7-mO#d9HU5X!8s6g#oe5kdJ6et9g^of06;Ru(14+!o?bxTWMO(9@Wr-uKw=6%SD zkE%#peVFBBwKH{n{b3Zq%;&%EU7Ju@FXt?f<3fM5{<|d}=%a`t)R%M7Ek%hX*Yytz z-__FU?Yc)`t3&a09wPsa_6r>{SzI^dIwBAd!m_!L)fcDziy|!C7xG|@5Bo|FM3e5t zghtJ#mb+fKaBkA|$od*?;!|{N(euxhziHT8m@p+nykt?YW~uj&fv9Om#vQ_7NnfD} z@4p$}Gt|`ncN~bKe#ROU3HX1c{txEBB-xxE$bla}EWaOae+|Mjgq3@_?Zc?OMq*b$Y=F*|an3>yG)d*Nc_H3)^q7vWTmv2(5$z|09Zq+(V1&`iZRDEy4`Xr?nQqi`~c*+oF zc#3raJ{$dnR=zo12~+CmJ!=M4U!}%Lgkhu^)pYw+xTVEO#CKeJvT?nSx=GDF=-jn#Kx^%2h%ftaK0M-Oe)yp{}3vW1yr_HN`}E3|+Ye zMrO2JhD*(fKgT4AvXZR736(VE0p4kUJQ)PQyDK(FJF4VZ6I?$*vtgHx1`=Cdavp-} z{2dQojr~%=bcvEl#nJ5O{BA+A*r^tur!G4j>eTJy@W*X{&aD#wK!4Ok^ zU9>J!b`twLRmFv=ALAGp^Y>O8j_Jt^k=CZIbEQ4roTJ`JTZe6LoI(AK}04RQZWkBMXQkq(qVRR7e=s&BHpX{*E zT!hVIu31&?#diQw6x^rIW6!i!S~b<^3dLWrj1s?5z4O#H>4SyhHrnTL`YS<1(usUz zfH@Q&>u-rXUW_^NLpOGssoKN7v{DJlsof+VoN%gplDHzvNB2QZ>%=(y`Ti8XWptKr z9mTfe`AdYKI|o$q7mk6sIUM`mZR<8IJ|FQvJ-QymcRG)p(p;y*0A*SU{KPq5G&+9f zzyOT?Z5=2x_K&XAMZbF=h9D)qktF0~PxpCDH&C`r;qEFXWNGKfn7PXbBA#_0a=1-V z9zMm3yhEO8NbFFPu+2w-Nq3f$u2lK~sLiZK)*L<7_+>_Rk8#F;es94OG@ZM5-=T}m z*RCye@h9>Tb-*!nT%83{5_73uD(T5%cKe;+=G-MlaRA9SFKc2Us>CP6qG%tQsgb5( zi-6@1J;7S3L^WrU{dE5a8?I;?c9afzE&4&nrfzR43zCNwmvDQSvL3Ew&~(-E&e zBd!8)>y=ua8IwV+;V-}TB$wUebqamTC{DxNt)ifiHgkbu$SmJy8oFK8rWM;i^5RWm zG(V4nd5>D3d%kg|5!ATZ3*k=y=`kwZEVXB9iD>xMZQe#MK1)*O%p5j(q1R;H34$qB zlU2DhGpx}cxpU<6au9ur=7?xnpVbQ5~Pk=E^6vOg1&X zT=QvGHc>s7yRiXXOXLno-h^?KL5Hfj^Gxt*h8iXAeCy1bph0zDcL^J7aLYO9G^o7Q zDws&ovceVky^T3J=);-k3CPqKK9OJacrnPNS(%p11?+YdHtQjkhyxP8(G>;}@DYAq z%Q0*aZJgS0I1M(;b+y4z=g0m`9Z8v76Q^|}_BHVvb+YcmiEZKpQVwRjlF_$FR1qTX zBtTcozAG(m92^#(`?BMbzQMe-!WG>hss8A&dZs5Y1`P_i!N-^mYj$?hp5fWa*-n^6zrd?rj1S?tkvcvuK&s`FyU+|Nd(uZh<&)o_Jhmf*AFSj}(0h z2xI)WUInpc9E@Il>eOOsli;NI1ma~!R*S6LbQOM?t=OI4-d4{Mf34iHYK5FDcyVlg z=Ed$EBQ)misy&#Sm?zOUnwH*<;p$aGi-0w6NQ$HziE+!B66Ql;qw$Ke2rRK^!I<8o zmNS_4zM7bIYW)fG7y4plLh_hU%M;6 zueijPYG~w^G~|*@JP3b>e{y!EVNgk}9F4XRZJ4ua*OMz{yh3fe+T4MyG~*8HOb5rY zlA+BzfAQfbW#u0KKEQ|*ST{d>(g`Jtww5I-l!OeA8X$CL%ALuQ)>)9<$$#{)*x0%5 zplQ88hUzxInD2&L>k$7Id?4L4EDxOx(p^CPV!xQrprRGCFTaFFkHlSvH-F{IIw&m_ z1SMuY$Swwj;>C$B??Y9PP2y(GOH#{2yo~;ZNAai-nXhUJ;Y5ZHpU%pJYcdG5{e z1zcvO3b<~DHV9X3NGh;y8<=OvdT7;OhBBDd{PZs!1klL0up0RTs#n*F+ufLrDIrtG z9o8Ve_rW+n&A6v1ogG**voRRaxH3cDh2pLn$p9Zr;Oc2s z7?1!`YyIrRFw_(t6$q$~M-~CR;lRt1$^qk+fhrXiy;b{Qxh?wzPPacXMPI`GN%HcG z>8Ox)R^js;(|QJG*Bww+tiUyP+?Q~0%t*OcpqDX z0lND1S+$oE_r))0UAt<*tt6w53PbFFf6eQ^iB?B=Ct6=Bm`5ZWc2roKmkkmozQyn- z9~g&`|LY2Y`ENYqMI6Yr{ZYL#$k_ga7V*b{S^nNrRaG_U|FFKsfqGlHP;>Z^_lWtS z7IzQ#XJY*S4JJo?!Y8l0Mjtbc%6*SpZx2af&kH8{7APh1^H=V_ol|DaZEAYWkIp)E ziZjR5a$Qd|nM?FolZD^bL$K4#M^J8UGEa#R?#(^`S0=5 zn0W!WYx64Cw~!0r$J>FBuDl3rSFmC@)tu4$bC2MR$n!t0VV{9A)?Uhv{g`HR7XB4g7yu>HhEQEBUyefJ39*#cR1Gdt77Gs(+X* z|J2f|TZiL%zZKA55-2?JUyF$UrkGRI-qLjK1}E3 zF8JJ>Idq8t&ph<4KArg9zg8`@OW=;TB0eFGKG-FjIZtixK<(Gowvu|AueM-j^g;jU zN9y}8ypZ7m{jo?eq3s0pz4YGq&JFC}`*JfUJ_vrGT{9KFa==|oK(9w8eKG5Y*tY&L z(c2^VHr4kwArlXC@7}k0VYRc9e(}zqHa!%Af6?=<3$CD@KF@=r{4DbRgLy#>|MP{& zC&8ZgvA42MjJVJLHi~A1pWDgZsnQ>sXwIj7-k+a(WVSuES}p}zH=zD=MHRykxCgCs z5KM}oz8fRn-Bp~_K?`1%!qsM-5QLw4=Z56wTofvQW{H!g`7EH( zUvGz~gni*&4<8%2df&zJ@5oDkq}3SF3Wf1u?bmC~f8sw5WaD-f1c5%IqL2N-0*7v? zn>Mn`;VUmf?<8#lAiDH=d-H*&qsQoX@^&RT?2Ooic7pLo!u!wl9rRzY>}eoq@ae-0 z7F~H<3B;C<(qT@eU3+UV$rx`VK(QSDRu%%!e((bQAI>o{2`C978-d=B*iB&vfwYb% z!411Ht>2k8(z)ES-8;Gx`c>y_{fc zJ~xs=^>%={2;BzSwkSnrerxm@u|0@)^?xhX+Rv2#(tV;AE}RGU>Dd6a2Iha6AhGpZ z*Lb}3kPZk+w=Xp15ydZi+t3R>sC5DNYg=JK#C9y^IlfPd_zO8aNkiP8SG}y5iXG)U zTUSU4lH7A{24T*jjs=L~M1_9xZ7TW!H&Tn|B)kfFiH{9|0Sft$hx2qOiZk^QRPxR3l@*E z!^JJ-81q=1-K_bhQ!~yMS@w|UvY4HVrxW1yR^+UpSjCmOq;?tem z!~^c1LMS&?_LR6KCcipvV8{4&NDj>tMk`t(ph#ui9*b9q&fT3$CZ?^k0*~Ae$bsBU zs#_m;y<@RF+P6$qDRD)tZJ~P6C6jpqB~EMUzID|*izP*4;)+DwxLlFdsA5rber3gm z5|6YdHpen`#g{v~h~9##MqXFm!@UK0on+?uD|b2@9Gh}<+(7$)@BLFcd~GSgbo&%M z8x@ImZk?u=Pz{nGff3ncD>zeG#zlO6%^Td7<1uVix#cjI<0I4W)7j04hYYOf*UDNa zn$hgi&K09pN0F;=lByk2ga2m8W|j`!DO>hCGtMR@ax{lcdH6tOMRD+R?q&bT^eYO}3+@wjh%zr>mI<##{ z0<*Ady|0q2bj|#};q*~{GisbsI@Fn|ic3lOx|BI=DXTpVUF(j&)~%9SAGEVodF0sf z+L!JY2i>9>n2Oj>dM@n5fF>LlPj_P%N!w=eHr-yh z=v0@?Z4HDwza02REsnxw($V9@Zo_IquWv>t2XmXDmqw)9%t2MsJ=S|` z(p}bqQzvkB>HOhE+54r5OvELv4L=B#=lP4H8cmKZ!sl*qcMTQu2De^>BQA&$&<~5C z!m(i@XB_j(_3D28eY+lWMMG5KQO{Rkp8DEZSy^3Lo0Y7-R^)-??Fz zFK*lc{7F~&Va#u)9$frNZ=jpBbxOw5rdJ~hHF$XUaHq#}`{%f)$!d{3_LSL}>iGKg z{E%$6rMGl+DU%KQ>aRoF;my-$s=&F^`P2^=sDsC9jfEp`tHFD&A=$|HIc338j+|JU zsY{^iF6)mt3T$o?+c36-a7C}CACq{H3m%A8Gp2o5oQkCOV$XmIPt9(xRkk@F>*@kq zXzS$Py0g$)ZIOjcJp zoe6>E(~CDiKWyGUsDB>cxwURorz{&(ZAugyRiJxFlsI>F9I$GS4Udtu zUhP0FL;c(nF<)QZQ#3*~khzn2D#n}SRA;Dh4NAmy{-jZw5%uX#nvp2A+As5)YU+ko zPQ=g9^TLtef2v#!?aqZ9+is9S)#UC{v|oyr4~_hUtQw9f`$YbUwFYIx7e{vuLRKA1 zj~zU6IMKq#DruQc7Mr41_V&%ozXB_o7N5*P3=GkgOgF-rrRQuq`^;)<@yD*e0juCuFH&7 zQRvyu@42?#$Y#MMwI(sMSAjRiK2V;8>`>{_!ApaB^3Oc-Z=a_si%QC@4`k=bSw*BP zR-6VS?BnTD4qI*E_uKC+8%S_J&8S^KPS@4yVNU;Yh1yc2ZvRzNa+?OBB=mtOdjTHF z2nw@1^}p)HC)R>-yEv1*ANQ;|6|!qbERq;1HK@(xD*v+Lj~05mxdn<@cIjLHjiW}{ zXu>}g6G+`gH|kj?tF>UsEo^^VRK$piYq4j4VqOxv&~4cR(Q>4sjoXl z++S@=@Vv@F+sR7*m}4-sw2_WpNVlcR_#@%9?mh`9!FH3FSH!)Ia0s7&&Izp@3?e@Q z4PFAMRA+77sD=oN3ce?CAxIRdaJ#1wvJteDVw%KS=6Yo<(p|671lHje&$J+??hV&_ zdE?=P?Tksea*)xwWcqTbSGNK*4ZuEElD(>jScIIIC@I-*8jsE7?((jTiP0k7myy)- z4;LaNf<&>F(d4O)dL63W`O#t@`%j6MZgtbZGn~pUbi4Q0uK{4n99;3k7pwvuW>e2ycDoG z@T&R$Y*>tb+D>doDuz}Oa}#}9pkHrVnmw_>cAw#fo58G^(~~U$J(_k4v0N}9>!^Nm zN;}^=iC{D>iAMQ# zp;gcD0iuY7eQ6(LTc2E*qto4I{NBq7V!U$KQJz=LrrFQ!P9m&zVYK;W#o#`Dt3TnKY6ZeO^Jys*u z&Jk}Vr8NTe?APasG*!aKz?v<70Ld)RZIr)RgW@bVBi!<=YJGn)C()D2HL(G&e=p~q zPFVbzcaG8XulgRFvbDyQdO=O#8QVpr&7<65%Sie#*Kll z&aBR?YS&XU+Sr^SDV~U$I)!^|$GT3cWX(zIUP_s_UujB<8zWgHN6DivmSU)NbQ5Rc z(2m)^wCN`rs!(OUHP-X6@xBEKi7@hojJ=RS&Wk?#-xxuR-uD4nnr?ubSAHkGmjd|u zmbH#_W#Kp%CEDk`xA=1e)|nXbx1H@A3{_M5#>ErC_IFjU>iVJNc}Z61?`)cc=uBfi zhXbxhx6~=8DK~k4`;3nt-$YZQ4Fr3seZC&d`_O?XU!MlI>J1=gba^qR$2Sr2Tv7dw z{x8<_o{7^aZ|*F~v?5Pi_yu-eeeVb4Bfc{K30%yOw$`9RX@K3NYfzsMgP}v7h@sIw zQ$3b()3r4AY4>2P0NA2H!Wq~2MV#HSC0a}V}RJlz;v~Ld&P=1&g;=ZAO z973;2E!1O9*Q&Vij8Y=D_G!u@J{NtEz4V+hd4DCiK6n^{AT6r3qX^pDMygwXD%no@ zmb*>2&~LUM4R1Wn96mu#Ylva`o>zj$WYCP+^tMw*^JAAsAFt2z(Run|bkBML9cI5) z`NGYqSU|k}+Y!R{8tnf%(ovWL->;x%9$nf4ME))1cHV{*2p4?guzQqw2dEAX&kEjrIU3)m|%09&gs z;Wee6F?DJ`jcNdVZn9Ra=6U`?8Ju!6l}J0De$fUR!7gnlK)>fN?ov~1b#Bd^l01e2 zaCi^;52w4PWxD!+CMb47DN*vz3&Lxe;!6ed+NEUN2 zVDH5t%(r>WgXv$)ecSg27&Y)0zj9JP>T&eAcZrk%MW&LkeC5ZnK ztlk4`oZgjf4>v5M_|r&W@b@%6eb(6B&g-S%Q;&TjtM9Y5c(!Mbp143L!mZ4r6!pBQDX7q~T`;a|PK46@JpeyPMH47#2}&^Vm)8ub}fS|TRb zU>C)YA#8>f=)PvOA)LY{WeNsV!mr$WZ}#HSBb?ask_4l6;ekXjoYcfU?%42_Hv91N z1@&tdKhp%7VB-WX7T`l=p&1qU4{Q#bqRV?U>9QT%EFd=~UP{e$NoQju1T8Wc`>T)# z{}1Hv4uN^BciS0gik*cC+tRb4bQ;iFi|Y5v#ciq>a;o60fKqq(?P^L*JZO_?O03A5 z%c6M%;uX`RTfZ*4*>YtFVE|JMiziNlU}4&aaSJ6I)LDi<5lODu0d`RK%o$G!vgc)# zpHT?cf7)c;9OsYEZCh22=g#lcc{&>lrDX_c}j-yJj^-{&Sg9vD>P(0l_C`a=;#ue z=#inv(iLy~BQ}zDllyu@^X4y!AO6eN$~SS*Z2>j;S^O&xQ_~z*Zt3muq$kc2eze@) z-N7uX}!0mgaT)n_1#s zp$jcejf$TtvCH~#dSfK>TjjD@iHAK-jC3{9bn#?u(p*Q&A1zl8lE>;ogz`7B#!}Xq zCRaH-cg5MjRmQYP)~`!i7C}uh-ettRJ);RAie#lyB*qy|APwOslsNa>*C>?>^TNYa zNa6oi-dl!6xvpWuG$J4d-6AC^-QC^Y-67qGl(cl0bPNc{5JQT9Fbq8mFfxcpOLxEH zTI<`}y^sC`>pElnr*{Ypx)G6ZpgJw;0VCQ{*eE5#APImphHIn1 zlV3s-MV@qXp?5oQ3=O68UVLe%n5(MA5&obpKwaSr=i{^y7I|}MomWdnd(uz7)b64< zWb`zUTWJg0)D-$M0|-LT#+QFbmsZk{8yDkcni-F+n8%tnGUTYo&Zq>WTb}`xc99z> zB{vc_ADYHZFioVN*nbPUI zB8B6=%RM~bqXZbH%N zuS;}=Jkt4Pwv8M&`B)Rc3WOGY6?tdP-nfz8@2SWjqgru%^POnKC;5rqfU_57{Jwbj zohu0LTc?^hCct_U$mZenvkPn6&ew3g*`_b=d^YO$q{BCLkj^SBZ zKJ#H*Kas9#ff{g^>|2?@{-S>~Kl91g z&E3*N<{E-w`T7zQlXUj2!X_my;Tit%r@}A=0Of*vw^xLHZP_l;V|%VWB%Tso5K#XuFJo)oj(eDd+q6|=2j)#UK!RIg+{Q`V;WaTwd}!*|y>Jo~>BW^jc97LG z{@Auogc6Ujvr`odjV{3TRSfv_wL-|rg;j@GGk)f{U2W31C-)W%li%X&4CO@TaYf$O z>*lt~ITG>;b!R>^QEH{f?Haaq^!OD1QZ85ZCuQ*MmUqOvR2O1A8-zQHmZYJV4 zSbq^3m>r`J@N&glA8Pk7T|f1M1?0@)!&Nn}439RV*m-m&YhtD-^N&Vpk79Onb(IrdWFl(ZA}BD6e)@<(6iAo%<}WnHmjqJ}~ zTD%5((C7fs)Y5n;H%XH0G<|CtbfiSaF3$3mA>kxEr3odB;?0A9v(g_uv_uh`Ifo+V zUYD|sHvPJVTFn7kh0AQ#>ncj`25c+^!kw5+r^`-@9Ub6U-Pp(zkZmh+TlNQm8FtxV z8*HH`qtjgHN_Y}zM@13E^8IM$kfiepN(GT|n*E{zDji=P-Cl)JeE$*5{fj?##={j& z#{KS6uT-u>ARpL(Lq|S_or>k!w(ez5m^Wk<%N-i5NjCp*mj+xC^d9OM+PK4+8&+u3 z*w9;IH};+TfO;D(2cH_n$$+E-;Tk$$Y9NF9-D;DOCA6C}sFtT4zAqmCC?~>C;ZCOV zIt3oV33ECjrM^$9gcU`hT*`N0=mqR5;f@{C;O%XcfKxrHw>Xr|` zQH#A^!k#eAcPKrXYO*AuPwtTplL>#KiRBle)#6-tQ;>xhuJvRV5 zDY*K-Z_(tOG8BH4v-3Kj+lS2e*-G&0+FQq7vEo(1s1QYw9)V=aGS3rH?p5;HlcaM= znuVV8TSiUK6sPc%oxG6j51G*6#_%VOk9a8xG)m%k>ir2kKO@^yU}&ewDzb(J^)bsl zlC7QEdUjYnPhK-km-)^>#Kwsa{N!+^WkynPj!aemPT2`bsPO#rbkG0Y^y<>%x zCAgx7V`-G-v4?tB*LRN6i!X`sFQ!!=+J%Uh>mv?)D%jGl-(BLj*WmNv;tUz_`!HDk z9WP6e2#0ReI{VZ~4XUsEt$*6Lc5MD`@xqIt4jhcUC^`1v@L(Iw4R+&S$J`~3XQY@X zd?}&f@0Y?$i61=9>r~Jv=B9l+$t!zkZ+e+NAG6z~T4q3Vy|uH3(l&rRkypRn(B7@d zfx}aKH{)RupAAtWpCR6%U|F&j7)nAu3lV1=_^$-;4{e{jp?v<`zxvx!1;qZQ^q~!Z zF0V@~!g4*xL??X*>J=`EJyrd6XT(#pZq6W0n5LCe8WpGwV^4t4dzrQvjoRbt!8J=l zx@UOY6fy-O&D&V!1mgDs$E{}@Gpux$y}m(x3~OfTp^^k!-R|@JzOAN;OW`5YRP5h( zg2eXy7f*6o~}`$ps{?H`DhFkCGE!-vaT?3de^4#@!Nm9q`?!V|8@L zlG%`_Fl$9pItqIihNNx zAP7M=(Q^24vY>jpOS|C&OJ~xzmOe#cAgH@@o;k0pHepTP-*Vy1i_67d7`cfF8o7%3 ze{(U|aT|y^O7P*8T#ui*eER7}$TT~QJl-loU_HU9ZNb$y_Pd^wP@~=`1Tl%>(6gP# zPyJ}e+D+6X7zF4vdPii{IWKuTO>R96fEvf!k9D4Y56o$7#RHF3M25KZty^O@xol}8 z#r}($y)OXSOMZ3wE_IgaHp!j4ULDias+1EZs#n&n94_m1Zx(?KBfL-4%DD${$W`jd zFwCO*zYCwePJMOdllU~V1{hOYxi88?6_*LOAsqt&@?U(Y2-1M+R(nsn5X45>((z`U z7>g_M@O=$8%kKMbuvTU;xb^hZU34=Z$}cpepxop!e)+J4g$DR%&_3;5PR_`F3~)8sRorgXvuQjT>j&C z5No`K&6M@Y>n+RqopVt4o>v*N&EceP(w(~MCeUJaLMNL!YB@OPEx)7>m_p_AaNZ_N zZkP9cl`GPKz6#K;!E;c-Mp88n@}KnyNH*<{pNi+ukiWzHm$S%zHOiSsqU^Jei!9_x zTcBlvJXOZxIHu|GmhfU=2O;~3F{PQCSZ}A7>oC-yNm1MP%)me-f^J+xgGNjUhSW@d zvS52H%PW1jYp!SMT-Mz>_OxTc@%?B|!NMJk1Lnpdk{oDND6rSKc{XAfL z$IY2%t1pC-jH>=qT^(!SG@in{jr+S^c*t|ohu(TcPjZyIrJE|$TZ$m-&4gkFjRdiE z_N|Hr@QHJEVIs1Tvkx!mdB$2Ad#D9Q<75#czZO&ziJhZ$>!(TI_O-6+RC+4ye`qfol}+5*ljvOvp>nafZG{;@2kHf~!7_M38X}G|o1t{r#}p%F#`; z_I?LElGlkrr(@}u#6$(@n3hKC#n9l|x%bh?Mu#jxbm1W`@d13G=*6?8rkhg(P7D@5@^`RNq-19{Lyd(hdrAye z^0l5ZpTIQ6xH~sop)F}$(aj*&cL3*T0d~*vF_#S^Sw zdm`U-9qBBqZ#9C)u(Nq8IsEe5uKO~xUG(<%^WOW;Wa=vY>*f1HqTG005PB->PcNaE zx-l%scRN{qB091iPQr;M-asN;Z1OVbcq_h{a;%JW@YRpYqN?e@22675A))FZVX6t- zLUuetn)lNKo$onj8;Zn4D9;9cE<~l@iRv(CIkCL-*}(SBg-inMbBTAbO&~uFi$=u6 zQZ82CV?AMQUI1IRixmx!I(o@YANohViV! ztL8ncz7*+j+=sUC_0L)*D$zb{genky?&*0$l;yW5LpP*)!#)i z;+V;{k~U)}3#2nQWBnYQpr%>XqSPpmOGOieLFX_J(DJdWa9nkFd6kamG-~i=EkqlM zo#S?s48SAR5=IMGm9Q;N#%@)91HePuu;$2VLw&We3gM=7)8clS!gC|6U(zi^a(d*@&hp%9 z++?wB-c7oJ=3mx;28VRNaKBF>TwB-Ft5{{1B@&zG3X%Qo@I7!I0^>>11Pt`T1GL08 z|{G&%YkjDxWRM`bg~+A_RK9F6^VyRZ>VS@ z;JeQs2eO#B;FpYtH3}Ii4-1(b1T^YFrYc%%Peo2U>cNk*ja~RCq+rUfPNK+i`t5?T z4(!=S&sl(7jkTPmmmD=E!tI@9t>KO!d?{p-1tvnfK}(<4WqZ`&T!))V?o&%BcRGZ7 zQc!ENfeI_sxYFf^Z>n|yL|g@!Sqyd(fkgsHYMrjS>#5kpN`h_AS8hC>0s!n-3KdJE z0teAUcBr}HEbM+-smTyE+muwv{PX3*t_?%^4qX=8={P|rV_+XQW~J^EIB@3-u16Xx zUFPDbO!mW+`4o%ips2K7B|4-60n@9|cX7I7O_hrE+ottMsHb)Jv6*&58tVm2H0@e} z)Jar4G1P`vtq4f*V^{tBT{j={W>1jBrmy+!Kopi-IV1`i#fIzk1mnjAuykb11&l-Q zBTSRK3bGzX(}9ynCC+2}}q86TRaXekB;4a!bIw_Uerd88rStIC2HAc>1<3yG>Q@ zp0(qwNPKhyo!-37>BaejXJd$xzj<3Rci4R0seZ9tayp_~DkudOzg5%xy!_D4M@^6K z)^1^y_`UD8GQ1eCD_~9`Y^GDFWGTbxapfg-AqOoSji6hcj5DyQfG1nH>Xo@%U60mr-mD{#_gS|A z34qD(_9lDR;yw`n>xB)EIYX}z@{LGX_se4&Y*Qo%{R>VH!$)V%dT(I&M=Ra9!NGR<&K(&E zOkcN*d1m#*)9ITNT?Ml`N9k9kLmj^&IbvXqUOd}LlPWU@u04ilhhAlExxQhC>G!YG zm>2iXzUQXw-5hmm>|t^i-GO`WK76CHpGifSlJiD8@=g_l-53M+r7XM2v)dn5uY_kb zU84W#bwowd2L~9iPi0RNa8;H5$|rEO>@ zuuH+35#wpPN;65R;pl6gyr?Rje5ve258}1d9QKWD>7Yf5v{n8^nG807k*kl#!gMP3 zUWAZYm&~9llhLQvAf_yp=~iL+_9B>@zH$=ctW{uPKDnkLu_~&lj(oSK6fEE4s`;Vc zH|g?=;B((**Y`vN++)f!Uo-I=-0-gCd8=ZNg5FL!xU@|1R@bIJNzA;`_Avrh0BWSw z{kw#RTVv|fqai=ZA~uKy$jjie3n2}!mPl{qpOYqgxd!&=H#9UjS4eA7iU<3(lKLWb zSgP^^PWpPpgJ|tJ4Zg$aS)>n#w_H1Q-M5Z@`~(L(SXsZy3pQyRU;FTKXmO9tOvys@ z_UJIsTd)v6Pbg2!ba#PrimY*p3M!uL=If$&;4EzLYRL>BD_`bhUR@hwG$#MdRy@GQ@Uy_z@XTnY+xl=5>*c$j(~(BaOy{u^W8^`8nJ0A+Q=fwYU=n;` zJgGooBgChS|H5cmfhUq<>$!5uq%fR!4wtZ|z*09h=DHbM!u-4E5E^O0fj!2@HCMOG z%Qy|*(O_Y?Q4_ku~;uAx)}MG|5ncC5P#AAJM;yvQH4<|m~r-$O}K)O#;}c>@Kk)S2N>8RYSa4zAiL2`t*D;x76%t~b$2Ai|^~4^r`UsHcl~*BScAAeVknGtM%O zGyO23YyM1hztd%z;|)ybh3V|`rlmYPsa{(=BObn)U!M|v1_cf6>#Gg&<#YIlY+k&d ziOx#}Y`QKyt_@0sO3|nAugmlEt*(hy+QGM3^4{fu>a2y$omGpd{ASE=M@F_>o8qxJ z2KRKc=)q^TXo4ldpB&ndE_;EU+!t4Mbs@sWdyTV7BDpVL`v_-}5X#N5gCJU_6%H;5 z%u4Mbu|j3NAlAwItW_tl7JXKWf9$RwZ2ibqsw)U<%dL^IptyKI?#8{1kC)JN;4Bex zLH9Us%%MNMCD+vpPm5|C*s!`F&qz^R>u2$kM|H;HQ{0t}Q1WPzOJtF`kdDjS)=>Le z9lmgb9bi8ojLaJZ&pNK5ggbgI2#)0C8;R;g0gzOs)@aee-8TETs*>J~Vd)pds9oNw z%_RaG>vMdkNtc49=lbjNTyBs=ovY8>AigrZsgWIM6Ka~E0hgEPJM(Ts9`1VTkuBLJ zP2OieE(lO4rT(c9_)$8{0$}j6ftHQniKnb1CL?cq@h2s|y1rDeTIF|U=nGSh6v++wbhyc(82 zSi+zt19zo|TL?Tz8jYuOqhERz!b&)aHHl`L^EQxHs*$EXI`P6jllBeVw?}iQi{ni% z>L;vgP60)c?jDKRTBpi##F&52XKz&{e%R3|%texCan8OQODj>daumF#tk5mBlf@@z z4Cv1ts$;x?u720`WDOXTva>ako9F>j9h74g>E3N_-&YtwVcpKOdi$HT%~(|(aAW9p@1j^YSx>0AfeAet#zH*wxe;`Z(F zmOx>OBzY%bJ?Ue#;km3P(kXY{37L^oFUq7;*O&fe@y#K2{1h8$HG{_PZN`P<;eJm@ z=B???O!4v#b@^o~M*)Y&40#sz14RC8N}A9N3zcvgJ2{! zCdp2q%9d!!w}F+brH$e9*wxEzXsxIs-*T|ECT*Qsw59~GFP{})7k^E*d9Im-^^oI@ zS0X-H(l~=RfpcH8=HL*%}i%ZOq1t?mI7Yu2-H4gGG8(EEkij>$(V<8N+|%lQW+CrgjkB2%hftb*Hn zbk*MdXu`V*2HY=WTy^I)K0hmA?AvdV0zoMTN@NGX*g>ebhoBU+&~EsX@a9MOSTx~Z zpZ7{lPbipob6lpCvG!jNOHvm4h#_uduqv!VEdNUja0c&cj#icNTY35^xIqX zbjuTDO>ogw8f^@*cLo$Kndw*ivLmBdY}Vc51J8gDpeE_m_L`Ju5s~ z?asm28uZ=*TNxVa8c#=LnV(Xy+mdS1zIhg>TD73K5ipz)=c8V)|5cTdETygUHiWxq zVkW}!qi#6|N0}&iN_yBZWhPg<%`8dIX3DW^YR^{tHMh+A!!GyGoqg+^-Ut6?JR~5S zZZtr3(Exc*HAPTX7M@u%)Q{U!-5YB9uzRd52k+GyqZ*TZGgtjXLO8QloNJ9V(*RB_ z|JK744(XW++rCp!PaM_&;E>$MCV}m@%@n9*xce3BawUvk7CRX-@*FJBevcht_mSbt?Ln5SJzY!;6(0Z#J!`AgPu zVo>@hjaj-)3j4Ujkyg3Ec5S|ytZNVA?pp2ca>LF zT5^wD;uOpIjGf~@P^^#h@x<98`;Xrdok1+*yW>C6>FG)lsw`ad0kY(&_YUV;efc9cKGZv$;Lj_k(Q@j2YWnwq;aQ6qg)fUZR**v+q~L zOsGsr@*sLtnlE3qLP=RKQ&*JVgmq++jQ8Ol%2ZK`!sj?bqgvPV*euN`4%?OtWXY{V zxAfbzl(QqPT3ZMgWOmA?lQtQOrp4l4EU`>7f&nKz9o0=_4uDG#_APO9&Pi>VIb6O; zUNaP9C7(oAFFLepC^TAx>8Tlgl(=ljLfg68D#_?hbM1v|Ul&aemLBp}wxHWwR}m)} zXO(fp_JjL$rBgc5aFHq`^IxWc#%Zdy(_46{tGIZD3_671jr6Lf#OqOA(q~t;ygwe= zM$uyezqDLx3icnlwoW}T6PM5={)#z7(e~ZvUM^i(?CdgU&Nn03{qYbj!aa@x-kD!_Gn5I z_eTooax==gyaO6iZGo65Vc3Bj5NQ2}d8sBc3vPCzg{(Vm(XLT5?`t%R$r+ z$@0S=MWXdrXWvCHwc%MQ9iPhBPZxz#`05y2t0e7ZftH_!LNw|G#rgzSWAm7;J z9W;t;7b>lcw}Wm@RwAVh5Xpz_3 zwNRa{dS_BymYJf_hSm0=n0G_N=~~?69&=wD(|jIHh^$FB=u+@s5-RyFian^VtY0ln zf2G9w-CE|kG*hZ=zn9o1lhkVl?x$)qwBVF=)MdsuX0Ttri4WYy2)%`0aWHqod8n&S zx4yO0Ob-@40q;;i3e*!pR)rL#v?N{(-O~a=&rY_>D9F&z;RaOVw3>JfR0&P3$sZ^> zo3XNErUT`S(*`L`%E7b_-j{iXl@EV83Kl?MC5p+XZ*mk?-~o_u6L zE_fNe$h#6V_UIQlnnibsovUu=M_m+n!&tXhBU=@=otuF$xgPkIOP0~NLkll_?^I8X zeTI;U-%GYu!YIRwUdO#0oyoNVLZ~A%LJ9-hHob0b8?lWdqDcE7#dI@XLT0UF5Xf@5 zN&o46t5X}b#?M;UyI*wHLD+0>o}YM}JvYpudHIJ33L%AxH}44D^d+y2+BpJjlv08b z7G@A(sD1FJbXKf>5OtNHDX+*T)rNxRs0DYDA8_i*fjN>+LYO%7 zD0?|RI>az?ZIYW_6G;U$3$I|^uG@bPQ|nfLvGk*HS)Pyb+R>=`+1=-Lo7>@~6hOGep}}ron{*mhox)-9;IukY8I1UWFFx_3g`S)*td*ejuuxAh#Hg zVh_?DY|@)}WWDlFUDOgGGU#R-X-B69TtVI<0rIKfpo@`o=;ca$Z2zY`64`l}WXidy%AY8&uY$H)L44<%>8Zlhng)7aDbGa@veII}7z&B0JIblCF2*6 zatJm93b`~QNKR5`tGtN<*y|K(J?F-Uy$W@neW38bzm3YTGjCUEW?iB8y1Z9&%Gy=N zO`x__UttQ+4Um&2xsApm>B-}j2)}vnkwkg$hS67K36E@LF?4>dA~1`Eb!Mb}sv2U@ zys$Fi5M<>*TiJFoWeMVMC2gcr^W!5u_8atQx`*AJNR> zu?oni&@k$Pv7r@9&u0CNvLfa=VhYSr5B;5$k{L%|pBZ!2tFP&-Bf!Kb7q10LPp~Nl zJ>Af)r=wZJCh{NUWv9NfaB(NZ|0zWi=;a71svK=uXg8{x$V%H;oRPAq*JlDllB6Rs z65oYz2W)^jT>#Go@9kxcD|<{K*Sq>4+=w$>C#|}8aME@l2S%xRonMg5059>3R*M!5 zWUir&kB{sqwuK?Ux3%B}Ymm)Bnw=xkTin>Ao@k&2LXGzZ5#S%7Pr|(=?bL1VVGCW_ z8&VT5D3|JcW3sVo-nuZyZjuRGGAHp3;e9RUAx5EBhi}xzW|p6YNT`w`6 z@765`XK@#(!e-7$XhI1en1>xLl-*Sy_jBHF7}4G!8pTUGjvQ!ixZm48E5%l-ED#R& zygwYg)sP4X$t_JQ6*;E~Jv(%;_76E4Y}^wSy}pS&A0R8u>1q!?U)iwu2H+KDI^P!$ zy4ft7pdPcmnJyE+`A@taDZM$nkdTm|3<^iO!Xe37>ctjRXUW94F+*v$zdi=&OE`k`$> z4!b_x1j(^1cWT`%hP-7o9h?ws%jOkCT@4#Fq!TkLdzokBeb6>jeehTNQR(mYW6MB) z%THA{Mz}#?Py}(lz&`O}r+#u`vR&|0&6ISydbG?-WlJxkyvV|@h9RH0ifO+6PIo1C z6rLc&ZSpky#d#0we-Jy6e#tBKG{%2^_w49{|M{^+_$B>{dG|bA`R5T``txyVCA~a_ zw_GmgA-$)4JpcfMb?J&ScI#FL){_K0{mK_fk^P%zm%XqkHdqjni@10yn`KKrQS`i* z@vVk+E}e=)!Wy|8V?NKId6J@WbxU+mu)Fe$c-BMSKyqb0Oh!3ET^ZKOvK2uti>XXTMWz}XIkRVg%UM}a*E^d}aa$80LtFaz6?s;`Eo?6)7YJGX&VZCj<-G5{jU$~Ze~?vXOc1uOw{zN)-fdrczu)fs zMEfFwUMeym=CyypN-V-CMwnV7`&cNXOWS>uDa)6e2%ZBUfI_=W0uK(#jTc48hRwqA1Eoy_3 z$%KMcCr!Cjyr5Q%BT?x!@?~5WN(greCxaihTbBkFO}Pg~f<{E~MtLu%*}!_aY0O!J zhV(wv@8;yh)wsJW6}7%4IKT;?SmeVSG+8pPAJh0a>c%4t-mvQbK8e1*-} z49ZqE`K)djBL>KDEs+eWCw*CK?J*|@Ez5U1jfm^E;@h8**VzfLug4W=n4TVLNQBPs z%}HFH3`DyZE??6bI2R!9KWG+LMp{I@zTX^INt;-LGBU%x&{6&U&-5!~+j0b5tqruq66|pm9DF~XphoJMum@Q2*>Bq2sgDKF|Bw_fJ?ks^o+uxU z40~xsG@1F&Z=F=R+?Q%5Gjgi<6mewOv#zZNN|*TQw}goovvRBYH=9DRqNRIuSvVP% z_@LYtADBDE3U)?o5$>f-_#NY)mZ{a}fSu(|LEQ@ngJ=)hf&>FRYQy`CPkGB#RC$UKlU{=Qx!$alYxw-%;=ORV88)Vlu z6(u9t4-OP`6YI>KP%31VCuDZSzNIYsQ|=?@(>t%l6;{3pUl$_A?5ZkOD1W(eT}_!? zS8`Y0EVsA4C(cnA0#Hgq)(kWda{kz)AwjI0nv`UpOXTzB=95Y$+q$+tST-s(t&5Y-oCMa>`kg?C~M39|o&mQ44E2 z!~tsaj9GbT{V57lD>$SzXkWhdc2@oiuB`Rb!%a>9g$6QJYgzw;gfx?ux3KVyM%88fJd*)nYhn} zfgTPRI-ZmdmM`srk}>6#g?)m|#x_`5i`*!DBg$|wo1l@Yu1*v&D56Fo7 zkQC7Xf>)GN*XSQ(ZTcnmhY{vxW|tD*3_-h({Nz)A;-iLqmswCu5@sb+!S?8&y z!|j(>^?#dTpvUqcfAd%Yq>-Q4hRK3rbE(Ttk}dg_d>SPzS0m9+p zdcGR~ADDYtPFGc0ZXI|Hz&;}7@84+p&93ZP>l4ENFRPPb);AHW$*YI$@ZGaF;%IlD zVI#I)Iw(jgCL-*6Nc4a48p{6aksK4C7vLy3kWxkmb_MSTQ3?6<94eq_jE)Kak(9Wvx zGeaT^xtTgj9k)kqprs&jj>!|t&a{m}i#zZH4p7~}CKC~|v1!U>;Dir^@7m6~&DP<8 z8~M?LW!~^cb?`{kLHLi*YXodSpB-_pR`Qf*L84Vr4A>z$(Pt>4` zMcOfoKM)X7qxIXc#SLXV3OTPp@TEUsnQ##V&Ty2#iEa^k`fD#1DI7zjbBf>6r&_g) z7z$Ee3^p#iBn_qPiyPOf|GY`ym0P;rw7I>!7qfk4A&w)*LG#l&-KhIuq5FNy@_w87 z#f^H}{tc3bcb|(dCWK>O?IZdW=k|v|uM?g^6@fa|>ehbP=`m+O7EqGAz#<(8Q((nOaiR8rhuJAES1z$WC=Q7FxlIc@EGe4UfI9D&jAF2 zVlq)=b}AcF5-%$EDVD+@SK$NMh^PGkmX1^&$E?!wmJ95G08-NEzs1X>T`A#Q zNK$!-?8nh`-Akp7;Xu!9C*x&pMhv3>zW&z(*0YN1xS)aK*O6+egS%mkFQ+XhmldC? zI6Os$iVzp8Tv=^!$$b#c$*rB;C!lxARAbVv(M>DgNDpHphiq^wHJ2E1h==#S{@*K0 zho>*g%_CHlL@ajUwV5KN{~IbQI6pr6XvvqI5(Cs=fn3LH7l35oyfZutHJ_4XIvjyD zc8*2)uT;ywDXYKVL;B`1+n>=}|DJcxkvjp(|9bWRisJdtMP-r&U}Xg=5>)O0T%efx z)qaz1poTWMyBqG(mmPP16PW94e!^h=V)ekBedZc?&AGcr-v{RF4=P+;-rEV(^w|+i z=1^&gu6M7rE^{&ra}%k?Uz9n=3f>H}IZ>u}G}F9E{<^MUUJ`4CFU5P~Q(rico+I|JQbCF_gpxc#? z{!|pe{WAq15Z|ON%S}e9+8eY~N(6@Qu6WJ|ak$D|OA1NgD@~jNi?I1FTB%BaHYSss zXYJ05uh_td$VV}dSh1k=X_rh%a=W)mprzO6W&Js@2+6;XDP*|AA3I5s7zXZ=-;OZH z_cthV;m_CVbnXlLlJ7YzP(~K=vu{7cUflVEk0x+S z{}rv7)As*)S|P0Gzak?goGIfN=e3`M-`xu5e+cvy3%(g-s>0}Aau=X*nr$d3!ZN5` zn+LkE#5uML6xpRso%ul5j(cx^rf++8$fN+#gmym(UPY!z5D(`=s;SkqTC7+pRqE!n z*liH>|NG%JWR?@hF#zSaUxlvg9%j~`!iu=@6_i}=L&V%FHa~#GHuGN#K81a&J8i!` z0AJh2s4^*?FYMPvjt2DjQR;fN7I@eaO@D;OXuogCYh=KTZ>StlZfziU+}P3Q z@_6LQ_b&>^A5WVXL%PB7{LkM3DVIY1pUdY98tMN&#@_uWAo}65pySwY4A-F?uhX4VB2X_W{3GNy+!QEX3f?I$fgS)#s|Kz*(zwdul zuj5wOAR}DEysOm|wL&yW1m4vbc6jWV2>dV)EO_81CKf6LfVf6p|K@T~WnnOXo7k!eJ z&;lBrylT6Vea`BMo!s^O_`#~m=y+xP<8iO=KIZJYo2sX(nY*?pA)gjuR;K#61~(6n zl{6hsq+KTDvd{eOyEcquRb~gKUru5xx^Iv)I3Elo?*ZP&#l*a%V@pef2)6c0kQ;8~ zV{kaBArcCdhM8K=F05GmDUDOgbZv@3LWe@<~((rl3@oPXbMr=xsr33&c63aq9J{j2@j z7KImqNf{^m(+!SmJCGIHo*L_452?MiFzUVkdk|)BwVrsQD;NbDdYGH_1E@_3UL2X` zyQA7zTLKtgsSd`9CQM$Y0!4xWL`Vr=0V#^t*-FKo&|&mA$bPlOB4(aW&Rs+erEDl3 zfwc=)DV7T=)V05`|1f&TPJE4z0jXb4Qg z+d@Q_HkQ7K=?egJlrCvDf?;iRcXW*Gx@tGtc=e$g*13$Fzbf5R;|~~joft&n>K(6d z0LV+SxQTke*DOAgkF zgrL4*9TH(TeQ54&A-ys!8y9iHZfiAu3;80AFiDBiyJuJubNqix@I!Om= zqEvhXeGUGSlHy{vDAJ_Rwqm!C0n6zOrKVJE3ya-N=^xtKNf!n)VA+USkV9#scd!DN z7{$#f9N%~I(NZiTKJK`2tpZC@3kF$|f_YNw>7rP?Dse0OtTxvhrGyko)l zrk>tzVK&U@lZ3|w8f4;QyDmsMDkUT4g`Rs|`$GtyS#>Mg<`6uIP*rB1i8wU@C&NV% zez3112m#Uj^$|-=QL$rGJE_%XX$03FD$kCOi)TJX){(W{bQ5LPnGZgYAm&M=N$sJ3ddD z)bkv+uA8ZrBnJV*$1LkV2G=f-sQxDBR|I6$9+($EO`5xYg{oA`M)M#W?48ycB#nHe zb7>WjO%yGwKCU4MCOG0X{} z=5^~qR1*=%(q$2#aCBHR*K+AM@?+Vu1^?}<F+{P+E;)Lr0rSr^+z%QxTEjC%-T31m98) zE1S@;OM)sk=5)0hZe=?(88HTMCX|)!Fm%}n9{e~i@a!_{(&)$GPL;WW*VR-UjpB5f zTK8W=jzH6$Gl=~Ku@7d`Y5*KQ@DDf%d3a$qEQ6+YEoOoP@qF3XG1Ch{rTk1cL2^_a z+vrhz+2u+{OV-viAKlJyP%JrO=#$H=CyPGsd zy5!>c8D6@jD^z|qFMiQI7i-FPE07+Wix4r2xLw+&uIMMF?>yC2bv)D&zSjtKZ&WLVudZcXM0HS!g7a+1H?9L^S<8IQNTsv=#FnJxrK z%BKSt@-Zl~r^$ben45&orG%_yT8Sf0eR#9Wy|lveFL{pdM5q3;^(FayWA>T@K2byO&+UXj6wj<+7L!}V@+anG44;! z>73Qq$1oLd&9xc~3No_7!uVV_3=DKl{ufd*qWtj!>UQzmA=QrX@R207mJVDDfp6uYb3b{CiZcLg8`d6FZ>a~gEXS892p75^MRVd6&yIhd(#o~i+H%y1L zDw~;`lLR*;)2R5I&HVg2QNGSh__4A!^YIM245#95f^G!e3mjI zJ;t(Wd`Y!Yu^I!F0j@7+z`b^xqgtYbkU#dA})_3B&!^| zww_{i3^_#Lg@8LN=##--9t&-ELROgKQ9X6LUp>#8P!Uy59YEU#j&AWkmgemEhP#Ns z=p$|@{lZ_;J%i4w^OjDziDg`pC(ek7{gY6DcR#w^uNI9e`fYg(f_|u0W0hXh$1s%MlJO$=&_7bHBL|Qy&KNF>(brmX_z{ zQZa=D1$&2rm3L|2d+;AICK+%GfPKdUJlK*}w~|pJD=W_%Ga!+wj%+DfTECL}=3CJ& zvA@?q^Vav1)#`aa#%B8^<+%YVdwct5o@{;}rEo(@#B9c}08hcgXJd+Wwd?O+tt{Uk6-$Q(y8yqM>caoi3a!K5#h4@#zbw`zuxtI?nC0% zx)^K3&(`|)Kb#96#9F$r$385D(;7rvD)(Okg~^Z|ZIul7$HKggY;P zy)tOy(4l50Vitseph{P!Ln><9s^tq;Cpuso$fK278gXGK+% zGi!3Bny~+@8%_RV;`BRt1qbY3{=7$A!Q*m0<0U_Co=ttyD&l+5dy%%{@b`@U&OqXozF(}J-+9gcesQ-Py3$q zO)f026XGcTAEkEWe8fG^i6}?!ZZOgB?(c5i#P`0a8hL+tozB*H#5nubZLa-Z8p>ag1J+B@fz)%n=TZWrS8zV{n6zmd%7 z>5#j`B_JRy{D6e>jEIOopRYtt#~L4FXS3#e2o2sS{<1UoJlW6q;Y_>W`)lJ+vOC1_$J*}wrb5%V<2qDGgbEY{ zwg+-dJHkUCh82Rl(@?*atm=CI@=i`u3$*)%8#MDnmH7W45?T~UcK1JU<0gPkqZ(XHae3wEIi2{aLl;JkZ&mh#p0!i^{dv&jXax%vKMSGU0HG=oq6SRy3nJj6lG;*?;`mL zF{MKbsiaNbI_p6QA1+Zxh?GQOYdJKduTnQqioB=NXxNNzqcvh=kJGrjv)G8};yEfh z`l}XAqI{_zLfR*GnxZEUoYb1FAV?Pa<;+yH!7YyVuU2MjVjj9??c-u68}cF>;c&0jR*#r^iraQIgK9! zSYAc**3bJ_bmSxO($l-2d9vcg-btdcYd02k8wkdYJA)^IgPrivCZu@Wbz)dFopEih zd)0cpj*}~13EJHrAGI0cLqFqPJO@1Ae-54EtXTy(o*4=eWQcj5CC$-`_BbBS47jzm z?D?H+OvAz4;8&_KLomyLX)RCWeqcWYevlzYY}HxQrCmhO?5Gxt_3zLP2V4Ss^LTQx zBNLvDiFhru2><$}81K#b3-sJc0cOgSg4~?=iMfD%@3-p#`du4iU{X^5$Ll;UnJmnA zQO~z_?`{m^yW1fZ{0{TOb)2&C^?gUT@{ianTZ(+|S1kdB@qf?|1%VE`l-FZ3OR7vi zodh%1)FJj#LDb~1dJ5SVfF!=bQ7SmK1TD+xvJ&nW#dOWUOVc2Q=gswfw(NHq2h|et z?ZXW>mdEMNte30JP7*=06+BDCeGmKgc*JEiD>}&cP=7Vfx}~Va5VS(2nZ2N+ zDEh@v&MGFm@5Dq$s!Q+pkjOlcM%%~$mb}~PF&zDPzUqrEU0NjZocoWXqd;Y5?AozW zg@?*fC5AFUVzLZzO`Nta3!alUj;ItB{mrc^4+i+2G{V^VivaKy@UjI!5ZWa5) zF243|>fD_6xHc&Z$?vT8Ba&!+81g+gpD`POd7W!5{&6-Q;@h@< z6>f_E0z{+>Y-SB!cKi#$VT~S2W-be^zg?|3ZLCco;51BW%Sj-|=zMf*f#5eBcP>U; zc>ft6WtUw6YFAR<$;L{xvgZ}~$@Sy7WkdhwADbquqWk@>eQoj;wZ;_s7UEs9ih62K zKnX3U=7sM2i{MtuCvs|=9&<^Cnu3%SiLm|QiIRKDbxI2V>%8C`3B0)AGHVL&fHfbZ zIS`mF#&L!rHkebxsqKd~w^^MTgn>woQlQs}H5?}#(KzJQrAk5tYSaO8;tq={fixq8 zBmJWBQ>REkd(n82WP2^e-;&=`rYvyl@S<7kKi>qI{P`YMX_II~8_lR`NWqx;?JrXk zNv2*Ux6@*!-thj-lZ;EO7F}a25-!1}>mpbQ0rNedQ_j1m?Lg+-r>^2)okol>DiazOB&Q21@&39 zyIe&!*%Nshq$e;1;?;kvKO1zGw+drN57XOaCTwF4!FX6`YO*P090N(3#lO@$tY&T5 z#L08~)#qc#W=+}otDR+jQmpg?sRZY6P?{UxnUn`xm}pFk8+<&k6@|u8m7l9=tf_0z zQIvVIAk3-h6c7+F<%6&qCbpwZZn*FV>qd`E8V!y*#m0#;QHjA#CtiN|-EvaHNXkzz zd2c?o4(yIz8QvZho1iG*MiFtE?U>FF02^XNkJ%w%<=Qa};75M8Q=vI(C>?;#W5h?5 zPw{ThAKiA!R8nEd#Jg@2?pA|jtslt`f7PsOLI`4FqZU;&}G8xjQ&pE z;fj|M*B%*gDY|}lk>w^Bm-&ReH#3aNwg|WkOQ=*SPLx=TkcgVIq}`q(S_P@mlf+8m z+1Yq*NOoCGQIxH@?rwb|(*AlmfqAy(W;Puyx3oxB-G8QL%L{Jy3!$ZzESj|YD~0dr z+mSF-|J6BGCt&+&VBW8Uzopq4ZE}`yQi6j(VVdywp`1f}p4Ab;=Qr`lW`-19%=-5B zcEL5$(l7pTx*kpf3Ccqu{xo>sL6TT-NI3O?ACdG)AV3*@JfSK*t^_59S%o-YXJ|z< z`0r-{asRwA)23r|1}3N{?u<&&0JUEY&wc`iEzU4QPAd^@`F?ttv#6P0e-2cC$P$sp zLXi%Z7EF!w4dD8RanP>9z<>k2DxH4@%ph%bp2q*__@O zLlq6h@*LldQFFw^fF6uFBIx4e!U&HT2pVO0eE1GFHih?Ac-Jvv*{U33h#~dV!cLY# zkVg4}0t9zrN0iw0;C`*6n`D=-ezius2h9ALeGFBAqY(8*+nkj{dGFO&#UdXuu)j1!P47Q<|AIM#=SJaoX0R9($K(6E~({s-olkS37#hr5G zzWY}rKsw*czln*PAagU)Uv!0=Zv}}3XL9>BD+leKeE9Ke=R}JgMHWMQgQV%4XW*9i zConA|2APQ0m7S|#TFg-M>57>e3Iyq+Wj=jf;gw%oUvDVF?!$dCV#fgbQYjS!g0r9PS>GpO3+#i9zLL-TP4OI1IN#kmAqe z`DNEJ`RNChTp^#AnVeI(snd_n&d<5YR|rP!->jJM+Pr-gsfc0+wsb1Ku;Dg_`7YmK zK4wLfpGak6#&kQ%Ttnyps?BC_p=B~l7%}xzP0o42$MZ74B$R4emp-Q~e?S*Gr5tI-h`m{(BtDG5 zW1A_gZ$p%oJ<+L2pzdsJDe5W1n7K}$ZZ_-hh{LdTT{!v>ezZ|z$)31aNc&2)CDD-f zqp1h|07nGc&`X@u5qS;-Jf6;u_u1_1@O#dhwkxV%Bl-)PMS=i0Ko*8kP;JY0(12XV zciEDm{{2sYWQM@QjdmXspW~m=&v8GxkO)`C*RIuOPNqEWZ$0mC>cGD627kcd)#*9n zI%evMu7I7T%vIg9)qtl96}xADE2izcAys?DI5c7Eg&RRN@|86apxe}>IIq|B%5;w0 zFlOr-guVC%HwOw?J)OIC*QM|cfZef&gsoTzF#nIh0-KZAx?)a z|9=7=qRXZKEsOl$v>5;lSBM0RER`idz8C2?8Uiv=PzHz!nih+Ph|UDg6d?pIMts~P zArL!~c)W+|pUCnL4b68OD+% z6-vysY5ob9Cez#N`g@K7B9%gzSE*Z+FJ8=Yiz83w_&y4msP99G*ef%+m#n(_^iR3? z-oU<;Bb7W+bPxV)Z6-V|RII%qCJC$r#UiPPLWwWgOr>scg-*cBMv9!I7Gw330XCCy z!vrq--I;%|>`$Uq42Ke!()U85dp^THIEPUz_+cxWlS%>HYfT!&#AGDg1}c!)>Ulfv z3Em&y53aMBE0>8TP**o`n?GCa5PRIgWl`V~Oy?HYnnJfIAlL~Ol^8LRLXn056f{{? zRm@5Zv|)11-bX$S369WLO>TZ zYnV6QU3c(QJLjIHZ34q>Vg8 zIZ(cr>W!8ZbfY8>_-IBTMFFh$vWGS!vhPH?p@hhCoPlt{#GT=Rs~m)Ji7fCY8F0)1 z76e#xMf7Z{tv+9Kg79ZwKylxy118=b_O|m(Bn%=lkQ;~&jTj=4L90wvpcZKZ-o8{D zwC>IBmo%bqaiIKopNWBUVSYgZa~GsbPn}am*=aL*oFoc9rbnXOyA+RM3Blb7XoWYy(B3)(5`-i*njPU{r+JU@Ns0|L;4y}sT5=Oo^ z8MM6iTas!J8PY=_TucT{LLeh7oyl*!p#PeO8PacCocN)#WW-+QAEHHAxI@Rt0s-qp zK@aNUU69u&ItT$hHmhQ9ck%W34G$#gbEZw-1e$2Jb>AOOI0GKg!@tgv>Za+;O&Ql~ zRAAK@8B8%R=O;R)ab!7i5x;<_j4cd=tinc5{zQFtbLC__7&86d3O2`h=**ikx&#m9 zeGglS?>2(^98EBe0SCiJs-s4442>Q2dg~Zq@u|s}o!yART(DC#LtM-Q#R4)hHm)VT=C4cHXzaZQC<1!0?Oa?eqsln|VKj zC8`#EyRGu31Ov@_Yz!H8)!oY>nhbgZ^hyIkV|y0_*9T#drIpWsL)p2o7Ir+MuSD>qy z_LgIFx?Q8o%g;AqP-_Be$s_%({eB$qdLtHauiMc-xFcU^F@q3yPQ20Z_@T`>H2sm6HLrF(zp;h@EX-p3Ae}_s@u1J3DeDo_&p@915uTs#n1Y1=Q;Nq~q-6Kfk< z#dhN(G=%?EVt|$NzdHf5>QrX%+3I}y^nK2zXtXoNOXh{Ucnj0DJV31D2(xy)?8yV2 zRB~og#$CsoJsGh{NWNEdFdLQV&03BuHs&y~KM^Sf4MF0tQTJ2HYzj18GICEmRDT$J zzKovui<{2Tvnh93D0dRFOBJ@5tV|FPCaK$)hgVb(MVyW-e^g3E7>lL_akwa9M~5_C zR??(I*4`l3Eh;ynXHg(*(xf;>nj876@SDav^0SZ*tQqRVgh^CvfRWmB6g^qo9~nk; z8_$Hml9=ygl09sGSAqD!QHR3@up~dL)E_R+J$;4M(%A)*qG#q6^CusIi6u2VLg0ig zI@*t?SeP{A~nNalBB+V^yUHeFG( zdU+6Ws#XnmrAA(OfYo+-e33%D`;$l}+#T3#EqM4I8Eirm@h9@bMl75#M?0c5ta>lR z1nE^3F&hktqxl-cEH-T#mN{Bw@lPVY9$yaI-BDtpF$c{_cUiiWE9UiL2nw{Q7c#nEJ(~6C@D)P`2iR*yhL%_q_>g)XbT)AiqBbfv5DqD;DyZrF>l{xo!rSWtWui7%0L@g?v z3-~_ZV&12L;7xhnNJbv86C1o4V#}&IpDoU`iEvKPDc*&bA%~nT08#R5GRW>8AyqJX zaA$lFR-sCQh9E;21f(NE27b{~`&GAqvH>+b$ITTZSF6UGspKl2 zgk4rzK5!bo0`ke_f@ez}@fBS^0XJ-_wKO$>)Vyww<{B&~aFFCZmlhTlLYUl`ZeN*j zkAr^R1YFr-eqEw*+)TQ6xlT3Ycrqu)9se*Wr*@+!Lc!>J;~T&AeA@+QQ)K4g#Lbv0 zPq!e;dvZH--}2hZNXBrk2%E^HeK~NOz&x$DV$!UBsS9{2eu|D^-q3{-nOR<5UR_1^ z^L=0IDkuo5j)Q;?5x+x3(;eYr$lA8zj?3V-fcjB>b zFK1YRu#lX}YfY>7vUS$xQ&BQ@4`OHGDz5zAq*io)vO zHRWoUX2L-RC3jo~&MCLrTc-CDs50y*xC`W_DALt>7R}SEhVUxZv%$GlwD3;JM0>!_m$TFM0rS+3}Nx&%4zKhg=Ot_Jy2n zP;R5c|Bx@P(&=dJ?riN;7^t4UvhADJTdbNT9!H3#O&#&JU&`_(Fene4Q3~oiy(Pup z;yY$NIsz6A(BoUAqVMi{WQS>LkA5pn8NGE{rJu`| ztz3Ev8nkPdrDEq`#^+D@U^!!$+1*-*z(1I0{rAEKHiIX7LMuh<+IFlWI{Md-rx`&@ z8FEB^?O)CONR4w%+Vtism$G{9_C>NF9uhvmw&9?#mqcj;%|*)wc&-Ks>PTRfOH*fi zuI874r0)+dtv3hgYu4O3pBA*|Gfq|FU=IJUYq$xfuBM-Ob7ZSBAG z2ln+Qif0Nn8dMtWUEA$7Ew7u|aV)zAv6(nHt1ag>hX7L6TcTkbrSvR!gbvp7x z*&d!pOi(Ghd5B-!9BR(Uc4BC~zcD$U1mWUPNU`o_X(hR_6cM<7w&RFqHATVqE=n*q zK6KW9nbyj1;ss=EC|cP3ls8N5E1YLmatL2xn#(Zzt|ev97p*>3Ugng^i;=vfVw)@5M_9{x!eGIYYR(HdvaJ9&S**0PVCT^$M}Fa8P4A~Mlub=J z1quHt4jkL5&GfHfmt9oQVZZ#WO+x^wsVRtJ-r^?avvYPI7*t{a&k%7|Z`OeIpdm#< zM~#VXMaJ-}bjE<`=Zugud^nn+j!anEtABAs{2m1+5f=G@oTm;Z z9K;e@?^ML1FEkle9y#o~KS@5?>UmCKp=6a1xXxvUvS`QuftR;(_;OCy*nXw8uCTDM zxY+Xb>DH~L6HcKw+D`0U=lwl%`(;e5s-dw1eR;A(U)5Ga=y&tHJ1Om0MT2{lu4fv; z{)sS1-}?Cxt2WT^z*1JkZ+1VeA~ zd-XKEbDRztxZBRh(ZWd1``q+W-)77^P`j5_ycqYI zJD$s(na&bIluQWEHgx~CV7mXFW&Z{?9hxElzYmd(sqTLcX#evjW|{py_1RMHh)Me- zClKx>E|U%#cI7II{SZLpxlFm%;d*bjOvY!*7T9YeM@2N=OV$YB>7&X+K zD{tC8fvDmL_HK2b8b~bgC|OM!m0hZ@tBT<8GQ?<*3D~)yX3E28r$*zWXm{Cc?cY>8 zj@fB%44p%O4OkU_rf<-h!$X~)|9&RyTi5{XB*4g$!EXxwlOGE zGsd+zN8ytBgQD-`;(YCg2hojGjwgkPmzEK|9XMd#vc+MNzuKS)Th(#d@21eOV(y#P zru2$~tKr8s!Uj?gUdAGY(_#4@qY8=>|3xw3tw9>;Li^YU>+w1s=L_1&)caM5Uq{xy z?_-^YedhZrTL-6@Q|(-BXXEIpsoNDriDHFK9V38>D;7knyY~z2>=Xw~rJ2B55MdCy}&&-L5|oI%wN3 zb)RodAgXq>JCLuYUFyr2`q(D?ppXNQ5=2{hjx&I&E4J;HyxkVw zq!{3hY3B}8yz}P9afiRW$y@2}gUP`eV~4$8GsHy|c>w~xPY*#qt1cPxD38u;QLNns zk1EDdz8oxGCNIYsiuhgW>FOd@Gg4wV$#DDi(=zvAc?b%Bw`Yq3WY{S`Pjo9?H;X*i z=J!0GeJoKoV)iCHorI2+wJ~EywF~T$?bEt7tP_Yjp$x zxixgEr8_N>G^+R^^ z{54*pnp(xQ5IKhR1kN|Nj5(ELXY<$usgxnP&!U8g&dPHOvsJe5)$+?2h1C?*sad*iED4xP%*#j z0hT&>+U*@%A0LM0RRzc#MtQv@m6tK|zOB@gS2G(lP+yhqGBth#m?9(+UQ{VEo&bL_ zC!@%1N8C{^*4qzNB^%Ud+8sChovMz+i(rro%_k|J3c8`3$kXLcHVe1A-zKYy5>pU+ zlpkSG3S~vfd7Q1T@d(rdN0tuuUIiQ6*YA|o9?o`oz-d*n_8rf;YdubOoa0zRPZ1d> zPuCwPPF6b0nDLkEEe!Zmflm7_bZO(}S^SRcO^)}?&1rV$+u6(aWTeEzYfVLEJ=b5& zdWmlY5e1hECRVdaBM=48TGo%d{XA?(dw7(+Pm&{=Bk8xQ5LE)Z?BDBb?}g6APCJ}@ z9hq{vyf>BPo~w!{GUJ{Xva+(yJkf*?Pi$;QW6%;Y&BXjy95k*f1y$wN)m&K!6#4B} z+umO;X?>dQKh~OQYBH>*M8%_FS|2UM--z%tX}^YqSWV`HMB#CwwBEn9g$)D?B0O5y zbw~gYb~4G+g~FN#mv&uqvdSHMUV>TfRK#I8m>4b?=8L2{tZnh`YjTRKtPBH$KB(Q(E_s)9GMQvx49{6M$+B!VoEi6|xKu1Hj~q|BK|wq^LmaxN zCFWx&!a$s*(}f&|fhGculSCq+(?ryxz5n*vFP{;sfNG{MjHW5-hmn-<5MX~EvoCy+ z%&1DW>$iPoo21J&5Di0d<})M2UH?7|{=&XP`-jkRC4S>h@6Q6x?K-ezN*zL{z{CIO zZoG{#_~5wGt(==ELLN^k*8040mQ#%9#d$Q+|4gn*5jgGt&L7$jyF-g2zA#IQg@KkJ z^}8f~xH2(O;%e^?K*XBt(e3a3Css3D@@l~?2&_x)nH z>lu@J_mk)PsgQX#j@8p%Y&H&gxBW6d)}OS~i1xf0+zrbZUzZA=mXG8g-EVGUgnfm% z|Ef9+0}sX%J3K@VPY(}|jtVud#0NJnhQ%GHibR}Q!m2Z2y-a=!ZOcISL-DrVG7Q*_f(%TwJK$PjlELdC)T2Q)7cEa%CHMEMAFW6T zt;hzEtMFu3M3!I&rLgx553kG9%N%YAC%KUO+d-LY?N>z1+=J85i;ctUg#snt=dVbZ zhD2+gHV+3yo86#9TB~pN!l!3lE^j*{W)V|lVs6JvVN!_q@o4w!0S`AvVY8>F_vc1J z?+2I3Ruv?NVd!0+vGt6hkX>VSRau&}f}ai9LA0LUhLXgae=P&y-=-mU6qM~jw$f?F zm|ap~m($$778EwReViQ<%oFV+N2u4Q1lz5@&YtS3 z7>Wj5E$wQiJFIpCOZ-fLr8VzgE$=gDTiPjwPgk4Xr2(_1L&+b`MYMz@_c@Hjd~R8^ z+&=%{h&cXz$>XDv`)NaVymXZeRETjKXCIqT(I5k%O4=;O()N^N^#l$tk|_m<$#&#G z18j-WkwTqy7kjH1n8j()eFS0CJ6!><8b38>{huqROjoTE3oqyl^AokN>wT0Gk3; z*UlW)T%q>jJP~DsV>|8|L&*_PjlbPJ3@`ZjoB$16qos!fe4WJ_3jD1!O-r*oI~qQo z#^UUVdmA$lT?tMZbqcKbQ10cnI3{X-PTCwwWS83rSWjGq)#VHdvZzOl&x7wjzNB*& zA=*Fls3%!8u@iNxbDs+9&PD_|ta?H9jTda@L<}QWWfCpj+L74lkb1U+@>`IKOj|~J z`>I#aI_{XxEH;>;=RRPufWcl zM>!~Kq*$O873RxbC({ON$Il3r+&dz?iPlX@NSu!_MQHvOF0L9X?C(?yWk9cVe@rjx|kARE*}nzb^b|!xx9~_c6k| zxVUgKgF8PsDl9}K?eCac1FpO=HN^V5E_T5Gn;)dnA1so~$$vKxg#_szNBlo(2^!A- z2WjR1kH#;k|0T`*w?gxuS~4tS-%EH12_Na%S11!LD=V9!v{xYp>m)$d$QR}NNXXh< zST=ogb0a>|+}!M(HpK(p#g5DbsRlf0{sCC9;-RQfiNbM%_VfxE1Ef2uLrQN5onQI&!omC{f<#M4SqKrEGx@=X~H z))w}@Vak)gG)#fP`6tx`)?T-nKmiOR0NE3Jnt{I1NM!}T5Adw5?$1`WQnuFLU)Nn9 zk)#X650gnGLk3HwYnfr|^Lr0crgw0SZAnrjts8l5O9mGwqt6e!=-|9rdWwM6eX!aN* z+Fv^(j_gqCOQV;DctK29z1v;-y?=S#m7pP=P4^u{P4U4@@9*^{B;EJQ$jAT~OK{5Y zs2ukf7H4OZYmy>Z_$_7N3iF|K5pcf>i6gY{1r1|3XpQ(Y`!l z8-(Lq72m2h6DEymo@2-nPno7yf zZBCG7g9KNXk?K%hqHV@+bMEPVTvJIebm)a@195|?1nbkb_dmA~Stz}sD|D*IWmlmm zzSlWMfq3GDek{F;xxlVMU5+?oOrybu&w_RhU-sv89xV}?WI93!bS;F2HJ3nHEWjd; zgH+uGnL<>YI5F6vOT%S|L^5EDw0Lw058LhC?J`-Is?gx`);Fh-L+%a6jg$#~bK)iV zF6|V6b^lmyb0lKKh8_JNm6$5yu20JE37WYb+moV2VBAB6`&Ahw&6`g!CloWP#qwPU z&E0lE-BzNLRlFBYB2*F@pkM>hxk9n{vL_PYb**YY3vYTF`w@S#h}6^ndWYZ}I%Q@S zsg^R``RyXqjAj(}a$f&$ZP40i`EegtlB zsv+IOH<}_Cey2x}6DB~GD;%5G_3~4jJMVq@6PJS&;{C`+I>KG4pxz(u#3T;UM_|QU zQZ8g+`$E{T0OS#0@i$?=%_Lf>!4yY<$*ZRy+nN&t8KYZrV5f}RgPM)L8?hI$|8|3C zkOVCF#l4U{%q^bon2(wO{#=q-V+h0NXX{0lK_rDFaTr-8c!)WFx5A&)OaDw{A&93< zLD^*~7_HR!b_9n)1mvp?8$ZJFQ2spqbZe`_zW-PE@zp}O%&}h#MdwG$sy@e@0yhtEnvqT#@_5DiPfb%+^Mz!c9ViUL5_Ns>d?E@hS=q^d5 z4t`iOCi!M-Jx9VIK*mB;6WFA0f0q2Hi;a{(`5KRSgd32mAj5a&(ZOuS`!f%Q8gQNw zA4X+~@^8SlNJN8!kOMt5x>`Ik4&%By^=UQSb#ORAqgwqt-?hS%u23j9&A30-$!FB? zKEp_~O-`0pSTu}|jg2m(%vBn9V30r`lElhFYOG<>M$G>_M8jZw&6P2<&r};qIC_OM zDyl=-L1@-8X68mx#%RYf-GhjbpCBS++0?Ft{|1_KpPXn8taI?iZf?(IK%RI4C589O zuT$EF0ygtr93*&Z?1!_C^ZZ6F7QTI;dM}{7*lJ}eUl>4#&`VBhN%Eg5j0f?N#0nx3 zd6nV?#z9JZ6M_}s4uBXeGITgW;X%`qGI(_VJ=Gwf8ASg=hG>Xd|AqniPK#maHa@{1 z6LH}~yaPwR_rKN?V#CW7M0tq5D3K!!1u-+15i}x95E0B})=pkBJfe7>Y9#XREu0b< z={HauCKm>>=On}9T;N@t!3*1-!DO&~bwJ#_HWLUkGYang>JBo2av|ig#f3 z?b99*3Ur}$NOU*HKo0=MkMEyh{3-Ru-Y<1)7I-}03YU`H3$UPLr@qwwRR!7tU2<18 z?zcfEPG^Q!Vg5CiW>p8e0Z&3&stm~}Wicb0kFd~-oTwBRkFVG1)mc3zZwv1ap1WTjh2qtEu09pQqY?<#i3<~8|E;{vNJS;Aa=@}dB8!*)so;P=*T)Jt!pjSIOI={o z1a}6!?_8T;y`NM(=K0=a;$M4lkyQ&O0t%Ab|J`9OBlKd^Z(U2ZHypB>SGZMa zPd$W#EGD2U{EvVrxd`&s#J}l7NFlDz|1{Pb#ti`&E(eIJ7Px>5*zyafulQknx9`j$ z+d)tcX~18@ys?tXhZPgrhrJ@V78*8Y$BPsGgDF#)ApdRuQvbFQpFVn^52VG7U7$F0 zg^=IWN{v^?S{D7mwEa?hgcDL--1y^m;AIID6lkITT7r7i`&Mh%30KIv7*I0v_0e*> zrT_(^iC=re=+r5`)tU4=iangns){*3;G*iF5W^KCmoa`pXfmGS!^K>%Bh{BLC<=Dk6;lm7LWa&xd}o`1v3 zY|ndxkL! znhf6=Nvb@29+PUEqgM({8qK%39VTXK#AcjX10M6lVux_g#BX#dU)<;G3qMxaF5+l2 z;k@s7_8@IH*NDBH{$qAzY%9v)m-1d00@xp)FngXKRb!K$29;Pmm#B(S-&Zb-|8u;Q zyW}clU!!{s^7-Q{&3<(H^bL}f6{C-slU%nAwf#yaE)9kg2LB7}pWyy!#kkP>XXexl zI8Va_qjg1|kN|rHsi~mV6%K+6x$*J1W)unkn!<&9DfS$6{&Mzj@o{NQ$~$C@y|K5U z;UEVFkb;?rpdsAxgRdw=mWL=P!pFy)ygDrtrY=G;=-Q;LnMnw_!08qGYl51$r#$20 z*#m^D)(kz&mkE+dxoaDvW;~u0x3*8PUK?fm=vGYhsy(THJ#-JqEW4IzO8srA<{^UJM)*w|Q{jK6c-t>Y}_{!NP{c^*eEH42EUn9`T3nIq8c)Jf$>X6C|%Q)_^ykl_&v>| z`5Saw->;4oK9-0sFAifJu~Se+m$(qqPbd>d=vO9;WzcBzC*vH8XrrUadX>pCSJ#xs z(KSGd;In57iU;+mcGl}Hk~zVJ{M)HAq`Q@ZdD`SI$1I}?z!-gJDGNV$3%bltk5$~U z>W)o{(sm{4?L{A(+vq1sD;i7bh5d6BSz(-yLtlyopetA_%$!&h2UwCP%{N(SH`BJ10v88z*B@ zm7tseL{Ccv6>B3s-p=jPJHZ#kea-!je<1`Z|2fJWrf%d+cy8~*+j80ySzE?I!)m-G z`xWgk@=}0g|4IbeGFx`g;Vbc6B`KnZY)lr?H$BLI7PI6;xoXcxAyEA3-DNZ@NIi~j z(|nZT5#n;Y1vca;i5p3E0mGE3P;Y&gfyq@f)SA*Ixt;QUc{MeKKQX$MyU&U@ z^7(u#*ZyVzDM|R}QvJ}vIWZ+T(^vJkBS1V9I^0Vq$PObzP7or77xq|y*#A@F3U`v~ zOl6RkTCDg3xNtK;jL6-qQ*`|2hb)@9P_P~7RU+L7!6)~_o&`*^9-AG%4@AN)Dk@^t zt^Rv_YsldVadwDoR8dvs-exErCr<}CT~HbYIKH!cKqI(+no_bAZK`?x+qtK?eWZFB zYfi(KRFs!8`55gmSF(nlhb@yQk!Jg9m4G@8t9!KR2l8=dEzjRj)v+LUvGRLWZIoz{(3S(-g=+EYyKvjm(gAFY9 z@TOr6SO|R(^#RnDKxY5Np2@J^Ymxw-J27f`-aC+wn#GfKrCfM25{lovgE2b{YA-rG z%zzSYbwiUMd-s~#hy?qN7ky;^X5h8~*-uW*47cu?MI+UrwBWZpY%F9uS`HsbzV1W@ zJT+0HbF=i&q84wxeE<4UmrHY^pU$e0=zuxvMA$g7Z{X_T4i z7s1_~)trPGCONFN=ptuK*xF6*$~!F|MSYo-<(#@?4e)NES7#*-IR(#ajOsCt#N_4F z_;Z`8$GvmoUQd~l0o!smNO}z5cLxC!K!3`|*5rwVfA= z@;R0l4wVf@+H-FQ35wp7ZOr;~RN7jGHkD&xLBy^?i!Q(!T7hD*#k$$5a$HwU1I8EY zB`j*lT-8>y(aP2g0s*?1)fY)8-^$RTHcj-0SjEcmOe+1a@j}`5_V&(Xa&Wi02AX&q zn|-)}3qxMeM5VR{Af3Qm&Ccs{U}h#ATy8d3=m2YN_g#(lz%y9$i{UUxIzwA=DzP6w zV~@esoL^l-?~4-kiS-zFlxLF|(n5iB#o9T$jx1ul_UE5SlDrTlrjRI*FN8InrRi#F z`b+b*QeUh-OFZi= z;ltu)F1%e23t{4eVa;w&y1lunUuu8~yNv{;Yp~UAX~>)=3zkEUv&e#nghUviOjd7X zB#_dF0lTzxgXxJ7J7jY04vvgK>137n?f3L3g;lun)Hb|PC+~Ba7Gb3j)gIgzT1uVb zBpMHq1C6Z-bCxt4P9`E0&uHZaBAgTc5@++dL-kNG@;&AsO<#z~e%BO>m7(^GYTD$+ z8T2OHg4AQxs*;^v^}WIzv_Rh2p)eVvpcBZ2vU};=zGD^>v_O&GiV71>b_cC{W=0ff zpEt?ccHz+kd>gwa2$Yp|fxJiu&mURJ+Il(?kl@VDD81a=@w0TMy7EMJOGR~Q9M)Wq zFWfTJeH)W%r=w!)__?dvWAQ)S$v~pxrVFb`5jK<^HO;d`-)U(ou;}V=z%9d**q310#qktlpwSA4>q3A=seEV0Tg*u2beBwJ#|_#!>~^ zk!ZptvKPG&=2^683aL@p(;*YaO|5WE6Xl$mnb?7whOowrE#jAsnl{)O3&!=h^TO*i zm@*UCZ5z>EMCu?B{8*}SbGDtvWrjmZR4R+!Z~Gz5uVxIpcImU8hx8uV_H&m?G3%^j(Idv(hl-kqPwy(u%s zqMyQrhOOMZ&M71NK=NO}<3(w+lAWv#0~sit=w-WuNGQ80>p0@2wK9p@v|@SW_HCU~ z#4Kuc?yTxY(EqkjpQH5@_gK1k!WM{_{n(v1%6Cum@7ry~ZVUaTTh}RJpOHP4G4h9`!j^#0d!}_CRVuLWi3&prVO7X-%n1 zRK$6I2D5$c-JhVPg~x#zB^}!jABx6a#^u$k;0k~%ZN!yB_3Lz?H*e%MY@=B_xze;{ zq!!!mcRB!KZyU~x5mTY}V`qHCW_Tf3PUoRW@XZEm4Zop@43z9_9uIKzOIJjsyL(r+ z2Z|=bWSK9YLwBUya=1F?jGCeVO{7cBce!D#z%vRKBKUx^*?&0Cm?$R`|j+{5(crdLF>hZdmg_59HTj7$-N(uXsz?ZzYiv-o~IFNp`3-92h zhQ(nc9=u^U7v2&rhZntRc`GIz8KKj725ZJi!;m`gi>B0=Jq#1PVB~NRyqPL-B-yrj zTirHnFafO0(OQNqdjuORrJ)c)JWF=iVx<8+MzW;lAEb24T(Gt6W&)BK62F#Khv>4R zmY%wnM(gBxwW;z5vv~1k=176)SZ;$%q)#7cBw_ml;`R2tHh%NVly+2FSCn;>TQ}W-Uw0_p%;5X^LIXK;#Er z7vM0-&K$1Zno}LOK^j#<>uXVCX=`hFgxVNO27@@vVULemHImD{+36BR!ttSva(Agw z-H91lfaIQ~t-M;2nxoap5Y2W9*v9p5|L1@Igen#Ic%h*~v-!{eoL~IxudJ->eDh@v z2?;4_oAvpsmz6~X(YY-^fNJ~=0FLPqDF7_5TwzT^tT;aIX%umL`>pM5 zLk*3GY38)0rM0=WH3*kqqo4GC6}1&{H6d*PN4zoYBxlDbpW2Fwa2f+`TFM9_Nc9m~ z1BZI{*ZU*7*6ca>FHr&%9SAdC7e#wbwrqXz>}j?E1e6OYJle-)1n{X!N`0o+r=z2f z-fyh~x9h}A#E7aK4m<3o*A$tfNZ5H~xQIWJ%t1XpHipBHf*L%y_;g6;Yt5=fnXH@~32BT8~C8q$7(&w`r}W3x^2URI!>L**$D1bH@JMY64KsU)VBG zHn>BJbx_{nt;szz;i)#rLni}9uCJUx@G+LmpwsNIR#aaP@Zp8r zqOh+%xQqzboi`!ie|w~kP}s^w&+NuSO~OslDT{-c;=&~MYAhk4hxP+SrP}6@FifiE z@L|Qg^;4FYIRN3dd9#=0K*r7D|iW9xcz*{$h8PV@R2>+zl zEQpVseqJdVcZKE-f0%sjPJtOVh!FsIMQMqjzKH`yH9U9F7~_T`SVLsY@UV|?siM7$ zyZae)CfClCn9(MSX(FQu3T)INtQG0O;i;=r(u1k=zo!gAKBt;W%^j z*Mq^i4_>i?MT-9BaXNgtuky50mU!zFEY3>=aQF}-@*5C za%|?$v1QucyN=zHUsbISwd907??GzbyWb@1>k$7bQ|>a^(A2S2Sjz3r`QrNMzz33RtOCP=|aFiIS<9cKkCd(9pa6c`PzZ) z@ol{06A@*#b-%E+;_rg)nhZ!ztfoTr3{j$@GFMk*3lyLwyV;jzutF(66GvJhszBEZp8x5wgDKl7da)QYv((dGdT(l6r@7c+zats1)*SZ$ZNYtcr|JISc<|bcJ+MttYCtBF3VlJ&Vn~hyu z*Nhry{@%^po3=K@OpxH=b$Z^jCRx*y$V|aM_zD|OJc4G3I#C|!nrA0bWYcNUW z2kWB|VCRM%oEth9vOqbeD^8lELLvETLzPEP9{3G4E^h0P=;HGHtKeIl*>bpI}xoT`p8&)Eof#3g`O^jiL9l$>yz7q0NkgzKYfqovY zI*i}aoV4|r%mm7fQ@GQpp5j+s?|XjqbSA2j<9tkRQlm$N-y;!D)oYjNOSGPr68RvC zCbMN$g2$0$7N`DYR$c*Ri78y6ZhGuU(k}X7$f#dwhQLV()*fc{!ihhi1r@4_dCghx zBBwp{(RTz)b?kz3I*Nab0GiK{2bk*KhM!psI*^E+Pn4ZZvzs# z_YLyF%Y$3Ljzg~9YR zx0R0nMwwWBnmB>S7JuyNxVIDh8ppUTRhcP3=yLosRgYTPd6V~?8TXD=j*MuLT5iN) zu2C*Sr-{fvLA{~hPVopIfRp)V%5o9&dE$=GQN?Bp_zF!L`FGIm1YXS^IO#JHH}bhC z%dunKTezKXbR>5Bbf7S`mB++!ktMD)4)Wu;4a5?!Kpb>jr|O<7VvNMc_qg-M-%G5z z5^=lkCQT4nc8P7eQhK{fdB}||W*sr=*==S9BvI*Y=)DHUwzXbluP$P`4yzqD7JJ>s zFyJ8DMzk%YQu+LQRARz*^9tN}?Q^7gatLOK>kS(&A;{VwI*(<#2uunJB?M^_>5u2g zUh>XuEC_GWJ+rK?bWOA^vZTZ)b*5;CWVb&xU;)$Q0YmKm=ZOT~eVwcF*7uhaEvNnS zTVlN$HGsol-NR&7pk>32GR~r!2N1S@kp(-5?!5DLTvZP>L-q{9YR=x_N_8v5I953T>0(+qLa2EuJF_?zj+&pn1-IpQ z_aaT!!sPx+jU!Lo;(h<`wP=gvNeY0Gd@RP2qq0wt$uD1FEX?h7WXQ+Os&aVO+s&5J zBDom#J2_eB+e&D@@-J^K_&%>6uM6E>uN*S8P3g8c9nUVr$G@GTWXFY*LzveQy}8^Y ziIUCmq40U~k%Zw9$m_O4F*f>H7Pow7Gx!w%J|7r7c*Tipl+)pUe%z-+4nbsVn{g>{ z-sSzAJ+d{M8NtPsV9>8K7&q{vO{R=A9c6xW{q-Ap_+YY7Da+bwBj4Vd%OhseipTDF z$(Y;Rh^WC)AI#De(Q-{mP07>6*Bh-$Yn+(#6$SaC*z6A1=h>3141$S~4%FZY>-*BW zjK)g=@58g5jX3bS^-!)Vkj_+JiP$x;6ks7P5C1$q)2yt($ zxbU~T_aK9}rzMv%3nD(pX`=6#e|Gu5@tb3wt;84n=cj_lxuLutejMFnB{olg zn%i$Sd%n&d(`i&?wm1wd)j#YcN<@!5P8%9nyic!0;62zDSSgmH4A-gy=TH@$_ z^zgGoMbi3r3J7|r|}XY00Vk!{_T&R*TXrF>%nexk@E|PP|ypew<3B!aH2}6LQ%g> z?&Pl+@)4#ai#7q*Wt1KNl5#X|h?fiFXERIeIs|LZ#x?Pan+3- zxN7RcVJir$MO(%+zub6!wqeTYbI9F-hn?cL7O;oc)_;C4;_PnvxE#I*w_abzvVVi# zjN{bWfug^6B(a%HMU<60zIYhdR=4-P)OINPd4Alu_J8)bT=_%9P^{AyEFM%A3(to| z1i-EzPKr$)Os9JK-$B{iRSHuh$B^3~;#6m8Xe!vpHNy}JU#(@vnz+P#Z&N%{F8SZO z0BXF!B;r&2+Nd#BkoarAAlT23Nj2z(fPhfg5;W}eeBj89T^hUgY_ABHq{QCzy6Qi+ zcAMNHwKpc>`C;Z@xokuw_&G;2&L1J|8lk!B(ua_HtNBOZTm0F2RVIW-2CERUDlcZ? z>{RCGobpV8k8#*jZ13dm?BoL0W8I<_;0O8mOm#%thIx`qY`~o3kRbm>j=!AyZhNQK z;c_`y!FR5}tB~D6&nfz=`Zn2O6#UhPRmc&L)5s?N_z_iK zwgW09eyQJRjmRs*=s}QckT^HF#hr9)Zu;!=KWQ3sJ1JU+H`oY%`m*XujF`V>Tw)%% zVp@0X9Zv~hyw1SWLIyPaiDW2FmJ{4Fy}4j7D7T8!r8zHFYQGYa9uQsaOjN9?%uw$< zG#ChW_&KSVpVp|rG(EVjKkWP^NQu?ssWp3Vv|&&1yt#W*yxiLi<+?QB`5TsG`(~>} z(Wlq9l9jKnut6AePO$0oV|jyqw%5on}bg9(7;D)hT*d#5k79%{V{s%Io|?@45rIf~>HulP-1zw@D%;+{ml&c{Swtb!IH$gFjCUR-Rhli@9_#^qfH4e^G zjmdMNZtmyI+83=JJEqq3*ZY4#eO~FYm-ZL#cdwieMRdflwQPF|QSkr47b$&IEE3V3w5oCa(RF?~^9Y1|0?omP0(__Z2TL(N0>>k|qh z_^(fw@cXu-p9Ta{d>@&guKv<}nh^AHf0&L}ajP< zwtJt!fI%T%@!N*Y&ukO*$>&>jyOl}_8k;w8(b_XNki*%)r zpgMSY@p0=%z@QAvjO73Kj6wdP*_o~0x7`JQi?TY1Iv{2yLb*uV&*0gmC(s(Q+j+d- zW}{V#CPRIMi`F(8T_miguAhqN8Q1a05IzSERiPW+&K6#SI=Y7s^Sy2@4`D-A-nJGYHZOm=-fm#gFG zIp+M!Q_q{n!L+|r3M5+{{QM%FGQNhE`>qyD_X8VkvAkKG<}EWOKSDSt&qhIfI92OE z@b_su-j++)%%g=buliY>9M^IgO1iWAB#?7>Iq<-A4)Z<$GMK;T5ydK&fLf^3LCTw8LZxOn9TRh5Ao@xzj;2AA0| z$`mCbuzL0v z;^jm8xSkG`SEv3&o*>F9EtO9nu8AmQ`U&IdX5mt>%L6KFYI3-9a%g`qiHVsTZAz5i z{n66h(vTJM>^k^_0GFzAV+e^XtH+vyr}1ocE)_nSzeQmA$?!=3rs5g{_9L252fwiH za(%K{yC5G~B*LlO;B$|Ek!-B<)BH~5XDDn@W4}`CGUa=N#Qpq`P}LYO9Yxyo2FTSC zaXajKP8HhVq8r^?O9$b`AjL$9t}|Ax$d^>TTb^zoQ{!g*%>)swx2b@Y%^Zf?O^S<{ ztEYXVgU=Y@(g4@rLmA9Ou}3m!=WKufH{2b#(>E33o5 zW&J-9mCqV~&@tdYrezSEn3%X#Mxd2@eoZ09gCTb!{9NK0TGH!$5IVSLEqUUvb7Gzn zUM$2;XCrEm2C|Ls>P*A!{(V-(j2D+eUu)vb@IWMvf^G+0eD$68;{9{}Apdd4bw#ML zjzT{t5z8}ym!~IkqbP?of`R!ppPqL-KkCHbPwuFlIk2OFz6qZelF6cDudBPiEj-#^E2QEL3ZHEG| zP}?rD1zO#nCkGXoF$dF|2wVT+gL^^z&qb-bkDZMsLoqXG{jvZNDb7O=jNBZkN(CdL zU(K^|v)&B7zgeD-y5vk~7jCDNYc;l7j_7t6c1)*lcGgwo*CsP^3ICshtq+Wbv)g)$ zr*mX?2D;QecEyDy!c%uzpRoq+;A7$bS|H%-KJXA;4`%|7H@&YCEll=EGehr6Tu*Ns zBOfCGwv0P4Hav>$pC7dW01xZwt{W1d!)UB-yS2DFC-=sEHHcN0qhFYF*XdRJePkBt zK>9uBttL*|L+1bTK}Mog{#hRc8IA^`j>GyEKH~T;`R2<}h_V=Oqv@dk84J#TCL7(M z=l}LHN~oO)K!^T6NH6_=;0JstG`Yi&!bJTi)5Q0Q#}N335a}k^FmPw!&1+;KWZeHW zZQVXOcK@g6)D95`A^rg;-zD-VWd4suaQSH;AT<2{eXIWmio*YaV*hU>z^i^u;QaO9 zk3N!{xtzBoMiw~5vd0I%cQ;-EyW$9EQ!@XJcJC+F1^R&x4X0U;|2`&53@AQRj1A z-X@!m+aGhYOLX-?W^h;t@n9zMgFZ;TJvM|$$_h>A6OpRMf(I0T*8qhoQYgf2fCr(v z=+vFhwuHNZuZH_uk;`61iz%V(!G{qLJcq~X30Y8T!Tg{~6tgmc=fP7?&&_=sGJvc9 z#*r#PiaPDVQ!L8doua}Cbq1^UY4~z!>@Ql3ekD3mgM^2n%4Zh*=-F#R)!kEK?~jKk zi!cs=cUqZ7?(LlU5zQiIf&&Gi=z?Gu*p z9Ud#?9~z4|h{eSUo`8N9o8oOnysGudj}UfA-R`{}|5h*;oGm=@BY;Ivps4l_z*P_; zE#yh!^GK^2Wjh?my1}p)gec6MTO0R39%d`f`sqPI^!|Cp2HWwrZX_k%+C9q0!_HM^ zLT>2T->-g|?$jEm@ef|Bca zEQx&5Q_Sytg3zA&Yz!~-73Dr}&eQ7Zn#|c1dGt2=uq8A@|D`?oC#|f6W4kd)j+cMr zPyCgAYo#x@iaAb#Tv)_YJ;2iVU)$inP5b})ibZQ0<^I3z9FQvV|8etTZ2RLOhTwcW z1u)7)DYE$KB}zzRPc|)N+#$GCPdSHP2^~SmzG@-TPoIfMm`oY`V_soRPpi7%A%9PQ z;sUrCB72{tfet!q_1fp$W$oZiYjSW7`~-%~xW#I*&^(6yh{no<)q<$H8k4#;x#%{r zb0IsLVq%~vm~5=NKMQIcF1}q`p=)N)DVl};tdId?rnOaFPa)(=sm}1Ipe+eib#=|G zmcw@a6s40Ju^!le%ndWF_KQohoGDjN`QXSBq}OQ88#WHBQI63)hM!N}39*Z)jwCAZ z0~6VM!I-}N?qk;da!>~~>z||9;_U092O*5gTaaIveem$a+|+k*1LzCmz{Y%q1*{@Q zlsGw}j&L1moFsQQ<|zxI#&E$Yo%MwI*iX| zfL{xCIPj3UikkG>P=R1+x;2(>y3D^)=MKo$y4wxEsi4NVc2|SNrBWG$z=JJI0;ZHL zUCN;wx6}DzNdzo*s63uPkGO7hzn3LSlf%M{8CA2^a_8mgwkxZRR%p3^w{6QB>r_t$ zhaPgLQnMzrn*|Vlv!ox#{63P*tgSa+&y9;X!p%WRrC;L<#ok~=qea{oz9OT6Ti~K^ z06Qv~R^ z0rTM`yb0X79qfgex3@Hvd$32XO3SR>$#NByw6qX><3=Z@{CmKT%20`Q)NDIMJ~y>( z&=!<8=7K%I-t)OeKzw6F(^(f0sx z>Vmk7i?nzY8lWADXl{ghSwX2Hzs6e&bfyl{g6Ki0aiTAHL$yC{~-mU`oNr(Xai&oI$`+wg>FMI4R{0n_(g+u3R}&r7^r( z5DJbArgUDP376)2vv84Gx~}g!4OiwmjQlOsMpy9KA%eD9HiJ_{vWgnF=4-Y9dCF8&PRp!Z%P57qJ^XM$}N8 zAbe1Il#Xl%^?1z3u5Aei9vU|)M2Nb$shJdw`FlRlw~7QdL_|1c&9(uzH`kDwkVT8o zjtLuHgjefptVnJun}xiK3x^HyFZHrxhRGd3Y#nJXJ_X~-(^MTr<9j`yt}h`5ZS-f7 zc(1_ZCh_vJ8BIA(Dw*=cKNSLmZP1@MR_dE@)kj^--lN~B%Ftp0@$fm3B9eGO_plsEFwVyfU4i3R zF*39$lpBAl5Gm#k6yTYg|Iah0K{1*kwl5U6|N0+q5hf~CST^EgA%(etf6OH0M_l^b z0fA7;g?t#o(@}N)ERF&K#Y{fg1C7;z!i8`)MhXkoor~ zA>`ElquZ`)FYXs#KLKxKL@K`*+{c-}*Kj^aVN4IVik<6B)bFSY)RJ%Lx2dR*!gwu9 z;d0}DyN&P^zP$;>c^kMQFT2;mhdep1eY3?1!RRjzlzJn$zrY;MNB@Niy5Ur;Qh*5j z2Y14s`^m-}RsD87JQ||~X)=Co{PI*pro}Ys1kImbh%@HEuQyV<$5Aj)u7K1R6PW*C zFvo7q>zkD~Ls-VUFV^Z4@Bi!_Kbw35ZJ+x2J`GspR2kgZs$J6-%y7D`{A23Wd3iDr zP?YwNZ8^4gQm@mbZ=SEz;o%b6&UFBK;6;yNPwI48)o9W58rOiv%8n+|J6uOZ{HV8G zv^kTKJi@124TgP!PDI>&*M>MRlWSGF72AQKN zt$Gof-4QYRaT2{6XEFADlQ4E#8Uu^k1vQ(nLE|#%(hA-h2*0+8zn)Mor$^&yeI=UD z_Zm)|^iP#GuZ~&52r!q4Jahujb5wMPuX+`8HpTI8w_{p4K5tVk20opx*EVfy6)Y>= zSdc$+Ip{Q0F)IL2_rX0`-p?IM5oP%aw=G`_u44{b4jr=+Iz7T@(P+oY5gTkt%pOI{ zfg7yee+f@c<}KT>q=Uc{4(kOnHb+-8PJD0X_p9dhUlxd5Y2&`&TspR#iH+_PWO<3z zIunZB=5+y8|Bkla&=4Pi5N1AjC04j9v?a1{=L)TP;o@gW)QqKLi*EDM`KTU|VFbiE z1~c5vQCO;;IEJGj*Hp7yDB|>N8G)Ajrd-)hxrl@|abL zvWbfaH1jeDS8UEnbGOteXe-KNhvlAXz7YmDFDgS?IG7>J>1T-jAAxYtX<&ka#9COi=33LB8KOcwKtbd=R>4 zr1Z~K)ZXi+uXJ~u&3eeosFnnr1fI!ftlXZI7|tyDLZLnCz1SG31ThSVT7>dNLwg|` z0pIB{=T7gNr|g+=KO_9Z;aolyIs9}$8Fpsq8wAmi?Tq{0{o9}{ngP6Q;s?m1Ev35hk+736?zdHOGprc51_ zz11k_(w)AVF{L-adF9O-?biNqx6YJHU=}JfIqzqJ6PnyugKwRNSrSZ-RzKpW$QX>Q zabEVwcm#gzPdiYJl{^Uw)}W* zAZY*H)^_~o&7NGeRx1`z7y!?QV0=4xS&cPJ)427j(5s1SDOcC#ZTpvp)ZXH4docP> zaH8U^W3s|P>%pr*j($dMzJylvAADLk`E>aK-m*ZiW)+R`2`;)1o`J@cGJT$Q;K6D1 z$D{`VMtFNi;C*`uKk!=P9iVV0FLu2jOy&6egRknWea{A2S*aU&=aP|D9F|yi?0-9+g*F zk5c;G&H!Ki#+_+3b8F=bupK}@=2@<0Yf`sz-#mL(S9h^oSjXD^-d0Ft0+l~^0DVy; z_zW4U9OZaSp4R=AAxd&yPnP7O(@a@&aTY+g9NI=^6^aJ+k1|=x!-}gZKF_&=8!yi} zuNEp}=F53EpgKLU(FMRMv3!DgIT$n;F9UdP_asMZe$@e7UiuSM2-a_^G+M3sZ}zvP zzFiU5*YJy6PNi?v3AY=blN#17P8v=}DOWh<2i|Q#b>_YUemHPARXe_Q32gRXPwfYK z&FJuQ1gy{dsTHBCEuq8;H`vg=7VF8F6%bZiV1==Z@<*C4jzp+7+rs{g`{MZO1VqU^G+r$iR)# zCRMo&B|YSM0QGTFT*Tgi^p^qHs24cs=Jc*V{+}ZOtzPUuDVb~oa5q$p4p&1TD=(_V z1yJ0S9k;lq7!l>q`kZ4jZpx~}DocevQfQM-$5x3nl{o#(Hr6k(efX@eOL?~F_3jw#_gJrb zRIOqAMTL2``2|n>2?z*2+t}FwEhxYlqxzl797Z;@|&G?Gk98kL?DJj3{s3F)k0@)-u|T@F}w z$7no6(5CX33KwiWYePwPRf!?ZqN)^WFwOj%kvwSfBsU|Y=3`~LPg`_{J)|r-cB?M_ z0e?zL!Lx@}&1#EB!B~ksToQWhSwD$ATzL6m$3edhGRi$$SH3NJGR1@!;w74_dYb#G zT>%9IbjGc01IXO^O6?Tsc3SP*YtHn;hRlI>b^b#!;(_APqNm*eBO^evJ*3BWoYF;J zFpvns=>O@;B^QMt~ImWN}4~a*g*0c3oI?@AgR2# zQbYqkw$P~*Rx9fT8z{G5sR33NAQzT}`x< zi5kAF)6*{;YA(8*Q?^RMK6cBK(PcQR(W`^bAv!^rN`zwb7C!(F)108{1o^K|J;EHjo@VIPMADL%DPM#;1D%(xU9=) zz|NpVaDv~gU7$)o=l#6FWnO?;ccMv{dRCo^bg$GEI$+#`2z0BcTk(#Ll8r*G{MUM; zNo$gTz*FwYl7kUG;I1prz3=4N9&SzG~Gvw8)Sc83t-?icV$MKX|Np|sUWDu)Ywe8O1DC?sK`G}%)60DtA6 zp;mLDDr0~P8(o@ggD!o-sktA=TE6lP6na6J{o?2VJdq8XO~PhK_@i#d(9qtkuIQ(~ z^ZCg&kFyKbOKcv-p-N*oG^)yI2IZ0#b*B+BLCO{SU*f+r5H{vFcIxLg6(lMlVDG>l z(2GM{px|!^6Kf<%75y6GP`7sxYv?PtxP>HB$HSBy`04Osw9uk*q1JxE@P~#xEhT`4Z)&^CQBx5SH+Bwn(C>=#i_GX{8EO z^huti=^K6tWK5i>0n6t5Vu>7Q+rnWK6*_hsUA!!BN6^B>Uz15w+5$D2OnnlNSwrg2 zW*O`1)u>kYAny|P`Vbxld459INFF9*8X-%|2r4sLO9)RD+>R9`uO{ozuW))gaBLZh{1!N! zv|{SIf|xp&9R|q`T{dPO19`1UPX;P8bP=eUGv)LkT$KEzKw<0%;>A{Q&;0AYjMAn6 zNiN+0P5!bErclstEXD0#w9P%11 zapkNrjb9#y9XG7so49S$G!)y}szs2H?NpVR3>IeP;IFYLvwzFDYt@RC)AINXY2_?F zASgTm#RsZx;m0n+EA5Ne{)MTrWc(ovlgL`O?LAFhP-CiHk+fzr2~_7)7e2vkT{uX5 z6Q~$DbkQ<%G@}HeDz!bC$m+mEeFFRqCclaw0i3y<|ODd7#%3A#bFlj z2w~sR_IxHcw(s#hYU)E}6_uJ@x%1{tR4T`_v+1ihj^bi2 zVsd7bX~kvq5upGzRP5MUn$Cnh*!Y z@GVK&o5eeTTfb|*ZinqMWQug0X?c)D)Sw1c%rxw1v`h2U?7Tm5?lcnm!}Vo` z`m`VsJ0+!fO?qfQL^Gf!(qudk0W?ZnUDYm7ZgDw>m%D8Lb>!`w~B2G&>g)M zxNZ&=)V&+)KYzb(k0m%vZ1g;!y1x}{tbA2%*j1SrRp`#Zp8EH}hmL|G3G8#Nct@T18<+8HYAe7kM6e<#!W7jAT4goGeanf3l-<0aN3QZRrO%jpf=`t#S< ze+q`%GF5(_z%khG?KD^5pe&V@@)?`G0u`t(;70!E?;R&oax`m%khZEF-n`3jGTID} zN6jM5;E!LRWN4Qdc44tZ1h{aKsV62qZV$c6Y5fr8!q5^2l6bbm)Edc+p-sd(5|moY zPkTU47E|aMlgB?NPD{;ZSEE0d<>$3AIsI|`k=0+BAUyKdnkt_c0~b_4;7P1+!{^Xm zEZ%50vxGvtDd1gXZ&HC-i%wj@ln!m;1NE(kzSH+`I1R&Vs^P)G*|#dm)~Qo=DL7&sp%}B-`3wqF`F!uq%sgfNi^Zz(%?VU7sv};Y8Oib_u6G)izvn z*|=_C_ebQ!F^brPxf3lYL8d@Bhe}o;Dp*JsUS;1u^!Yh-miHtA(~hz+}pQ*$bz5f`#%3h@{%RYjgSxWL5$G?;Zw3fHqT&C@WsH z_;C_pF6xu&37urooFat!x3}VNtWuT1x|hrROWdCtV8N&C5p6yN?QB29j*Ir@uFJP` zf(e2}i}v<#mAz?q!}l_st(JwynDix#^hZh{UOkU!2q`v{cvlDRKe*?>#Q2l2{<7G+ zPO&vyj+M~&K%juq%UqMF4IE)Cl&`qH(MHCd%t0dH>>gR4o;GC1r=z7M#hG0y*Mfk) zPq*YgFl5^%HD$%Kj8GpQ9=_fiQUDa&@Q^Ex!c9tvs+073O6aV|Db;b*7C`oQVk%(c zTDtmk^Qi~aBUOJR@bOD&OIZ@5*1DrSkN_p$!_*;?F?DP#F*q6axqfq}Q(WUpRi-80 z1f|~7*kq7Kw;7I8D$hNKdPjZ(joqzyf>9KC0yRVDZx_0AN(PnRcCu8Zqd@9VKU8P} zzh9PIY3kVQ0%}lNA2ekjZfPH#EiF8hqf4PTsl`2ZE^MxE&uv6(qSbZ%_H6*VO+5Si zxMos&axz6(t~z51F1vD8QdLqF`ayl)_!3zgh=)SrBCex)E+UWz}M*MTTZpHnMEdz3{$@-rw*PBD8Dv_J(8$buu zD>crAjrqkK7)dn!wt%`U2t>0Fv|5~AULQTYO4a3&`M%HU;aw1|q^6@Xv8@U!rTF=~ z;S^5|aXGqq3)|l6fUevHbdYOl^YH!{0JPCeWdz2k6+8AFGE) zBz#u9T&H8b9E6}cD9fs?-u~mIYwcPadD*Jr=N1Dae7tI=E_Ny zqvNk&S(kFrquoCBrqdn{4k*VLyWgkh!MLVWGQ_jVj4oA7Xa?gOP2`FnO%KBs_2&D7V214ntFR>y;GId&J{+KwLq7CdTpJyWO@&wPE)s86uOWP^udVXwIXV~@YIvXNatcC^OpUupmUO$-eX0K%nbL_f{B@~|^=wJLI1Q*IT0Kyl zREcu;M~AYNORG@?od!X$t~xg%c9`g!p`qLt8FGvg#70%tovUrKc-Th4tf=A&$ecb? zbv7j0@X0fD8CCP>@uQj~oQm%o?G5e!8+&gV6j!u$i{cOxT!SWf2*F)La1X)VCBa=9 z*AOhYTkzn)rO`m+8l1)*x*Knt+sQfid#~QlTXp}vDyrC2b??2IYpuD)lr_dT$S>O% ze$2?RIO#&c-B-Qa(lg~GpZjrCMG0|CH{_EMp$knoDtR;xkz;~_le{%IX>(qm`Gzx@aq|-#leW8Vl~j%Hjo@NjuV}@-+}ygm7K9`E)uO zDZ!NRo9vG)nxA9WnHfHG%335Vp{a`ItAB+!u0#_M7LxI^j1 zRQ%7nvmi|=dUlw0m9p%^lyoMlIDJZp`vU8VgH|~)d-Urhg-|=ZBo5=IAUHyA!ZW0u_J z$cU2reL~UdA*lihMaBZO*OY8skf=b=UZRDfQQ6*Q(>J!q`eO#fI8BQ=O&+Dih=I6> zTQ7EQyP>zKSeh`SFO)#M7Y0Y1#?M<$jgc$x`XMPw6)Z;5O*+sUko(bmuAJw9!Gy(g z>$P}15jMJ1!dK;j6Z2JPwwGr<=H)TpLBXM)J+{`pdXPtUD9DAoX?o1&D=bw-%cisV zSaGOGwH@l@8KSO5S&OGX^A!IG_HJtINX26&+4vPv$c3wR-PTN7GJqTkFNQMw&xG(@ z2^oLjMs|22=kV8JFl>ok_YQb3oO5=Uw?^~L9ojsD9N8~;%g-(I3eHJ@p4^ZgyH36@ z`0QroqaYRC%%)4aA%-9MWtfg2yth|AJ)5hGUELMtY8MsOjl4HK&>i2ZzzlzJwvf1t zbQBvx9m~AJ&U_6R#76&mDv_Kl&oIU>Ku)k9>n$qJe~o$;uNWI(!T&;$4VQ!3hf%yH zdg&NJ#upVfq!Qjof*p=3O`I7eTkyu@6>)5sAh*#sWg?B7kx7@8L2T-WW3jx^#Eq8zdUUnX8mHis%QL( z(PDmnHd%gQRyo13e>mk!V?jroVsF*Bb^WNmwG3)SX9;i8c(SJUY$}=0#gC)rpOPL zZO`dg^|9j?4(HE*(;ID>$h05E4x>s@g*DhF#;UM}8hw7veGu0BEf|InAoig6?dRw) zS@m4*LviuWYzkwnnZPLVkK5*isVtD69Hsu8g22OI&){DzS??Gz(jE6 zOSc`m!pD}8ZlGbL{?_j_)!fren{B{cso*&R(@`kLQRK>VSPw|i6n|n*IHfeuSLRMN zuE7hDie*mc)3Vx;X|y6y^mNcNDmGwNvf{QzH|e&x-F&&AiQYUM7y0Yp&%h<+OgS2r zr>9EBhn2~u;#m6Wx!T{{IpCv)WG#WBPX}!XUh}hGKfehFI9SOzR2h$kcan0w6}n6r z(lj)4XXK8RVQeJL`4!BJXvM)Hlw#DNvzoK|#o^C%uNsYVP9W;{R4hj-$p*#88_z2)RfEFw!-bHA_AyG3W`Ns@*`_YzT5sj zxOoJqIN@DhR(+N?&jijrSs{W({;aVIof-sx=hOY3MAzf((PF&~f-u7!y3&fEep?SB z<1ilGI!#t&6#SeuhQZilrh(#XnYIvhc*k=aRd+bf#Z{u! z?d@%TLNzoupf>-sdOWTg3c`a)Z9=l<3$QbmW#-yFE_?e*!L9mY{@cPxEUPkntMd}h z2(tB7tyY}&fCr2}p95DUAxmRf0Qsw)+bL8zat_eO#Q#l$~joFA0K+V?oSrv zJ|eSX+eK<=WW~N$W^Hh1jw|=BGZMUcLBeQd9hy0|QSwQlQTg|#lCG9jIw%Lg%F1Xp%YAsXDajGq z^XD0bz4Ss!ignWK;ICOxH&pzg;1V+D#Uag*z712)&;eT#EOgJBnuZ^$Hq7at!h$@Jt9p>xP*=oR(lOHF_es1&qu|srwnJ9xl zt77C#l{8JyR@fbpe?ea>Bd%`^(d1?%eHPB`@1de67FwaMxJboS5!bhkARD?}e4aLR z<7Zox+k?=)v*%wnt>@5HXWy-p!8Y=+dK0Nm**}_Kx#ak9c3xoN0vkaEW7B(kbfl;g z5h8iEwf)L^wgOF5n~i4IwY5N(o1)w2SXh*J!+DW{s}F+bhNvns3|n$HVh69v3Vt<} zLY<+Ft6lJmolR0?TrcyzC!nEv8Tfr-?=A$nI+pRDielq1Lycwvj^K&AsWYhVC=IX4gEVx* zGHomjldffC_kz$dM!s9|$LT9*lc1<$vjD}}(U_+$aNf*C(2$1t=BCWBAjGa>ekTSk zN>jM_BPi=Wx57cp!t zB>4K9h&^&<&tofHs4ae5^yP^k@vcy6xg!n7)gxyVPbuR zr?w2FIxNY~EQv#5`sYtJFp1D3!Et}53qMiXH9V(TF%!qxa`>u7<56xs{A$(pJMf*- zF9cPnrBbS;!l)3@D_0EdaiKjb>$%JndP28xp>O7@rcClkXbDgrJJQ!*CFvNyum8w3 zdB@w9cK|&&c=qID?Q4Azr72td>BBT-kvoN!Xo`A;=A?wGfY=Men&4cu$g&pDR-{aX zC3gNwq7x?pgF^o%a&u16W+&3K=OnK?v`gpBxF$n?Cn>Z=`vug1c0BY~*vU5B z7&Q=xJu6?}nL$Xvo!k=amv5+<2`8G}%z-PYH<;=6dCHsEajYzS_dl ze69=AGiiN9lc^@d{&~ra0ykB-UYns~*Zk4xRC7aDsE%|{LMbvcqZFPk9=W73`nPuI z_Gu!zV7ZRnzSG)_!makp^mOEpVaphF*jJGQk*%+Cm4gPn{l!_OgH(fB4jU*2F+uKw z{o9zYQdLUX97C$xPVV38cB|J5hkhiuRuk=v@lg(EPgG_p+O)^`HI)*SfZg)m>6->E zKhg)^$zQoNnMwxOPFCi}`0vlB50twxzeqEa-+AM>(=(CNBQx&{Bw4b3bjzlbBDnR? zKhXR}ci`E}fOW7L-mJn!z!X?uNWq)+Qb&d`K)39JwQykfUSTQOa7f*tfXl#+s&B_C zIY~${T^~Ws#B*je=cQiaf;7Bclvrfyw@BIpDAH1^`+dQ#oOz`Y7uf^LAF(oqnKhp; zP7k$k5Qkg8AAhsmibh`2dyv*+O1}2Zl#u5*`VBg%F1>4OHZ<}>;-X|OQ#T?BLM?+| zxXEXLj4h|`;QXo?o5;RIxUt4j4ig@ zpFe&PW`oaueY+h#vmAW=r)_sMJ>hG_d?mDUkHziaD-U@?B=-)92lZmu>Pyw%blh(F zo#C^CDROj(zrQil&64m%DdTdBd`%xcuBj<^av=Gjbof(S#!%l;DKu=p+p#JdFm`GW zkkayz6E`x_O2AIvxo=WlP`J(}mic1&mLXbu(aBFfmvrFBhjH}+f&L^Q%Us7PG0=+;BevZ{RFbTt;V)0d{!PQL~SC$U#l z>L}>{c2I$wzL#+z+83y)Yi+7iAFLj+;^8)~nA_cwf9LS7v5M_kdv#ku9WKLUHOU)d z?$ESb*CqS*OsD74o8{SM#e~_r!#@>sS{lD-wXW?sRhBbn3%APZEHYGGK z^y+KqC`m;8(Js|-ZB_Befn+qbeXG8*H|qZtw5E0q{Fwd1Tc_&h{=Ti#ZpFTh+fGSS zTU)AZYHeKvc%f`ZfKYoU6NmB!JGNi$=MDA*xKl!Fb03~%=mg92 z3Wt9>IiOS2Jf9D*U2u_*a5hycxpPUB5C7I&jEL~I>KvW}pAgTETo zJim_cy}N>JHsrmi6?H~!Rrc{wOgRj28ba~@RDHby2#vB;aUd}H?szj`(7H1@&fVcL56cf zl;cZZn~7Y9=4ChZ61BYCAuAH%a>NMc7rMNLN-b^lRTqy@8`f;tL%$=j>9&X@G6upHmWe*>$ov_~`Q-?&1bK$PQX~v!9JUS);SiJJPY9`Gns|_PeFn89p{VH%hs|<;`10)l)zJi* z?<1?q#LdcC1b2Hr>qR_CFdpkrd__p$Ykq|}d%M(~x5J`=={65KE`WZ~qlsOSwQ4$X z!)+g@)Sa~odLAumEw{=iIj|nj%!N}wHpJ;zJQyX$k8FaeJG9H^Zi3KDXCk;UUsGyc z)$rxZ3a5?ApJmT&g*b06b|||7pZcs*@`j9D{~1?Vx0j+qmkZ*E(f-DJN#&> z*<^lnh=7ot8$JOtA!{YetA-ysMJ7%IOP2Q<`vdt$9`oF?pM=3z1BUZms?CpIIw{ZY zeG8UTR!u5*NHEaJC7Ci3iAh!?BKTp7%-ezs0g4CaR!7IRF74gxpG=j z+;c$E^mN(EH`Q6CKGm}+%~0KVI_g;9qw?i$$QBelI`Cj<(L6tuF#&5v6F^&nrztG2 z8SS50;t|{Vgd^tYcZHH|H19{br^~r4Cu88fhlT%n0yyh!>iEK(!nLjX&GhWZ?MMD*xTTENSW}^m#a(qZVP^CW!S;<0DRQR={P78{u|?@d^>iaDG5GX! z^IMltr$GJhJb5F8-06OLUmQ(FBkEm(I`?oFs%&ZgIF+zrUiltYB}cVW00_MxLy9hs z6eXwHZ}o*7#u_NQx?Aq|OyUXI2FQ)TF4wwzwtTrxMPG<{H#Cy58wNRBavQIR2wvxt zQ&Jwa%bA#abMp2we9ot*x$66!&5=B1<|`}U2)0h_el=4;ABrk98PgLC@M4EgR$SiS zxUK0gN+jEKVBY(NqQtyPQhv6IN+TNJpj+%I`yiPy-s%Qo=Y*`Z4Z&RU!~mXqw{gk~ zx!b@Z!TU`(*1MR_2+}KA)^tVyLv7G4*yf>g@^Yi@N+nXm7_>i@WKoEE1BEKjA8G=q&YBfoh%~`Q z33sE@#$iG}SNo6DrYkKz;G8Tm>tgavO%@7yM{d?+dNtsMFAs11 z;X}8dt8Ygr5z;~UFbZ?NSCup+Xc>^4lfPbV^_&TBw?KtE4sb;% zXC;}tUpc;y)I9g1oz(kUH+6S##m))_GR@<@#G*AjX9_j$>dynW!tizTb>5L;N{bqk zg)wuiK$Vk#cmtKzkbWu3Y-4jf8|4DNzp;GQS|#U9bgKoZGhi@JKXB`QqdM-Qzq8IR zZJgo{w%n`Kl6zm~RvTD>19NrNklft18{~7>^!fsDulu$ztt$7$zN_`osS&u&ezZo* zZXn{;i%Qh>5^ALJiiewfBW45he|y}}&|3U$0AhO6>l4smqNH6|pH=h9x;N6ZT){LWH;jRHVzo+x~b< zh;P>3CG^iHj^^Og=&mk!>BR2mo42^`*JApQm3llWA;V1(R_fHWC39NrLCz+n{`UL& zOfT&!IhKJ!&F&i=jV=O8uNuo++)_0swYn(&`K~@JL~}bz%DZRCxi>=q?((7;j_~WN z+JpPLu}!@T>$IWke61i*+gAIxYp0hm}O{}a{zPWSo-f@~}xK|a~ z6NqAbvdVliIbeKhY}@tnl7am!eYzFBbLgvFTfy%HH0(B$-N0BoulbIWO!`OG6qA8F z*>_nqJtEVeyXFEPt>tc<=I0;TJMZ7kudEqvcU0v)WVQEtVU+HVm9unXeM(e5WZcI* zjRi$dMY_9BNqr}ec#i6*daQ3E@BiHT{`^G1A~d=#!E8y~5qdaGW?^A5)Vp2+1VqPw z_N-dQ+9=^Ovgm8(rv>^x?V^{0Z!e3FKs77W)Q4R{oTB_ofqQi>&6G_!5Ivd>~>01RqMw`ugYr^Hs&AoH3-4inUHk$ATd6snPsYF5f4B(JRg)NQXIC~cb`o;gQC3GX1wAztjY zYvS{_{8*4FYpgY)m9s0Mxn;6Nr#vVBySDWl%6l)|KTo*s#B^dEUXIwSLYhzQB0s!d zPk3y!-^z4}VQI*~pw)L^YQ$Oo?m@s_Y7o1t+66SOZB6na6vR(rbL0AVA4#+%L|>pZ z5#e{=GKV?;-V^C4x3IGrCCay#O;H<*79oZ^Nn*wqh>L^ji`$sU!-7Hlh~6fG}x zxz%1xE`#Ak?coarhNRP#693nw;qvaof-1N#VJ8C&2i#sx`*B`VxBlzL z9)&{}mqYaE4u1JO3m_U7c&*%E^a<)J|vd96z|GgM=tMNWx&;&B1 z>j!op;L-@L+0ZR{9V5$K^+2h!h)x$WLXVb0JGVsIj;%pUXGiHxsg<0#Ij=7Zf|Lt7U7~9nU9N#Z zjhEv}6YNil9ofWgpDKP24#CK7<5ZRapb6mtZA-1J{%=^tDP8kKw8<Sy-*|Kdq z;cxe7#$!d+%ssh+o`fDDcw*OsQSZDd<`+UcjSS{nz*laiYArafg~?mz3x(_tJq~t8 zn%WgJAIhcq5z_Wsmp(Pd;*_{|4xaOmK)?dFFT+U$bvyf|Ax{7PUep~x)zANG1=6!I z%v7w(E?jGq)^m6wsBCOPsQsP3l|c1-1Jt&v7lsR(hY0$0IGyD&4?6S$JS#u z(E#N=Aa!k_l(^a09+g1nG;zkdq#U7XiVVm=WXJk3{n?3fA$X{AK0_pGjzNx=PTnJht(aMy;RJ) z(-sxiT5{@JNPC~(wGk1lwVs>A$HnHL2lC>hSa5GkIB)ibKQ!1JH!cW#ENKKoO5>mc zEZ155yZV_1Gg0ooGf@mL!(Nb9%s2=%GZRAW&Ph#5Ri#AY?j~>#e_xQ(wZDDOtY+jT zY~KvStC>jbLlyXxZ1<3PtP6XY#WU$5T9#$oEjzfT;UEL>P> zKBlE?$9&6?ZVbQFVaD^EYOel_;p-R|qvucj@b{}s2s&t=SCfo-2V%c67M3M^eE;KZ=5Qr=0Y^4=R)GIc*U_I?*#iF5!O8<; zi(=PEJX+N%<1YAhYfop^4X?*T&qAGw9blY>tD^tZ{o=T~8hXX|3COY77;xOf=M0q! ze~#o>>g1&JV{d<4SJ2JYL6{hJwj`GEHSqkln(s*9yST4En2P2+$H^Zf{*V>MKEn2cfmEf ztT}Iwso|rDIJi$X;Cy$i9ge8Gt#kt5s}K?3gFn3c10?{q(&2M7hbV(NCZCYCA)@CZ zh74)s)p|hM$I7eUIY{R=LL0ANCetkMTqY5WqI;9Vc%dE^8CX6 z1zGia4~zN;#`KduTS=)fz%!vZ>~b-cgQt2NO-rM3r$1Dvc%Gdk6qZAAKsBpk-rKev zZhZwc6OhM4L#C`E`L&2xYU%u%VezuFma4SaB9hrqJk02?B%}bFs?dW z{He@AyF&Aau*YpnWRbAv6t2tXQ#O>9wY4=j*ZJ7TjjZ|VpM2AlX{s+9SSPnSd(7UZ zbgTgml+`$}PqzLBC(%~JqU#BzadtVxSN@m#Ei&f4XB&;1Z_J;n%YF2I zKi||t^ENdNI`!&8C0+;p-A2ijJ{yI|ewXV8bR%JNh9om2v2^QnitqalkK}a;*A|mY zeOEw7Cx8E6`00I98907_?4%H%2qO5ymiw?MAzqa&ardVwS$06hhfyl6iLCQ5`c=|1 zY|bD=$j|u9I7C)4(}rNZ^L$w{e|KDOm}n@?h0Rc=A%ihneLPqpmhfhnG-H;OoQl#w zYuWWjU}c@UXxER~yajx{uDr1=V;G<=l!OWWKdw3q34Tekwi4EHW!UNGa}DCs%}@8n zMlidvjl;MmQU7MliWqzdP+ov$%wPC`Tb(yhvYlexV5?$GRFQQ*n2y%A`{%ol!Q z4&!vHZn1+Oa4rIqo)+pNYhnUk5St?XbKhjl-Gy)`A9`v~^CYeKQf=ZPVUyhthWRDN-ca5U_4xT}uy_I2Psit*GF)k}PZ8{i)>KYzh?VSTHjixO+lEr8(Ll5)U;9TZ8# z{aIm49w~~_oIApa_BLdUT=w#mSdf~MX3eNyrb>g?h&81+4qf3Sn0n9jhf+R}ZuPLY zy+x`QnF~DCWuO4MCI?tz2@BVw6WgBrzAUKQ=qv=OU5NQ%e{m?f{y4J_p1L?p_;Z`! zAt&dR`*PMZZrGe&8}s3H_aIbVOvv?Qp^R7f%TVmnR$Rjfg$N{#^2GShehTqXUiI;C;g$W2paHK5zgybC|~WPs5W?V-M{2d4vPC}oqFdR zzveXlxJ#3$eRUb5=dknI#ouR~TcqZZeyE*P}+ zd0O|`<;`1>X{N8)qDsshaKkQ_E2N9l45j(~`+1YE9V&E_GW`ohA&5E6k*d>&8t`4e zo-(crh$^Uj1ZeSk7)^*?6Rq>zInFRYJ}_hnAUOy}LK$UYalSnCSYY+_^>tkBSOn~i zH|CBYBBeI}JKTFP6bPSA%=-7ADB5Cm{0=1~@508zOfKiW|kMM`pis-i#;}954o0o;U55yU! z6|Gticv@}us-FFGss_93*qx4m?nrR6hACf;>k5_Iq7!-T|*u2~Q|D`I4w zCe*YAPU{(&!op`&H9Kmr{|YtvP?zSnxC`Q1*sx@FI&`S#3l_Y0=?%M&#G7$a0MJd) zbr&MC9yKO5#x18Smwxd!5v#Q+Ng=>}vE@&_KL78#m9(MC1{XdNEa96|?x=<6x zzAU%ftnFSg{FcLnDfVC3Adw4u5!mr6eRbRry6Hqs7!wWZDN zesvND9h37hAIp^jh2R3#klgJ9*A{envbvmLJ>!OseFJ0M3GT2?U{u-NQH~vG07~3; z5Ul&5t1R(#bIRi@`p^X)*W1Z`Xi{O?M7$$dK$w@`v(BmV2?JcTVJy6&9B2_@J+m=0 zc@)JbGHxR3g~PhoaH%`t+~S|ZJm+z7QM@HGSGnv@2P^Dq9wa)1Uf{J-ONP(Me|N0C z?l5lbNgk|P?J&#IWe*nja}IrcRTr|{U^B6bx_oeSWl@M1#(m5ExRovLPr+~!?s{|9 z7yn-3+2F?*vF%fp<}O4|Y&8gcAnbWC*Oqg)%_`NslZY)XhYRVN0oYg;ZP&CTwiS7W zkkH!iv{Gsl&7CJtXNb_N)8lR&fh_i?Odc-Mo)A!jg1lwow|Y<>24e5%&^4As9=G|0 zDzyf$-kIt-ZiD%jo(?@1cs(&E#*6_qTx^M@LGrMDag*$-Cc2;u=O7$XfDT$X6>f;g|u0c~0(Y%2u0P##Z|#{LB5a6Y)(=-QC^y6^NPB z1pkw^ib5)#IjBomeXyyqU-DS5P)ZZ_%#Eomot-M0!NrNMUJLB>KPtEqD-Fqj99)7{ zaPwwf!Dy-Lz3GAesLkV3&8UFRC0sKW)38ZvkL_ORpJG$3O-H+zxjZ%#p$YoUHg4=4 z{5xHK_IKsa1+HMa9F-LqBF^yX*H{xY3+`K2IWvIy3qx_2o8BS2`RZ&z|3l@8v4V{P zrBb|XgwW8;vRs6d;c;jv988o}T_xc;mR4-jb~Sk;Z|)(ym|OBm)3Fcu*dw~J-zBln zK=go$>M0#Vl$w^nEnZtMR1k&U~@+WL2iI)x*wB`Ljv(c=>t*cILt z{L-!en-t}=7YwJ2*K_a<@!+-}^cIU+2TPhCr$&tCGh#u zIrSIxt)Zb0cJj9(oyBzBH3I*JZJp6}8x(|c&-xE03~6GYoIGImT|k0Y|Xwbzx_5;?s*Q;?Tp;zE8pB>_DN@|LHNMYYrS{Mut4*@0=x#gO2B7aHU?!QGrL^>@sXDK=A2o$jn^eoF0KZzC1zjK}_i3P$j9O2p2G?XI#&TC^L@NU6dXJYtzx6$s|$!x_% z?ea35#`A7)(zc*o7C_6oxIZ{1;{Wk%T*bF!zJ|=&s9UK&nrlC|hpX&Fzo2Jyqq+2? zWvY99VSP~7M1nf-S@Jie=b9xzoyf=QJNVgh+~eie=er5RpSI>+_6wuUC8pGxsT`}d z4$%?1IKZd)m(hD1dP9zeT<4(@En7#V%2_G?Ee{>P{;gAPMil$znKa>M8Xy{|{XI+T z!-*bH*?spcN1oUBc>9fDDt>{k;JV2DWib(epX&BdG55@VsZJm-#(u@^7tl_FPN~Zb z^(&!q;kbt-Ok1t!r~-94JK=r^b@{`Fbmkdz&PBdS#HsqESIu;$=%fe*nAf+B^Xz6j zeCoI@K@3w)07?aZx@2i|ykMd?DwL8I^|=0X=?BjOR379J|npg4GI!kC}3v2K+0 z@8)oX$_nUdg#e}oX8aa?n1rDfJB2#&;tL;4axhF2h>+*^#oDTL)TVU`YDiQ?gFYs9 z!bY4MPOgb7Wus*sxhCkWCf_mjq2?f>V1-rDHfGXo&q-VG5-zMX==%ZRMo8-jIZ{zU=NRE1Iuxq-yG>&0jtr&U_;(`@nV%_#Uz%1*~C zyWO|B^T*-nj`5c#PH4dHud4|zPO%*)4mmDp%Zm}l8C#Q%E5E5a5jgddf z>gq5L46V0Ui#zZ9bztIUhHYryewPnIf)mm~&s^#ipPO+LDA~Vjo00;A7Q!(jajhdc z$nYLAEDt9S-rhCUh`T++>5VRR9?4InjLcUXiM!Z>a{FxH4r`eZ{k_Jewk3@|U|O%; zmH2*_l+6BK%DKS-veghD<}IKmiQm6~JF{9vBx4Y`Y!Mrmkg&mJ{;&^zTevN}RL+OF zKeDvpQHb{~tvOorT}_*>*H`RmH6`Zh#i~0sNByMMfEsTuUnv{t_Ki{+2SNnlbn_HZ zMzMb*?%d%u(&m8KdD!kFo&Y^;_h-z6wz=I%&qw6kHNiU1E_=2x1=OSNr+`Ntb&=!n z!T0cLi$3_>CbGb27X#Wgl=_xm$_bVO@VXn2Jy3^CZUDnyZ^5CL@XNKxlj&BC?;ZZl zPxr;S!HZB0t4nwkyR*ev z?u6sBY&C)JVBiv`u&Zndk9#VA!_FD_`qdbsw%UN@u-Hb@3tVo-!C3(~$BWZBt+hT! zOLrXR1V00HiQ{bS904)CU`P(jb#69Kp;Oc%O?Yu}5OCuI?t?i_X2MLCEM{bcnge;@ z%h{^c$G3>{hKE94n-?-=M}tw%5ppQvfZbjMkQDHx6FQ z{VVp4YH!X74PqSeOvhY%x<+9EdZ)<;^Y*|#@<|ma|i&^?dqQF zqdsqH0y~%~oiN%z0J_w{A5X?}MA+dg9UkYqv33IN+2Wp$8x9bn$ScG48LtDyiB`n^ zM6=-0?zC^0sgb5e+wKm*xab=U+%7=_e{l0 z9gVu0+?f3XYQ5G7Y;lZ30!aRatY{pP^b#1v>pK5Q^_6@GiYy<0cM@Oac8U7}P<|Y{ zx@k47p#w^!^kh|r+BM%sNwa@no1QZST%F;(Q9|^m$5E}Q70+i>G4;|G4CXIM$8V#I z=ZRMHWr+YIfS7n${T=!B*M!6Qxk*?pYOu8?VX4*QR(!~6f{J@)Rh>6?{b&CG+Y`^b z2qS?Bs7Y4L8Z9-wf~&nfFSwOvMX@3!0AfD)BND1t@3DLc?1yV=o^Ij2gL}emu6{b4A_y&6r~-b{3Q5MoHtPIE0GCW0+D-5ZgpO_3OfLVir*{H`2Josb@2 zZY<@zNv8`>z2m(6Q%dZzS9Yr_&~2-v(8T1cmlGIp_;ZT1lZ%tk$z;B6CtV=-0MZ_4 zy@tU8VWbb1#%*K4S3)2BK1*rgW+~e)V6EkMdD$PN;B)=<_VBIqVYjwiLr#%O3&x;yyl zT_50lx0)q2aOYp%A5CnXHb&r6$JqVZOQ74XoFB6}w)Mcg;D3@g}NgFM`NHTYTQ(*T3Rh2xMMgU=|4%k4nahg zB(0kV+j-EcP3UC*yu(H$gs;)BVu` z$4iCv`ps102VdQ1Yo$T#2u+wQwttQZVJ1b24m6zqKzNjxWZnsuZd|%Xap=o-If-e= zw>=D}TpB9M3ggC=9c)Kc^q!Wz<1rGeo#2n`l-L8pUN1HKONW$D{-s?0z9NR$fAS&- z>lPLLr!T39;qO!aCU#cc+F4Vg;7?mm!QOkqw|r&G{2unJtw-zC?485jR;HEhc6{Ul zkOf%UEbVGL?k07GKpeQM-tEZx>zZ)uBaHST)Fzq++_lv+Il1>-zb2PGfZ~YcU*+oG z^Zu6g+ix##G(gqaPhafa%c9;P%EAd{jeFzSEiMnA0-tgW`Yd8`RJ>~PynOwD^Qu)w z&&@@r7nsO90{raluSaJe@0!OE{4Hw~R9vi<8GP+l=8J8b>(~91{Yxgu|6{Vh|IAbm zK(^4zy=?6`A7rr81XUw)6vsIy8tUqM$haPDF-p8synZW;C4^M)iSVdM-^=KSJt zxJUY*7oeaDL;ruqjOD)xIhJmDh0uS^Y4TC0YxrnBu`JMqBuqrW^$IIQ85sel5f|Kl zzlgXPB>oGh5f>VNvw8pj2mY_v;a&hu62VmXfAX{K5j18^X7P8(&Sr|P2WFj!;z7|# zCP<}fdDgq1lqGmxEq}!RMmCcaJY;E3!K3Pe@^=(FK9bMs83euhilEEpCSC7(fq9`%puaEje!c8L+RQuip*@&RqFXAQZi2fe@Fp!V*goH~{{n9(@IL-Yl4IG8 z9gNpP!mHFalFq(cST!5eASC16~r&%J8Wm&jA5; z_&|3~c#C3jNcKlGHsx|e-zQHJ&0gT+#M84yCT!;dCSUd#IT74HeU{#I2r-}Un3gT+ zkE-cPGh6Q$H^Wdyg^;%tq((ACUpRH%FeU8)(g=!j-f)lqu6|sc2pAxbK0w)$NoUY_ z$I#V$PJkx)T_?QP?EV?19cNrLj@!+}R=k9D;ui5Y(h=@cIa4Mv6ndE$6s}LFSZZ!) zv}Eg1UX|xJq7C?e97Xj;FUXZ6%r`~MT;oPwOXA0bD{ym?B3Y&w1?jyH8ae@vTz?IJ zBd#8rL9woxpB|8Iv+|~NL;{278DiG>$oOpbWD0eLu5&3^U!QKpeJ~%5{Z^UohVzsOT@V-kp@6=s$yK{ zEd;%C<3i-!kHDPxzte%0IPP%G{KwkBNes$;;DgB%83S#X);*T8LlRv#Cr7Pl8j=7n zZ+B5tiYUQ=dcdZJLUpi|2d#+?}i*g)3}9I5e-qmbwM&u8Hco zY*6F-2A#QP(9+94{!Gv9=J6E&yV!nqQ_cKcEM-$$m~gpaZq)@M89O><2MxwWVK2V&gruLT=zj{jrL;M8y!k;JZI z&5$K)3GJD;o_qjo7EH_59kZfZ`Sbu^!yGxs=H!7sORh{0AXM|aj@%%)qgRLkO_1cK z$G+sa0>3jem96GF{h*@exB&m}E1onI-bj=4`5H3QaNPa2kMG7h`Tcy!?s@#8A1t&r z21%`he0LGIiw8xqL-BnXc+ZOon~`Z>d$ka}`e2 zNv2;YC6LWiZ=))<^ctxCPCmwbyr(thZloj}O*Bn>{3z)dbe3I~Ze0Yz$M#{0E6l|j zB-{>u(SH$k_e&{_J^Xsc(UQBDM?L7}yC-CnQNvm*Q&Ma;{9f1C=%W@QQD`L(u0S`# zOPXe+7*#dm_0o4+*HRitY=d3*BV9p=(S^-<5B#IEf8;bhH=mc%bj^)*4?=!NdZzCM1qLDUa2g-bD_6$8d@h!Na0z6k zVqtY;M0jS7P;pnuYmro!`-7S&&ZKmkU$ig1`Pi3`@gpncQats(jrzd3BmRo541Zg_!?@=0B_~B}@cW=Qo35?j=4gAo9oCkEqUvc7y$EmK87Ctp zF{sCgg}*4c#$L3>zq#$8KcQqFPcmzoqh>N6LluN|DOJ^$gD)l zVa(~&)OR=5fwa(j$rKP7if|;FIY-t=0%bW5bj<@ULy6CXP_u9!;)UFq!_o^ zkee>;<0X~}{=_Y_;wWH&_MTdjK03-tgYAZ4-O$GnvBkO}UNk>oP{S4`fB;6t{m%(Z z8JmqcEQrjoEmexA-Z1)QEMd96Xjf6v2%WP;Z8Q*as{=VA#fIJcHhu$ZYH8~|N2%mX ze=pRCt?*V3pS5KQnU2@y(U9;$6yLIuf5^w-JT1Ak1DSijqNW0lu281p)X>1oU!L-b zjy$MHnk{ruawnRUjnNjh&it{GlS+Kh6mgJNLjF*5TFrW#XTgv&x+KE49*nw}g3U<6 zNV!BD9{&D&9!tz)aC-10N)?|L!M7I#$f^dR6Gx={+5j^(6h0=b@1riro~?#42`|Fa z($abk8fB~a4ta%viWUtR502q;w)_;z`a&jV1xJh_W|NnkJD0cVA`*IiL2tgJzb@b3L|6JzhmXy9Mie5GehK(!D$>O42i>Z;?aMo%F4>pYAGuY52+|zEG#@&k9k`6znH-)^gAnm z`dOv_NDp~cL4=+@t{GJA_F+)kbPfTr%Xw~4sBqiTwD`_%LewN~*r>3_bUR`^6~Rov zJ{!#w1dTBdJ$S^nllE%at05}Y~VxgdU5s2rZL-;U^NU} zcH=*=WNLr==FOP8Px)Y#PVGPA&}&V+s_pv|LejXotM&R@hyoG1?zA>#d{W-M+ft=o zedqmVv@NfAO&j_#x8r&CV*S%id>7H*bU6}n9Dymuo0`U|#(wK50RaKwF^asAFD_F) zNDETT*qjz&Mvc`a9mU0sjjbso=I;zTYKvnLM1lr-hT`onRmWP*$GlZ1)tPXE{8Wie z2d>|t1e+Ie+9Be(KN)_=j%)_$ii~f*xgPX8(h0M7GpX%Iqg&P4O4HlAlcJ?Fgs_MD z^-uS&j}tmZPf?qr>AthY{#fTt*V)oR`a9`GxI|uE5RDf>ETYEnmWFYWTZ2KFt!5|a ze{uF!VQqC$*C<}x9f}5brCqnSP7}~$E<;5-R%j^`C2q&to ziA>!(M2W2QNn-znJ9FnijRo>q^F;71>+Gl>_>8A+QI z&O&A?gkMw1N-L3SSR2}rI$LFDOG0@|j+w-U;mPM2@7nhZ3qdfRPeqk#`(t`7tGn;9 zL65oJ$Fh>yBF@j5f_r;>E5NaHN7%*wsqx0YdUBFihUKdkZr$jftG>rR!4ho!!ZEFs z1Q!WvRciuftyE$@K9!4aFU741%AbPmgc(ewU za*JOBwD%BX%ZPV`YmXSFvOsPfMZ}GKN`iv$we6u;`9Z=nv~w7sk0PEJ z&6%)6+K1&DI7T^Yl?TtRa#t7!6k0K0b|`0sF;O`+^p#3s;9F$hM0h5qy*Zs7xW2h-DyQtHehp!1f)2ctF>GW^)g%L7dLPqA?T! z2Q&Pu6O{VlS@U|TN-nu!-HECO_Tk?DVbJ&h$(2g3h1Y#RC7Bv|kQg&XqqOt<&V^Gf zQ9BaNk&}rSy{)aqR@p0Z0S_ccLtK!LK`&ns0^tjx5(NsyN%Q8(h{R!SzDuaZOLRmn zsCw~K15a%cWorsvnjh+GeMaWP5pZ}@+Dm?=vUT36?b!p zq#AyC<+39;GRQ47*4FOlRcd+!VV#_Fo~VUys_S|Wb)iP#r@J)$<|%9Bv1F_26MOv; z0?%4cttA2$o$%1Sa2AI-L?H6`xAyd}xV-Y%*IEZuJ2wy8qQ7vBDSIt~_(KV}#mJ|z z-+UrTj!OzKAbg8;=P%O5iBsd?2%kL*40_)6NbOjl8`r-%iDX3Z_#icR*j62n={pMi z!7cy&!9?$oPsdJ9mS$(h^HE7f%|U(nqc09 ziq~qB1?-y{7rtRYMW-4N%B|}_M-EA)2P~r<*FD@X4KRlSm~5TnuJpC@VH^I7u3+iI%K{#S$L#%4hzTbElZ$A!^iLht-~_ljJOShQgbzp>S#8 zC4;7SW^jgde52#0DKh|J8Y6dyl69$U7$O}0jsau4o3cvxN_C63rwXM-B({`L)Ji+f z-Uu+J^xutpb-(q3pA!|Sj)&qjk&=;BX*2Gd_fL%zu@vFNpmt1ZYoV;!gK7B7OZ)nK zAq}-jI{ot%_{h4-KicS3hEWrg>l35lsj-(6mDpqH@r1)s45!nxP8bP7);0*^r3T`W zj8NmXsWWs9VfzwglSL|Zs}ftX_;#^(+I%M@6puJE09v%*H|Wr8@j!Mabhv53Q@73^ z{|SHC;BW6s_-7A(EBf0I?-f6#Q`)3e@ylJ>8hg8wJ9hrqiBr%+yZ*-xo8}r}G+VsP z3eA`09pAffDIi28ZfGusp{4r@9BZg`D5sM84O>pzC~3b|b<4fzvtJoNQFP!&fRWQM z>x?BO`f^l!aMFa0ct@JlMaHMrWVwdL&4zXk;Po06)v)uAtj_1r zWawV;OH=%vr>WWr>kH;yd`zs0f@{%4)qp9(`Oj>{;+h8Cen3lj8lv>)f}s2SaK4*W zLL@*BA2QCz^5DWo52@Gh*d)iC+dmRM$HH$^%la}54q?6PqrlQ7<_l*st|!{%bQpib zN2oAdB1WdFJ+6jeE#R`*15`331LQ*9pyzch*@rJnAXk8^Y;a8H)G4Q9`+9z1;lXlm zW8qwTT8|>n#Uoj8iV^<0jyH=cexMnTeRCTCxZ5yqYB(h{hUYvCA@YQ{$OI6zB@Oyd z8G1hu$_}kOG6|~YXguNuJEt?N9M1%3@E@nkC<-Kisg#@88FOM-We3LHKtGz$0Mq@c|(0|JOyJ0Z6B~G2Z|GuV(te zVp0QF^9~s_y(qZ)--o%q_nWZf4hFLH5VJl>A)G|ZT$M=RAfo=us8T@*Xs!k4jq1Q{ zfxUy_$fdCnAdZ>CXaLZeD#W1>L>=b+Ee1e9<-eM90qFnDzdAso2JkFCPXC^wBo%ly z2C|jo+}n!}_awm^xgg{_9i>3B5XSHQ^#R=Y%%k-1f(VFkBj-3F;=5c1I6{G33Zin_ zanFJ=xmW065?IY2ez7F8w(RVf`z?UR)hbdl)!ZBAZYNG;tc}G(a=z<$;HEQdV?|cF z+77K<-!n2B#szAon`SBF=cQ1OyHuePOwOlA(y#3nlc^@pF6tlyaqZf=|2RC{M2ba~=J6!mj@=_wFsDcW|JQW>t6766*htDEnxWpAf zB9R1hu8@<23R(ABN~qObkB1zqN{2m9z@}{juiywBmK#5U)|(Ms)?UyMVLPa9#m-3v zo&Zxa;rXt(VI6eHT&tjxHlZw4lqAty2)(8ebh2(wFlN*hs;1GiS99zWB2;>)T|mxok_qORPvb{J5Gj%Iz)}6#-m=tqrNOK7$sb=Nv0y#zh{Kr8OwD5W?;?Ol%1N~KTh(<8CgPwsy*D62=HH&Cb| z%e`SC{#OQkRDckHK7L$v1egw{h>gtZI0;%8a$4iHWr$@k*3dq7KbdxJvR|E+%XGAJ ziXF38iI@8i zSfUXApRpGUPN@pcY>PHgp|FV^qWJ=Io<82%%k^0MijRlPp3Hg zYktbD>+5IK=w`)9lX<%_;~D|-15kVFA)I_=ms^B#XijTK&rWtV_V@x2AQ_VdoB+9A zBYl7IDB5$_vVIVFFA$ns&MRb{+8%KJDB6+xrHr6C+ST<1RZz1~5wfTe zJ9WlA0o^>Wxu2p$7Gg&TLAB_gjtLPR6;E@FI4G&8(gku%9 zscEk=z%Ozr@USnBHfS%mn+Alfx=xGBDCm>{=Q}1Z4+82x-BQ%cnvg{DyUmwPL@l+T zje^3yBnEbWU-zF$rb`bBRz?V`Xz=xx8FgE2Rd@-r+ie@S%J{v9dCF8(>33VF2uCYm zWX;$O^pI=8xQC1~sL<^jWv-NfpqD|d5f2nV(wdK|&@B8D9^fJ43g z*VkXfH5O_eyCV5M!_}Kl@7K1)dq=_tn4P~}J=ed@%GcqI5NHS-qr6YpAnZVknaqWjQN0{1IyLPg8nes84=FH<^ zhk>&TZ!__Mal@R*xq||Zgl;1hUy6pDfPS=x&hM|H5B&C20B>clbHbLa!1{i}e1H?@ zwp+KEQSiud$O6)v934oU%#nHZ2mlPSTJzNC)vqHO0ar4^cntMWG{s#+K7D&BiA%U_ z+a%_cNSTft185$kOxU)*|A9%C^5)+7zeUF1K7)I*Q2SzD1Ve(V`b9qtMV)*|!?|<3n z{Y0`tsmWIkh!TO#KbJ1@?SK1yfM2)Dg?m89_|EC+~SK1ZR?n{g7Wf|?-szc}v6-MO>T z5uPf+s0v6SmV+95pZA4x6ZmR;z@b)Q;a2LJq94?N=%7zWMigMiy^(P!FxsQ<;_ zI;5_(|8XR+b;VZiU##w>yTE|kQ$O~UnYRAdM-%O))K2`H)Bb=wdAjxY zLYJM6Ha54-97Lb?u1qJ|+sA%h%zW{xXfH0N&47l)v>&=VEPK8l#J^6q9}2D6r6IZ< zACbBA>`>tqboW2+lkrEMuDCpX{w(_vzxB!{AYNV^fM%&^SvVv`VejHH+xqF{`Da46 z&=tT$uWUo*!kq#gv>QCBQ<<-`nu@=_#S|&e$XUej5JK*12%< zvhXYMA{DJs?cl5=0)sX0)3R z!((rc$I1GiS~YBp`<>s8Gb5jWK6^Te#d`g|lyqN@)gR{_N9p%8;u84SrttmY_I-bb zyevF$HqL`$zf^A`fImfsuwzA$+{_&uw``*a(>^$HYMnxZWIdip8wZlU|tir+5q zad{oL_vhB@O(0o#YdrVVBnf3l$e@Wor$5l&;r$w_N~ro6%aZ)~T>tVRi7n;>aH8Ph z(9Pd9qXhKlF9>}$JEdGa&@Q#^++^42*4N`dKD=>ZG7_rO>xt`k)W7LAJZ|#6c(T8^ zCV&RE`2yn`EaiMJTJ}y)B@gj>Y?Ssn_SmKsF?9|1e=&j3*mDOF)%B~*!`L)k?ULeY z_(R2(@TWh*?@3v4OLTn?qF| zyX#<_y~;T_bl+9v{!cc1{+!hpxmrVZRz>$(A$BZ?`D{CZ?`mH@v2+GzZ=QRRxU9uJ zY;ic=yZ3qw4z*z&EWVEJZO_{Jx{w^Etj4wSy+LuWRO+W?^?i7%^)m(IdtiR8ioY? z6%YmH=}t0cydQraTYnt>k#=KF(cR7RH&$Q^@zYg8zt6C|Rp9ez|9vs!B>Z(xq1EO2 zTlv9FxLag`2s>=pRSaAy5fkz-XZx90xO)h(~lwx zmYSG~Oe~o?N^=Jrta2Emkz~u77B%=(pjT-LHz~;2)i%{3Yi|9Q3Ke{KZ;Q$v7BHsH;Z|M$(ADQwdQs_|;okDs6UN9@MI znue5kz@jMR60r{?wyghlM)0`_f_l>6-#}p~kwU11DO9-xF5Q^w(%_8i1xVuwS0*L@ zd9*_-WKQy-7!(8_t01&>f5!i0*_elw=LI(NEe z^eMsT29)GdiIf=bQIS9S|=mxG?<^$(AuJnH~O|LQ45r_P{Jw@Xxm~y86QG)E3 zi*n^OKyA5FSMX|zK#T3lM#VsH<91N?wZ@>c#`oo#L-f^e|A*?0b??MZmWX@V${D2J zyHn1BpvqB+4w;)N4viC@eBb0PtTw4pAgiC^kxyWM{_6FLPi>NIjjsB{<@g%Vx0SS# zkij-!9(tBCYyI+bSQJefw-m^Srtf)(QrBz0NE7q`g0ReoP_=d~WP>VA_4=SOOqmM) zKB=E*^%Xm#nF7K9-`52^f?&$T-qrn=FJBz_(Wqev4^T0_7D_ZoBGF%A(Pzl_-$*}y zZq5!oKYM=1R{G}+fS`#Y8sB~}O$NESrcPQ`$nmDd0jAS~J8#Cah)ds$$p4nh-%cnk zW?&{=DSTXw6i^=GjE_lulK*h2aM1&YzJ3b;Uug>aTQ9c)p@Zl98747OMI*699437~ zetQAMo%WWN#pUII^T9WSvHN3p&<3=g54C1iDUMpzyU(3${n^Xsk$TE!Gq!%8eTTbw z$X@%R5H(+UyGa7DgXLXRU0A~~wqX}`YRW#92^=&Xn|qc5oA*+4+Y0UcQ_9rgw^?ap z%vrjDL?1w`pcx<=`tv6O86@uT{{4F*HvJOqYCtz_@WQCq_a^`4njvEf@j~#bv6d2n zc0d?nCPUKSqu1A=t+85m_b8!_X99m>unaQMrOj(qIA7IJ;Zs~?oeKd#N%bjptyZS0 zwbVom#13yqiA0@j9mOD=z0!+u>X&Xr!HlV;l@&?;#Nf+IH^z0KJ#TXp^UqlbBAS>p z&I90Wfhev1w%{fyVs>`cE01Y-sjhw_!smR@|4W_3?S8?qcn~ z=ChiG;=cNut!J=w_(9CnYrXAy@!bMA`w9N%@??MuWSDeE;pFTy<4L+WzW~8pP@=O9 zERczP+{)f~8q>Qz!{W)NdWqD#CT6+&maf-=xQiVOvaksVpZfN%3J2HY2>XSI6})Hg zi2F;f^GC{u2nOFplL^Rw!TKZ_iMn-<@Xs zX31TeIUq_{-FtNEam?$erflMh~;*x6@hnt*fltInb zhdWJSzF2qcG#93s3SF)L+okUFM9G3PR`|FCue?YZV*-4ieiXVm!ewOTQF}V?3v`#0 z6C;Q-ZRV>*1M&zV!Hf75UXty_yu(Mhw@hK-cY>UJ3J-Wp`k>4lCF1LMW_(-|a^tFh zM`-E#p#qx60g9dQ*CC>`oUw-6*aN8@uNBl3L*bGgwc_ zp%vtQ{C((h)O${y;Tx(CdFaOa@*+S=LYPw9>4R8)?YigOvW`fU^PX%+i=93 zElS$gG>aUrS=8U=oN}sik4*MdetO5##|iMyj%uB*)KXX24w&JhbR0XTPnoTI(8ObY zW!g;u)i|3Nkg?#POtxB6KkY?$a09B}QZ&@k;TZzwr({`%+O*kIk)$2M;v-M16tSb` ze2>L;Noxa#4dSv>S@-6pdW_qA{QNipl#x@jmOT4chf=hK{Ddr|Zc{Czw~jr1kl*Ms zVG_Zs(hYhw1X>uC9{OJoCq1=cBdu-|*=h(OYr@a5$NH6q4Eq9YZPDH|8RBM%C_gAT z@@GBu_?WX-j?tRe*2Zm<*|0NnU~%&6x!!MsLOHMzDiMHT+wKsx*UPm7NA~r#NwbSE z^1`8#^oy?w&XS>qbU;Ux1Vr16Q$jR5CjfRjer$=Q)GrzpUxfzOmW@3+kzplEB)?I& zez{87xlqlXcU_0iy_H`y78=<~d#1GwZeZtJ$C^B#58)iyMTp)ELfiq^v9@B~OX>j_g zsh6TK>Fh+EgH#M1ad!A8GIJA;)NMkIL+ZE{_-#Lpz%=5La6jgN^3nnONO9vC@t-4u z1NKj|yh5pZ<2~FLIlAV%Z2J>kCkbsQWwQ3ts;<(es!bP-OMS9t2sp=eS%6(_{9yn~#v z8)z*V>Qri-^E(^T;z$4N{4=6>Fvjy6V)^|~!isNkD zIz1M}OC0p|^$fXUM|d7n(mbK}hBDSSUI&^&IwhE8A1yJ`w4kl=PlVbmibGaQ0?YjG z7X6s2nWTMMg=(S4=;h6%;mn(Tb#;0LZ8%Gw!P7sJ2aLn|DRP-M!OM zlBK^;9<;c6dH>~vP}~4Mc54~VpHZM|L`Fx^zjjc5-~sh0>C`IDCKs8@9kAXtQ!?Vba>7SZpCD&lLs8Y%HCjrP&6cjlOHn+Yb#juv#@+m_ z0=r4dsa3#DGMMs9xsrW=EIU16LqW$vjmDJEsgP!y zY0jnoY4+NQw$@0fwYIzDq)SY>JGaX4+LsE6A=QYDiMpG3^1S&!E)_0yE<4%3>&`r3 zOg_TCL<7aTCw%WpxEzJA6}sHmF>6Kv<Ff*1C<07uD%h#Qi=~8~@ zz9o+qNsD4`9aUm3Tt0~^5KU5055w{U1P(}05C>L0J9@rxQm3)ZAA<#t5GlFH6(>q@ z)nuz#UEc#rcKVHFy~EnJcUhIs?b>!sxjs%JdP&{$mzXhXFh7xt+_z1{ANHC zHhbt<&O_3waeR$9txrIpXy=J!TexKYPd?eOOs!NyK4BpVT2|_&MI$l4Vv>TAD}$$O zy=b2{e9UE==GBcRG+_4ajRa1%y5tDYoGGB9*znHKOLp#Og>EYi2?{ZWO#KvW`CI#3 zF7jx-oIF#;GWBs&*k{W{>rW6*dt5@+G>s}=3eiDg4AQibV}(*pXG*(B)VJFGc$QOt zJcX!nT-OZ)=65cHriHk1Kj~r+HZPsEt!=>S()z~F+q?VxqNl{+KfZA;e=l*zv&woM zpvEv)JZ7q+*?M3U+5N`5<`B$3yS&HgPpSyP+X5Onv1x#a_1&bYFAbj`hi;N2%ImBwYETu}J zG0x7~B5yceBdz{k3pMMH9ovx)ht{O0JMtSe`qixzCC4CKfE5M~H7`=7XBvHxE2YQ_ zc3Cl3Z21MwJq;M#VTu+WV7?X-K2$>0A3x^4&rdQNaI>V% z=%P1`UP?zVvU~zb7-QGh!IaMrF5hoj1)j49%8PDQ^#`L99lqEDnB0GdOiAb__mn>h zpR{oe|9q7I$$;?)txU+lfoxyMA@h9o>7%Qrq%n(0m7(6!qP7VM=M|ai^$qbNdvnA~j&tY1LBclqV5SSQ0^pM;!swc4UGsEwwZ`@4SG4B6)+&=DIcaXqZB zQodjS6Jx_o5>>Kb_x+a{t}c}`e>U2xooPalS|yl!R{KMe>@86ic(nT|q3^OEN#~hh z=psK*;^}=ru+|9W*Zjt)`d`nPTUt4f)r0?=bOBingQi`tF(s<(TS5y)-1e;NMr3Mj z2Te!~w4|Koo80&*=E5+f!gh#=>e*P8SILswu6C0c{mvX8Wod+#Is{oFPfoaW#eO&1 zk`-5_j7KJgi8w|dUC7m@mY)brtXf9Zze0ozu+8}y{Kkwy6(@rO+4fHT3?B8}L8qdi zF21mgLI+vkzf_t@S?P@j-4gq3x&dSnK#5kaR)}+NY>6@)#r(5ZSrGA?uWW>C(wiXb^!N9;s zyjN#O&N&rww3iU)?weIcIx#+_kw8svOkDf689H2_obbQIN63(;0=*S zyV+=dmd&%C;F-S-iIb&0vi8$b(-TLP^jY`R%WiNEVs2aQ9U9)l^Hcp3%Od*iC?wDsa?h~YBbuF22+-{;p2wg7dfSUxQ6ESViSMH?4dI^P zft5&HiB2ZkwiG6erh^L*nx!3BG-O{{`;iWvOThj%f@%c`LFPUlSiYG@$ZUSfANh{3 zEL$@2{rmULl#F^K5fdeRQ-P%h1N%ssG4@Rg)+`D$kB+j&RzEE(u6xk;*y>m=pp%Q7 zj$;5~yPf-2w9<%stBhdUs3T6ZQE7mPm9^fu)4NW|!uM(=u%fcgq{nY*k`B#BnSc%M zCT4Q&%!foY_5di{dXXpUXK zwVua&_iOZzQ47;Oer=cUA8jkn2pbPf?=P(ku7cNlKTIe`o=m0ZZQ@ddkQZawXMZPh z!608H2WX(8+AU7ge?Jm(a5R6+FzoV`G%rjw?=0&1bvIZ`V~e`e7CsAvFf;t+ZH3@z$}G(ah5p_zQIlxQs0vwH8IuSkl@nn=Iw zCItHSm-Q7^H|H`%QKif%;%%p_YusR9Q2Glo;HgQ@H~tahoBD;{gz4-m=62gcf^BbM zklVD@VT5#1uku%{!+OOI87r^1>v>2{5B{@b#o_lA6QdK#)3bMdP2w;qe+-2YcKT|3 z{J-<^a{C4z^|7?OXzerSR|Pma+Wx%AX25!@25$cnAOGv&#Lspk>GP*E3X!L!tOhgU z7;5CpoYWo|hM(#*mNHtdoen&0v?B=wk$++v|-|0sG_PVX3Zg+y@8#Z%fth0@e&5?ZwyXmG(a($Vo=;KgGpkoC&-7Iqtn|BY&uLceyaXiI)7#ZrF{MgyEo*01OSUwjHnS z=Q(7|2Jg>T()Na05UDI&tovitncSWHO3Stwetv&TS*}R)fA5`kym}Z|(lbETM272j zI_I5d6R{-r9^F5-oRraOs()=9|C%|t?f&6sm%n;2ftbw(_rhB!ZPL1V0xXoKGPZlI z^P9>tDVf9zABjws40f;LyL`Zo;K5eqIk zu7y4#T^s;3!Hg{K>!WCMZKyHqO!j%pn=oc!e1pEulQ^|sfJ-mZ*KOSCwhzpA(akte z4aj>r>46r$jq3!w9G45JlXdr*d&-Vd#=L7uR_c?in9m|F(H(eW=JlqSv{$b>nZraY zR~g%jrcy%zkibx5W%$63(f=-cO845geW_yJU^}xSIoiLlLcfsrdoL%$yv42@M$V}H zhj#k(C{pw;?|@bXhp-%t#>BWXDZc<389NVO4p>cP3L0h{6p6-EsewrN?iEJ9?hrOV zY7%*|0Oq{R))M-aO=Dwqi-xWb{KXrT2Mw0oonMb>on&ffe#wngx(XKyyr+}sdSKY(b?Y3D-oZl(TK<#vtt!#s7#nBor!7 zO*kYUX;`V{kS3HeWj=Sr#@=g8o#cRvBf*$dP7|h78#xoPoA{3S3rp#c8~~57C=pf< z9(=Xg5Ys2Y z345n+RVDnfY%+*axbLdV=FR4YDihR;8#>@fdne51@r)g`?ltnq+H99wg4Tbxk%pPu z@e>d!g47?nleqfSaCxhF2?Ie#Du-^EE{S7!CFVO)LJsbqOSuu{T*fV|^ZvFm7RYKr7X%5y`|RX(P(8wpvA#sR`z zfiL%m03;akW!F{kXE)2QE_mP&2?DnK-mk8wt+Xh5%(=>|%P`IJ*UStiS34cCvci4* z+uxm1+(qh>3r44>2A!lfC536FO-W0wo~sDQ=%v+Ur2bxb<&~pmbH{Wwj_gx)^#WC4 zZnbo|Gp?OISu!ZGv@Vr32>td;O;-Dg8KZE^)_p~eBTas?8PJLy`5RYsr<(eURS(?G zAzL+Bo?NF|$Lfq!mZcq!&)l{I6ZkUa9P(Yom2vNg>kpB={ith_==a+-KjE>a;&ah{)65M zXCUA|xHdNf9og3o+!-M|t-&HI=PJXw$W~7DiWZ^G!;z^_2OhfLSg0Mt=wy zJ4o7ai;XVSluh0kp=1w}#93W-vc^KS6a};SYYxz?CT^VzB^>_B?tm)Y?&mM}W91{i zFf6c{H1-r%PnBp+ws1%VnZ-T;+7XCwu*jTZ>Wew=+{Mxc35?quNo=o@=@bXx*txTz z{KV*ZA55{gUt9pbyp3!D7mN?YVZB{}+akJ0a@6DUz@aY;lnSTt=%{JyAxlo=|- zKy*n{C<)5!DR;S;<$CZ|9;o5k)EXz#RMm+lRlHTL)@f47Q)Rz4UFmVY(BpcU=rUuM z{lrh0b$=sy>=84yAGAJU)*J;ebIWx@Pj0{D469xMI+DrTZn_8rstgvs)lCwpPZ@?yKy{T&pn!0!sZ3?2(It43K z%CO_2N;6k3+Nq5&iSjbxx?V^%O-|a+AyFs52lPaZ(bIg4jRZ3mSnO#{rN{1(#%mYq zRN>?1>4LPFczwfpkD5@wDkMOu)K5>z1m~!QlfIh&6@*Jwsy=iVgi9kN{{)G8QMqbr zN^`4Ss?ua`v4$uRxkC0dJ_;UP`s8d^H0kCr!cy2T?_fk(xh05Js86|d3fC}|PY}C8 z5X~Xl>>r8ospK@MRjCs7Jlv=g4x4Pf9n)7U+#p(BDXT^5Qt)4-gqiUgC8CwM39UbR zAL}yWD+bS{a~N#q1^YC*-;=X;Ed2=yhgzBvq(Bg)rD^+ICC2gS7(>Q>-b*&%e822Vbgrke~(m8#lNHrXg_Vbq9<|m&ft1)n@F7c&Ep|XWt^0+xU5NgqwO5_V(I% zH%};Q47)u1*-LIfZRFkHUVG`;-+la;?G|Gn%LIWLcDV_(a|fh~)D=~HyzABm8V~K(yI(x5)obq#JmtU@MVk>USWH3_qbvau?uN}j)i89D&c-Q)KVAKr z2raMQpihBZJzHoLi*}z%e3*?e<_uAKCyE36#fImnMk=`|`2u{PIo_C=au5ZFbc(`P z$s}3XYy3W%C-{Uye0kySq7uzYZ!=aRO%O@B%OAor;b7Z6y|=9l+#lsrvl>RbAaR^TV^ps)SB=e(Z21RluobMAq z1j4+$5&lBiV@wa%D`p}S7+~B7179$Rz1i#DU0!Z;G-x_Ia)oW&<9)wYiYAFgVJH;n z42U^i?&ocOhR@*0c}o&7_qqLS`S*JzJp}QxL?8nJbI<&A!#ie8n8K7!5$1nSuIQ#) zBgIQDf1pH|AxCqIRLOBr1LJ~wnL^>tqnZ~Z`<Vd{D`1%;Z#9Wr(Y#lX24o@2qBW8jmhd59LAAaR`_88P%w7AW5jG{OILbV z>stseO^Fut!%>1Ba$gbEN8Kx_GY>3v2y#0$k8ig@#L_VAOEny9_+HszU|z4~rNqJf zb_D!bg9n%RsA&r&e0HANy$V&_Vzw=vn#ZYX16VT2tn4di+$^5gMoyXPVKj&|dUH;`RmT52eZ|8o7f0A z35Y&*+GW`MB^?jm1##qXa0p@VAXSFz@ol;OX;t^SCQ=G}-b{mT4uUj@=UocR_#s+$ zIBC85TBjFV4Pv$)hx*Yq5=M6)Y!}drx72be`sij%pYpA;RVYoVw7pcrE;{k>8rQH8 zT*ytlH0So-gmtAd9;p=Uk1k={iAJ>*RW1ma^o8H9KVB2 zy;8TB2rmncUG)d{(Ry|=rN;ka*DQh9{boZmZ%n6p`_FAvt)IL`8`~xlDg6Q+Uja=RT;afR$J?0cImI1YIplq zjWY0+K2XuJ6Y!O6bQNPx>j-I#=ptp#OK#Pw)^h8gnxEXQGi;KhN#b49GT0+eE2;gE zQc+o1>LT1M_+wPRUL_OSzOo43Z-xY|gNPdVYfUh!@{bLn2WZJgr&$Qh8OHN{zI+CC zL|5Ni_pOAD@!AWM0uUIptDW$)_?pB74al-?Pz#kTW=d(6O?$d|%H6}OPdm(2G$s8V zWIx+je282bWj0wIuycf!?I~+(b<;AMtHY07b6Z6xaGd~2n1GlpRz7|5ywtB2s3}xk z6mn+@>@lKRI^IY+IiV+v-1@4~P&zt!vX(w7Q#z3{Yeit4Ft4zCH~*k zL+bMkII;8hGg{U5g;w}G3$}}Zu%im%zMEbuD$3CtQ**W2DRal_>WRZ<-(Ey=?qFT< zj<=OknH=d$Y4vdBs|CqE6PYS5!M?)$z51n1N1kEpsBT3|Cj)4_x;gf>5ZCqj&KwQ) zZ;-bQcSx;6d*^x>%*7iPE$?`a!y@BI#nlQLR_z4rTIk;k2GBHqwftm|BhtS>qjNe4 zzf1y@1_p`bD+&zCmNmr_44pVn7CV)2yI9B-QSOCx{etDlgQU3WwW^|Bf$G7SIF=>~ zMaCN&BuJeenR<HDjYFv@aZqamk)r!UZIpN0lOf zc_+cVJzauZsJr(2Vu{y1Bq>Y^G@qRV%v#nif7klq_?co2#)cEA^#`6GSfoEYgMI*z z9%lVB2xKsy&3LYmC{T9NzDrPiDD!p9BAuVy6_vRTb+Q z0}0qYSu5H>lGNN8&(^MUpAsRQ5l1-57jk#&l1WEgYS-0}Jh_kCgm(s;V;>m07KclN z^ph{PX|))38w}NWo^i{)(fv#kR`Qv99MOKkJfGAZGH4zloQoHZ4KP{8C5R=&T>76{ zGd$BX-HEr4;Wg^=k|abhcC~s``^_=aul&Wk{4DNRfE1+}P884O6>))Mu>B{2gKUq> zK6OOL#GfH??4ZCT5w2CD(l+i7btbIfgL4AWGMq>A%FhV?H-5%PA-b$ciVrOr;e+>y z#ol8?+EO&6C`9Sk*&>l5tfP6Dyzu`zT5bLTTJnfrX_5>J8+_y%gB;u*-qo`98I~_I zi9Y(ZZJBMOTA`w>TvI8rVls z)~AkyPSP_`bVDiS!>M^PvXvRWv!;h^?cKbgnE=I(#Hfom>dMj0`%%owj><(ETe_m& z!!eVttij932F>nA48tbr;=`d7o66^0KNcq2b*orj-I1;O$p$5(-eYonD9c&^pQ4m! z`!pTrD{IE+>n^dZ)c>Zb)E&1vsA9F&%N`-ZLB0bK5JrF9R5N76|L#vsk-bEdY`ag> zys$EaW z<~m*s$_P>yoybFY(yC#={pJ3K(YuuF%Ddq$_~}|NJNVjaXX|+L~9JVSbszaoB9FPN`fAOYS#SN9Tuku%yD8zRMf=TbznkP z)U-Lnk{cJxH~Kw*Wz1@~ia4qg0JX4V(GNPPodn0N(7EC`)D>ymKF%n4tTJ zpLYD&I%67Qq5C1)xgT_O)>}MoJrbmu%$J;W`*D-4ASJ?asIdS3J$L@NHOV_pG2wEm1W2TRrh7SI z#IERXe66df`kM`|{Z-~DL}y>eOX{%`)ZG|v)alr$U0z>X%P*&I6_V~Jq;8;zC_%U1 z+!4Q|;H(+aaEVy!;KrpYc+AfP%sESZ1v-Up^-`&(QBho;%WfP+1d`5DtA6`=HM3w( ze3he2!+q(FW<1XJ)5@64Q4b`wbn=%Yl?AUaPaR{$j&7Zq8@j*p=dT4H21y12gEV~~OpJ^+ zl4hCjY8&o^qX8jZ7WB<7>n~zIE9!nWoK}U`lx3~O9AxRU^_Mo5VhV|-Ov$g_80Egz zFyra29JNX1)vBLA<(&YRRhC6;>5_5Er)jiFPjHiB__j8<-(+d`RdqIYb~Tj-)1I9C zG45&7ujM&tf>?qWbsSpgB|$5QzLYbb0!@3XegUg7llxQJkbUy%4BeI%)(q%_k#*>M zDHDYPxi3--i)*ZI?9a?9UYfG9c?)Yt7$Y>W<@&|EnJthyl|pc`QE#2HV-Q|=Q`Tsj zmQ(x^A9Zrv!}K?BSz{fkln#UQ&Cv)Mzq9ES+jQGsK_H0(ib@=T_fr5BLBVHg6bNh- zXVH5=9$pTlVQh>E5ih5{I?NAz>4ozHWYmGN!Bk|xnn%kaV}3EFF>e(5P0xlCz3#{! zIkM}zrX=)0Fs5I;;mlK>Ji%+*AO|PQ{h(mM3(~Z&Aygc2N=V+c`cuHaZLm6z?(F={Z2znLeZ2s3FxNScl%FWPbI6nuDU?` z#VUeI&B*SjwPY@h(!~LqyBzIksb3d@Z~4&(JZ$FW8^M^(L5}P!y26dF*lRGJgb|%q zPAd7(0xnXvIqwuGLD-1vefHg?2XiUdp*J9qHSOc0Br0U_0CfNfTd}OLdp8NYhBgI? zgOP$8jc>^ciBhCX_7-BnMcoKa+}a=Czfvm%)0A;^m*d*kQt&re(*MSiw$iAal8p!z zIUjlU(EQzyWsVPPK$i0&_D4`Utca;mF6ZR{aw+R$4Eq8AOufeS!#gmAt*ed=TJ3FZ zO{>3+zr+h95xN3zB8PeIsYcFJ zUw?j5ND8=pKdU)*g$i`?_r7VW(yp$qsuGJf(AQ6AGe9aLiyZ+7X+YwcK&K#Pdf>~y z@wLl|zo?wwV?TQ(1z(k`{sACVTW`z1dA--4-_7Lp_ zo5zo#p(`#o5(rHg=szMuLOmh^=-0RXg=WX+p5Y@CurPy?W;81r{tr`c6%|LcHi1G2 z?rsSQ?hb=PAh^4`Ggxqk;KAKJ_~0_QTX1)GcX#fbbMC+Hed(uOd#1a0_a{|fm3{2E z5EN-9FOIp}$@>qXQS9rkS%`}4)Kr{+7di^6@O}3cFR6u)9(vYks~2(nB!%VtW>PnlS5!yG`^o}ScB?lG+fTh)RZBb^|9BV}gRgwvkBit%B;d5Or2&wiu5?u&gVBJYcr zBEu;7@JF0>M)*)B0w;T15ZsuTZSMx$V~FM|R#x-(V>vsEJjzX5aG9l!XU6*b&LnT7 zJrBrt?l2@p!k5@56S-^d>X>~qmxOB@|NJySa1Q1jKC~uhUsCxmJM>|HR?CK03T@Ml|3X%(+gFR_p1PYivI{VDe2& zz_>{o3g>)I*STw3(}+A_l@(-3^x4DdvIA8y=VOf)EvgmX*))BumYRsS+c`;y7SCC`+qwoijy%iL;3CCO zz8iYZ9A3WNWi-0;3!+vL66MCycl%x+zPm4oH?F+Rm9p!{obsL;yEpjzL+oT zckY&qrsovx={B8=%l|}`yo`1ENjp`b@ zQ1Mp?8P0a*==C4qz|~eKpNpqlIWJ%>H7Z182rbcYH(2@lQ>J|JBfmb&CT6(UmL{a( z$7j25TKUt$k;AE=(2YzY=G2q8l@E!o%&Wm+lqj2PFUoIZUxgNz!x-l~K1;oh%4Vy*KT1G1#TM7O7pNU^4yvX-~IU z3I^L5i8Yk@dHcqS2s~M-@vG?*Wn*Cl7?zI9ItfDck@1uHX*x^Gql;M#p1*jgU0IG~ z%Z{B0al#>q!M<&N(zWAFDAN-hIhhO>4Ups@!?}iGLRK)DC^We@!~q}%YR658w!cF` zUYF8Bv|?m+b&5C}vzuA-&fou>o_kBHxiCgb=hE?#WxI?@<qwxzqZ_|_I+kRvVa>0LBwo7p} zHBnLv$M=Uv$QFRg6YZ2JeZdw&ptaSWrfQGt^UtZJnko3a*ZDVMHtU(G>?+q2mt&Kc z2ZGzm+%Y5`T%>=2TdWD{tpfNp+HW4iPjhiF{MnY4vG;43yRb?Sbj6kUR$ZdYHoDOb zaSjliTD(x^w05#fl#mq(nI>P(Jl7RmpaXDn{PIBMEFWk|23;rbFU!&$O%5$TUJtjZ z*Xe3*%vvfr1v9!Vp>T)BH5BpERt+6hmziZ&&aEYt(Pi<*tsT`{_osQcYBNo1woT>E z7{YA~5z6l#YhtCW$oM%-NY!XRvE_H>71eZTL7gREYr;`?&nzB;fKN6`?an11>v;*w@;rKaiy zlZcOG1{^6;;>k%#jg1GQZ2*HU?i^V&5WV$GVyLv6Bo0-@3^T6dDfF<#TskVSu{Zww zG@gcY(x!FhAclgj4AiUd10bFmr2M*O4H+p)MBBfN~3p5H~ueMu0S>WXtrELvV32yfB$B`%ICv#bPN^NfO{%F(!Q6nThF(lyip zivsWI;@!3V^ruYrw&X$yRMiQ^@!6&fFNt!12@I#*w+gI!wmw5OKH4p5pO3iMP zG6zCJ%qvU44lWve3P#pt6@TDusOq}+VBE%)=suzR{-%on@9E_QQF{0CxQIk93v+q{?>6`yM>18N9GQK_hv$%w~<<6Ub-c}s^&)$dUL*)KVR(v+} z)nH!a?axCU9fHrmODNed$HYxS{I`admhQP1=a-k0S?lX@TU-7w=-<&tADCoGyrFzO zww{@Af|2s9$lo5mu~d9LJZbfMAW6JvmoUf*x$mCkYj-2%>U%lALqkV@5MhL9W}GnX zns&4!+)Zla!awKXsLmMt(zCkA28gUZyu3V%=b81ApC#h+0xjJMh9|MZQ}T~6TK3)p zNtf@T=t6{^DOV7#w`n|}<%_00qv(k8wo9E^aHc?NqkIJ-5N(VwOu^#bozPdjy8eT^ z7XhZ}1LtPlyx)9jvi_l_$l^OVTbG~nje3BMFYSg3Maoi1+8JYJiF9gzZhxlxW^!by zmnFtwKzC#bmxU0*z$NhD6d4?Bx@fmUvn9#Ks*dhly=3CiB|B=4DXQ^fg^2T3h!+#% zQEgtqui9xO-fCs(S1o*t!Pv}>WJ6?*TKFBUaF!R_=Y(B)>1(Ab9SMrW z+4*nzst0(t^OF#y{YuyO!2+HSnCXLAxLz2MzMMgkl29l=@Q_hUJ^gs_BqBG+&q!*l_BdYT7O;%)socN23Z_HQ?d8ELA>Nde>B=7Nd7m zukqxRL53vN8I?deZ4B3@+mgss&;l&ADpUAn+S$D-v+ z{}+&Cg0OQ$j=Z`YE^op&a)UA0*seI7{F&KY%A2mCQ4VLxbQ)AAw3~y%Z%(Bg!^OsQ+j5#D*DpCn~}_T)`@dnB)LZ ztyZZB{F$$2EZULx_tzkFUHTTO;1FEe)d@J_&s&n-#p@tIG&n$Tde~0{J5L!Iavzj5V4WZF++@U~Ld{fwOMOyIGzzG?P)z8&hH21bjsyT?naQ z2d1_7u>#wh^Md~wOC{Y-=~BgwII9C9D3iikim9IMGPVsjY0kU-4 z&Wi;-vH_c25pnL&qFyEu2XHcE;C^l`>7^<8L{XS$iGDQnh%A7WQ zSTsJK=hM0?H2>Lv)Halrl>OS@38xTYd5VD)sgTdX9 zz@B0dB9eE3yXo)mZ;S%b(av5F{_P??w2Vru!}F@T&;r1GgZ^6BpD+{BzO0@yazIQ3(y^v@GSc8qv#-#b zo6Ft;Xh;aa={xzbU>MG+xi(l(RNTqgezN@OW0q81VXh}3ONv|Q^rRc_sNB5#tX?`k zt^q1HZ2?6mC`eTJy9YUYZJ&W%DvXobJBmvG7Wpqs&-cZF=NA^Z0G5wqwl17Oayza| ztAZB%2};(gOPs_y!B`c1sx!k41kT>Uvd>2WZ6}x;2ccpj=q)LRZDRv4ED4 zmgV8&mS@nsIdl#=77b&Ks4kUKns?1|i+J3+l8VwR}K-El`za`zBTKHP)-4m-Ko%VV}dzd*+?iKkxXbr30;7}-Fa$%&ffp%Pd9kF zGzP6yJNSgkQjOIgpsF`UNlLn$AH!8j&r)o1!3vDmh661b>ulS+A^m4kp%P|GTPG)W zNrpv>v2<9rHs>Q{Kt{V^_orBkR8>f?P)$u$6~guWUtgLGQ-)&3Jb^Z2tR+)Ey2qHE zxO*rN3&Qe5Q7RRkB}NJK7VkA>gS6ojFhWa({l1H0l=etqi3nG%NOZ!o5FrKpG%NhCwqq-ilM?Ke)z6*!G1S?Bd8mwZ2{-m+A z$ZC;1-2qFEUTr`+L#g{`>F$8mRsBO{jK?1|(iq(YVxL7Yt5V)YdJ~~4Jei>3zQfpv z;YGkkR+s+VAq^TM84g(6a}@rZylkGI^Btl~3Zbko{P^7o{W+gvJ*5vKSpOqFB1{8u z|NTVtut?Bcl;i*&;j#`gn)SVkuqx?4Wch26|M|x*AVT!x(m3=TpgSP+XB^Sk(*Fnm zl9QA7M_rRb1{0X%--n=H$RWe_vP4x)P#aAS`4IP6+P&^T`2NM8=Np{{k#DBI-!LI~ z85JsIDGxjdohN5=4f{XK%1TTA4g*ukwRueY4Qu|KsEFwI_&%ue1NuLfu%>LZxX>LQ z2hRbU#1R3Vbg%1~mnIAf>}>bNau69#swcnH=I?_u|9A3J+^5W^j(^isGQaItJ9rmv za**3P8D4z_NAA9{>j`O_$mI~5e|K8|yFs|3;&ML~w%lq9zPfyRnf?73x;s9dZz?&6< z@J9On$q?e!oPG8h<56kQRaFt8qtMoRpUYOiu_4*E=KI^wEcu-KhzZ>j>-EyRC4HF@awgCKRSuo@O!X_U46_*8s68L_|RE=VSysA z&(i0F@_Sfw3kwU=($d1jglsOteK$8ZhzDi$sXq*S?k;3z1;Z`o3lA0%(ep`Fr=1Cu zp!nMj;`4_5xGq=hP>jtM9}yf&fY|2d8Y@Gkkigt46D1wt$~2F54EmOpThGS z>p-ZKcJa>a$8CbISJ+Es&TfQBePQ=z%Z3ulfam!x z2jUA7;E&AYd+B{tucOmUAwV~+xPU1(HxY@d9-aWhzs7jOOM%jbU|Xz#)Rmi?`@^Dn z$yiA#4qRPbjRBWS64;%)a8j|sA9(hL&eh>-h#{63z-Q zhNnLx35?x2p;g<{W)ew7JGw3Mg$KcJ%w>5r9LP~j2eIpe_utb&+QyZk-!W6IT1}%7 zl(;3|e-88wSie7V42Ga*=|HvbRq~^LLLwg{hyytaEFT9-=?cK94}OuC6_52$>b%VR z2bI2Aziji5DwD_$XXDpBij$A0Io6KAZm7sf*B;109deI9HacTvGCVWc=}k1junTrq z*R6FNSseW?{vhx!u+>jJ%s{-kXxp5(lTu@igw}F2ej$Zx4P@VR_3;J^b9qwJuaAt< zHK@d`52c^O=X$F7^8#k&Fu@(G)FrpRyhM?_0ge3jxq;yK$#Uz*gh7d5Cfr25a$erc zFXft&A_E>=!-t=k_xD36>=##OLzhPyOh zn4u=nR=F~MGI??52ppVeyk1em6SZDEiCd&BaE6%C>%D&JeA^#fVo#C(^29^7DROI; zq8Nib)bURxFw-`I{I>N!SNsr|_~8?IRaMt#wD#eUdT&8JAS7S&{)X@-lu7X6n|l8+ zb1IZ$DEwrg!1m!0a`!M(?k6<-7-Pbc6lNgY$)s}%?t+T^61)SunKT7)oy}8Vo4ANa z*3l!u#3GSV%jP+u0wgZnGiSDMf84kU<+viZdT;-${vGi*aq`BFB#hLKaT#T08{v%! z@~nlP=-(X!o>CI3?jI+xN3r9yb#T3i;S7Ts5+Lhuh-}f={6w(LsrYPI-PG1leG7~! zOmbQ2@gn)}DZQ|pcXRz$S7D`TJSz}=YON1eJN_%e#@gq;(4(Gf?EHrd)ZV(OhLR|V zYW(TeTPQloM$<0`2dg#9`Y4;Up(Z0@&k%6E zp({43>z%Mgi|$bWjxjIQ+j4a_aqw|AH_uhuope5&uLWA<4>|j}Bf#NV6o+02d^r1S zfcv3d&3pf|#T=WUP(E|CEb&YHRXW%|ShN`r8CqS?9>J$S4(AL3QL)CjfOlNIm7{h0 z%55!2ixi7fqI$oA-`1j{2F9W!my+ z<$vGIAG+G(M$603pO2rsxL)k_6~ZF|uFD#WW)kwP>5)opl$4~T%ocJTeB#E8-DXpW z4??_J)5Sm{=5`G~R9u(Xl_@q+BgdmRDq9`Axas+jjr-qp7}Kt#dfk@AqyvlVWPHqo zeZ>;~h|yLsFxoZoxm7XKM>pC1vQ;8UDlRxMmAa-sv0GihRZYViuynre=|PF;9lXk`IfrwJ*UfLo$Se%~5h`Pa_*t2@iI=h+@^e<@2$XTl>iXurPlWgitZ} zm8`?#6NV@~^?b8)dveDqF*)64lVUCT!3>>`z=zfL`|w&MB2G6W*UYiK?g2bW9#h`p zx`y9O)8+*QpAD{QSZR>Uv<-!&gFK?a1uPfq4P_KXP$6I} ze@QW21qdL$(aDu4Q^+{lyYEy?vOZQ&jU;dasZ zu-epVV{S&tUaCuT)YJ(zQH2P@0(o&D8>0_ulyom$gQQ1-KW60XmoJ){>``cU2d1W! z=F{5g=|}ups!W{?ULvZi$_6T*cnr-B-nPbh@v^)cI}*Dm=o2EQx0PE$2S6i8a7D>{ zBWjL<7DbKz1K$N7P(N)u6Erg!P{xbU^&eb|+o>Wi1{8^GDT(Ap6U^oNgtX_Gf5Jg;<-YvUGSQvJU2Mj=o|-uQh4XW;SthG%BsU zPyW(C1V_eZ>EA7NrG!|)C?~5VY-;Ijts;=8w8_WcE}1eI0xa4ew*v!QVc@RAv*pg=FS@$*i)VS7gQ=Azy| z2%8kh4j4KSMlqLTk5f`j^t zz-lGA*Q>he_SHft9CHR^Gkd*IwA3&FgVAxVbOQ5IRWZ)5{Lt|0P>!rlR@GUS=n0D& zlNuZiE*k{8ED1B%r96=!{`HF|=`BKn-_Za4hLOV=?!bAst#o*0W@gr+F;rr0_=y~C zucBN<6--$Iun0+&B)fVH*s40OoxbPe=4 ziNgR@6$~*7vgz~53^NrKR6n>hxm@S8jrFpI+FC@tYwT_5>L*+D>TV(~ZS1WGwe75- zRI8WJ`=~T!<+1M&hIW%U|9+VlEgu(swNA6sCrcODc>8^*Kca02&i;E z&0#_2nm*m(IvC@Fv&P#OQVA?FCPLf!^Lm|8i;3)9psD{rQe-qqMAbW{FLw zdp!i2Anz;)a;SjhJ%X;AFdM25|K?SL?6A3p$I- z$ENbZOKrDX78^kpw9%O@ht9(Se2i0!AOON_zvHJmPW)a@4D4cLturpfsA~Cr0#x@<3l}n4 zsR7DbX67@py%b zzPXzqcZwNj7qPT}qzufKJJbR1{Ftvfd=CWZ&o_?P4)QORi>=TEq_^c?5xO2s>e8~_ zOghrM3HV$nNwQ;_u_qADG9lOYrz3&&#oYLzo1K4u`#wryCB)!bQ+Dy=J8&b>%zb-E zN^wqw@-h|SDZ|#s50dvH@Wh{?cNK94=H+%2R{d?tE#C)POspLnZ#%05xz6IjTxuSM zDoLzoMZeOF9j!$ee5mZaLoXc}ykUNe%Uo~&_M|i(=60}i@AB;ZgYTu|aK$$VVUo__ya{4gr@QfPOPF(Vk#a~OCrtM~N%Zr7_ZK&brst(x|*x2g9c zHxl?<6A+Nr#&4GkWUCE#<#GjTz7&Pp^SKhR7G(3-1aZ)^6&!1>(3h{Df zx7pR*9ZxFYELFl9aS-F1&&v{@5VK5NFEY}ACXc1d(zyWh_~Q0jl^@lDY^`_@b|w{K z>TUU#T2h5iy_|b{m%64jYvqfcW|71id417)=|fZ_oMa3O3i{Ybpg+dO%QJ=z!~#At zF-#PBTk+*E3g0UojOuD?u5w?9P%PDkzkmGhE2zJEmxqgDtEp}Qa5nz( znvZ@iz}%LGHc-m|8zL1}84Hsf69zsaYh|xY16#%Pkr-B?3-6&9i@lF9biJQSlDG-6 z=k5U1m3iO-G97Kn$@dV(n-#{}VMvKU9r(fjrP-d!Zlm|m=gj{bYN(Ghv!j8+W+?L2 z%Yey!l-Py!?aQy_>$%&rOP|24Z>SR99JqD%q;>`}P)h6jA4Yq@50OJJ_95OJU)${| zJPq6~L-VIzLde3zT7C+(;NN4;vSVIrtUSN}g1p3z6nvP!kx!N@*T|UMRh@1i^lp55 zRmvpJGgQvo*;ELHLT`Q8^xD~_QQ;fEthcs3!-kFh>Y8@N9I;_?qRsQ=-OPl%nhRHe4yZ3<73R%C_Vs=3` z+}CIfY3?zeX?QsM3k6B^_4y5Wp3^`}buq+T|Nf~;DWsHevz)zcPUmc$Y$K3J@B z*zf2n&*TuUs}1+GzS(uxAr#d(Jp^Iq^U7EvJkq#r(T<_Pr$Il)9`e+b^q**iW+8sc18 zqlJZ;)#S~^RTUy{!s#k7YYif{6VUu}q@$@ljf>N}QYJEFklNNurqT+!OS{5k74Ad( zl9V%1$WHjzm|#7e(X5Nq&*#|vtV|GZ`$5QS@}cyf>UK)Q-P;zV3$ZKNAON*dPRWFv znU;<;A+S>xa_mZ%;P9~}dC|KRP~@xCFUQN%Sl)34oN(6{D^}E~bh5H2s2h0bDt2e(@p7 zGXG^>aRMZakq-}x&});U@TNd&e^I}vr-YfHOn@hejAY7?cxiq7;_4He-HUxx@TEDA zEkd-^3aHJILCp8UOTzFtfPwFt%tq*mm_f~qQ}X9G*Sy&7Dh1oq_$5tnH_#6FTd8XV zA=Dx`dQjTFQP+&kY9_)u)&O|>v>#QP&ek3&bJn8&NiNr-h=P)W$h58PuXeO7H5OvA zI)H9gSCFw4qM+A}`x8|QheRqj(Eq;Uy;eEU$~Jq*u)?;S>rSBLoN$c7DGf`{_DwA{ z?*~lW-4B}-Q8)7++E%L>)G^xtjfN)I)`wDhguvqDgnzdvc6)tD!J zz`=UItNGNumDdTH1M%N0FSn3?=HK|;A=V4a*uy-3P=27rPsLm{Nxm8)0)E#%X z^RbyZU?t#Zq^c}WS_3NS_NFuRY|V(aQX(4`na))p*0a(V(Nm4=p%X4kIR zIsckxW~A$LWYit%%4Du#MYc!u{U#KX>mgHPI2sG+6BYRCx_i}Hld&BQW%at-=8d|+ zvQ(JXAnm`?sT_2iadZXjnqWpQWvjlqS4!n4@H|>`UQ;bthY5G}TT5^5lo(c?t_Cz| z^!T=m%Y4QdGN;+Haa2J?olH;udi#<{{xqkuV6fa5F$f)?PXGyqeEU{SP7SOk!s?JB zj+jtD2Qr={3|Xcsm7SWNnNZh=9hwDQiwMS`38*Q5pFvvUh|Uxy?O09%sW#fXAoq)C z0_G?3B^jw^U@^P<)}p~|B!SE`s`ZF_M0lYqOHK(BJ75FG7HyRtd@N=~UpWb~#^20X zj_lZv1wo^cvbG(hf|NQMYc)08Ep0~Sch8gBw9xv-ulx=U_T)!@caIlKcS%J#2P1XyN@a3pU=x_%^F@3_jg7XrL-i~1Ira7= z3a(tW0@d^^i{@zdOM{NaQZE$B|9xyH&>E`71a#LllMz0ndmb;z$~)!#I_O#j2tFWQ{{p27UGAh`h zgC_UTI49WjVbJt_+?NI;lY3t&vEY{6CPm?(pKKbvxi!JpNF)lHzuH@itB`B^-6us?<~ykDWpAFl(kn zNsP=PiM8ND;mWy46xSr2y)^s_E`3IZ5qxW$o|Ur&m0H4us<{|BjCO%p`OG>-Mq5+F zelbo|N;)Rdv4-TLpaPue+In!i-e3AX+8YZl0B9M$K%`-*jT>yo#3l*h?8HjpmPnUY z&tW-Cobj0vb0 zWL%|lwPQH}-ucR9xHmK!$bDpK_0@SXeUzS@T{HQ4n)jQo`LaFqvC~gBL^$fDJP=6^ zX`fPn0_*c;gEXxjO)?S1Di$Vo5fFGmk>F@)#ahZL$j{2vS!rQapg_8_W<_gJqvf%h z2+x6gYNy8pjT#P>x@D#P|L&MT|$NxDjbEZIu>&rJC`6;%VM z576{=_*R-1_ny>u1rO$z#6v|CC7HjSWpx$?7u%$DE9)J3(H%92D2vQ4=M>|=+mZz; zpQ~5>)8#}biQlBpnYxORPF8f)^je1Ya_ZMi+U@3X1{3Ewd|Ac&A z__f}6c8Bi`iI|@2bNNl`UhF@TP)KnmQHu?&SvtIPV49@1z^ov2*yiI`QsrW}Yc$bb z8mzW6wr}mvRBV|2yX5eZ;`*}B_~dRFHKDnrsjaop)vC9ipRb{Y-)vPAQi&h7u}^Di z)p7_eEwdv;tXfunCCI3#s!Y$!3Y_Ti_e$tJ>({WCqlhixN(XApFVr=$%^agJ@NwN$ zAMO8ea?#QzYA=m@H2c-=zro5+USzs<-tMs@&S%O`d@|CXIG$@FBkQ z+R|LE*xJNhW#6P{`d!|TiD5J_$pwPQfc3r+w&-c-scUKJTYmS=;uoAX&{a3lO$S-E zOwIXb;b8M}x>mK@BT(Vu<8N3td-?%OD;pevL#o=AO%J~w&);62o?y*q9IYrFc;g#K zN|TezZk$v!bUa&liTFJ2xZKcx@X(VEngUMfiRdbYjSPCTN);#A74=ES^|W*t%fBlF z2{Y1*Ia#LTy)NV^`l$pm^`_JTBdFjdRsXwDaB!N#$M+Ba?16xQ*U+~t_WVFSw?8T^ zbTZdQyd1stHK2K-0SUVe;w*J*WT$EDO7LnBVG;fU{J?>AnM@&3a6!-`)sHges2DV~ zNZCDn9Q$&nW2BKZMAFM=4j0Vg&bxZOiyB=ua()$6wQ_?s&Ak!u{@s#TLTPT~;^F_Ejh1DCKbyi_iR9sSA+IF%YUnSTlB8R zD%>u1_E6Wl1_}U`cuH|XA_w!t1c`tH=5U!a5^BmLlv+yiubav`f}St>`eH6?kKsH~ zw9E{_hsN7T{Ty)gbY#l;qbA`IfuBBI@Al0BKqDh$GbPV0e5$_CIsbG3XZr?VDwq zsO}8n@8f^5oW#E5F;J)QOlwi8T9!K3YK!ZB>1|^L8v*3g#&qSPV&%Lh)#OJ0Xz6l2 z=$FMIF6}?9u*m$fF;9wjyV#;&=5lc~BIn^b^JI0##Prevt`PPw?Vc85k`>|M9C@uA z!veQmFmE)?U~7*-!#Zx~C7)+Mwf}8S<<^%ktV40!rd~jyOZ#WWIj3TU6d8m3icKw+<7PE||`0%jz;zqW?Qd@mn`6fnZqc0u_4BY>U>Nw~!&gbrxMym5Qz3dLZ z_V$POv-_~-ezW|i_u1{i$+gz@H5LWy9dK*!j^5haotoH<4E>DEz(9KZ)e~;&tb2YV zxX{b!dj0OcBSYX#hMgQNhjBByP&UHrEwH*9|4}I~nUnTWTX6FZ}=;*J`xp}!ew>+H3b}Qyq0EtLQI4Z_BzO{)> z$Om}X-K`&=LE!Vuwt3gG;s|ix&v4?A~KjZEYKX_xydqRB2TVZQDl72F>*}Uah+>yy0 z8Px^J5R&8*i{o$C&QDHTdy^#lL(15loN9zq0O~2sPoWdzvK5tfXFhe*kQVZP3!rt) z>?4~}IyOs^b>h*{y!-pxWbmrlb)iYwe)u%VD?fjMhEDh-tq_G=50Q;5e0R<>d)>2v^$}t?0#d|Jah$sUk8J36Tb_ zO>Z508+Am^X%}wQr5ac6-NSv60|GKecf~38`%E3i24E{yQR~7E)3BKCLZd%@HNI#Z8+uu4KgBQGdfBT5(RE6k8lE$E=7snPVn#q%t9LLC+7`}Jia1V%+)GQ)Lb8S%D-3v?eECe=H zfI4)scQ25GYaD2|tO|~=wGp}&z+`9{dAo|W$~(arS&KZ)gkfZrs>8e#Z z2C5Vh6V8pp4!-tr>>&vGfH8Wbklo5>3|CRdBrND3*6bcVDpK|j*-WxNwS}uR)v)ER zzskyk)3=dd@nNPx zjnz)28O6#Q^y^R&M>Mg&^d`uCs%#bI9V2ZW-!&jZYZ-lHM#3bbo=#*VvHvXo;CNOh za^K3BT^*x1`b!q!-B2!1{|SnW?hvL6bm^^)P*KsK-(@Sib<9>&S2PufK9Oulg%)a> zNlHtr;pSpxVIv{NUzuj-=Hzra5%2BUhV<5j*rT8yc_1H*dU8lRuM-q3ww*q}*Y_;; zFm6@;l66O%QhYvfehvS&rWD%T(Wh?nMsPVIpc4ZFA*IBUFWo`l;RXow6ymY@^#!Z0 zuE9%#n`ZIze=;Z(2q|c+Itl7^075Q^C5N29j`Baq>&uY*=grZe$2n^ImzL6&tfp9O zkrlN6V$F~x-=W&r_Pi+#4Q-a^dNow$wp^}G@1h%WaqeLkMwWWEbF#*>AIR;jLMQKg z{=c$@Ir_d?uMH=*hwtKCXKgYyRSfe0AGIniCZ{8|OVQ&1gr3D?pMjfq7WjYt7(ckk zNju12e?PzR%M^HB8+fKmppLVEyG0W$aQfq=WH|`EU^nsV_ipeJYGtdf|I5Y1h=Cn2 zXrn(t-$ruo;oeld1sq|tM)mpv!KuC=!WrJ0{|AJ-@Ezjcu%Ka(4{w8*4fB0mnrnY? zkiv%0S6@b%OKYz54<=AGBD~i!saKreNs4`#^+x4yE9b8rHL?D0t)XbRO`coVR7iUE zcuCq8tpBgCFUa-~R{!06MH;G-LAmU1&-_MOO6+cVxhHD9d;1#1nc$IIY`baxvX*gX zzT@p{7U5y0ZJ=uoAm$VUbFEaytlE`z3aSzNqnnYf$6}A+)(!SeL4YAQ z>2nK1CyDO9fp~t5_WE~+?wlk`8G2@G9zD(mxZr>YvN9p4FPD~`ncv5|fDEaT_bzl| zKec$zLT~gXp;XB;+cnG0YGo-60cTz@G_hh~U9-`ewLo(T!nKaD5x~kam z3bA!lU)1DchS+}E(+L3}uFxy}gD6+8hRbX=9&04>8KL`O{tKU{Fh5muCVoOl#fY|G zgby_uUOnZ&)Ucg;aOhj}Za}MVXwa6(Kw&uCc=GsbCiLzIv|UnXr&uERZ2);2MWT1n z5xNq~oBCa_b+r0TCi{qz5}D%^*>d^$D2cPN$pf{l!pzB)6td)%i!ev5mQ1oZJp#%< z(KG+3&0EcY1Sua1fPoLhEHTd+{kx>+}{SRzD z>|Nu)3lR`#9WD)W)|Ru?v$eIAd#kXDZgVd0OrXZX!6o``?l{XC(59WbaaT{zKjRT! z^seQ>T628F*EioULEYetKI!gBmoTqY8HfdxCt{@z9x%cZ%ByK{*}#(|gdGU5F4`tC z@d#F`1OOw#1j6f@2ZqTASSrfXI17t91pn;sKbvnqt?$c^TmSAt{BEjU`gr@g%oHLD zY+C1B)c(uJNIM%==Tus{G@CA>rmu8&yzGgWX04x7WqAx{`gDc+iG{zHh1tKUf| z8TP)7p4VIMQ%2KC9%S}DyX`lBzRR|M|IN`}p`n}p(sY)bYO5*fE6M3(%l;sB0wVqS zTwh!>tf=kMTC8QDXb51En(bGlDQz1X`4fk*=adhlT`{lh@6pt%M7}c?;}Uh-Xv;7` zz~O|+#Bo>pGIloL64bH=xEk` zM?y+o*M5*4F4w$n_QKD&U=0LnldP7cbEW4cJ*hd#Csay%RUC?o$ws+mKqHkdT?&|>6n=Bipewc6^VQjF0<6WARxs#7tCcI*0s z`96vXl$d^GRu?qEnjY2oP5wTLVWeO?l)X$N!_(+}JWnc#37t(SO*f7D!1;c4L1yXB zwy}glT2IHo$}F(x2iIF}nEAUa=FzEzf5R*IKwl}9k4uEEgPMzNj?>1$fahT zd)5M2!g?(oxszYihP2b})rW!{VXjqZ1>~~}w;a=j;4}8Avicoc=jZEW;OSrOPUcO; zW$o%+7IYqIs7b@A1(~35P=ByTomCXWH1oI)KG}GF2o%Z$i;cDp_t976xrT+q@y`~_ zjEm+06fbw|hQcoY4|{JJ6j#*r58@UixCVD;a3@G`cXzkI;2xadGQb22!9s9%_uvxT z-2=fjJ0yAD_pPme?T4+E+N$N#9p=ux=XCe!{&k=3K6AM>BB~5AU+NPlhoX|Q54=1` z3o3hfSwZT{zQ6oT;G$&5?A=|?vJstbbfqWdWkMyh+iaZl%EFzbuz2cQ=4=28PS$Ry~r|b(1sWgg3sJa`ro;Au#6L7G-p02&j+_q(T8yxBr zvI+e!o+T^SK-nAk*&%Jxf3{eTiy>K_IHB(%vp6fDH|^!+qiJqMOigWf-g)LYdYNuO zUS*rSQt7yuERgYSz^Z=h;e+Vw7uy|`2e%$OH@2pwZB$ReR^^Q~{j<_33dQqh8@q$h z9OP7(41pWp`1SIRfQZEpP!6$K(;lU&*z^4?rFpZiC8MrLowHabEVb2f-JI0Z6@)># zSd{pI2srJJ{-^YR44DT9RD)s1H#X)hVq(S;n{<-HX~v6Yfx`jB`&9fQ)IQKK&|D65 zx>~ktP~Kdp;b=q#);H4F+X2Ti5w(pqwwI>Z)Barffwzx8%gaTy)9l?dO=UA_Gh1?@ z6>C*T>+BHFHu#w^tHz&o4RQe3N_A2y!SIq|!@%gyRpBhU`VDN&w@D4JQEC=Wo@EYh z&veEX1^6F@t@eev(CRP)9!}Q~)F9C2ToeEm?cQF-uV@LkSh|V z&{|brs#P*#m8X`+Q5L70W-(QKR;p&ZTQpFI@bm-*`IVs%F=+28jM5)6WIQaA=1^%(TYT%VJZv4?)< zuEnH59F-Nc}-fc4Wm1RpEOMFRs&p}Q*`X{8}4 zSCBY$G_(#2W)D!oLdPCR%$+s^2>zP!rCIgYU?m_VpBIPb0%%p zHP$ZVE?4SAJn0qF?y1|f2hlVKGd77&E-&&lHI7*@jb4P*jXG{|%7fnYDuX`aY<9Wm zCwW24hXB;C3ZjeQ7?Rj3mwB9i-ukNy=Y|X`#obIZY-J}LyVxigDs5|KCQhrUSWVni zGSRopT(9@y3ZxP1bUvjKWEm9Vrl%o78c<(KI!fg(@FCX}4)kHv;x;tYv5dwo=TImu znQ{`^QyGprI%c`|`A9Tr6b8MEQydjC;2s_p1XM?<7ZZQ~!Q$y~uu|r+S!-7!*r0Hi zMJrlfwUZiE%GrMrL&80o%}07Z@`IqR_h2-1k&;2kx>vHkuAZGfO z(1B+Z|3{tJ#1CV-F}!jX4No)?Iu#Zcme`mWF`s*Z{(%8U3AVGOVUrIm2lS0Da$ zJU`k_LEz-%V5D1{?Qhq-;JIXB(14H`m*M{kSToHDykP3Tp4|nZUCciTCTLx|)r zw8)UO*_T!{jL7dhe62(Sk8)n@f^{#x?aZ~Rc&@=t50>7oN~os{^3|A;zTp(k1Sl(H zSX+1TulbCP&jV)q3+ww1CW$@6e-&`qAf(i~FYAGGcrs?^Qt|bgBa_QBh=|EK z9U)eb*GbH&!HLJSj_WNcuP~>eaL4lWkLKFyb}KIBQ5IH3(M){~9$pbAJLlmoi?*^k zIO4i$n^Phlv=!divDau+4(S;`Khar_OveMJ?sWA7dAK^CKUB#KM35deDP|rU8n4yX zb4@P*iNl@UYQ>Zsz=``3$wReHvbloI&8ca4)`iyAyQ!Zsa<#2V(b-BrIk|g|u{tY^ zV@Go>a8Hruchu*u)PSIbxP|dge-`0#J|H^1dPVGSpp3TKC?Fz8mNp8`?uU95f2o|n zY#|7mB<@j#VQ)3eE$$s!n4SjKa3(Zj@7a!zj*gF-Av|LJxes#N5ilL~77`b8TtngG z`eU1fiG!q1FEuo{=ieEX>M;4crTze3dSXkn65D-TZz`QPc`A2zI0XgjL%OU3+dyCK z=(dk8=9slR{b-0wE)?H*-nT3f3EYz|H+k0;*jrQ<w%v$T503um{l{4&96Zz=&)`sU5keXj*csJC7^8wJ8wsGDXE>1 zp|C}{%`d937girWHjZe?N^~gY?Z2sg!;OaA3V0tF+=rK}i^Zr8c>>d}t%X^$US~mm zvPR5h_H$PpU?+A}aGTkuiqF^S7b`cFd1b-Zt#<>zdI{3rsxlUE3FK|~Sc2YG@p00A zhcuI%)-W`ztgrgQU=OGmPcd?=eqOb9{8Euy<$c@LV?TEoZk5VOp9FF@PY;~vK5TAp zuByFL0?I#K5r;HUhLnHP{K{-)Us2Oo?eOWuEO~Rex21>5p)g@cyVjth*xqJHM#=HC zy$o-g$8&|_tB!U?WQhw0VbfeRsItby@X!h9;;StksPE{Wc&a7s?_c$$q-@b4n~Y?i z_Wr$7^|vZ}e|L^BR>K@3F33LZRV=qrNw&_4j48cV%Opn;zMk{i(i*TTpR{lYSj;?FhOqvdD2?kU}?#3+KY#4;RT2ih(J=u%Jgp|R%X&PNXybvVS z6%72@y?3YaF<)ooEZf72I8aeh$JiKFu0Q_!}EoeBYdM)%6am?ew6k^ok-)oE-f!d9$H|sKT3LB>;uIbpt}f<_4V~#F1JddcKX7;0I{KR z>rOZH6`o7|L$}~bMA*F7wVvS$T@7d_K?M<#;muM%PGIv#26*-6d7^IuwtPSx_*R|1 zaDRV_XmW|r3Dx=+3qk;4#kdPhWmSISEytz0&yvGU9h~84FXpA(n}PAUaSNWcH+1Ea zK0o`Nb1)k5|Ki6mC?OsZr#9B-`|oB(EH1dOjx4zVeDG(FXB$0Npn_SY&0s9FldROc zD0x){g_xe2A3ds@ab@6CCSl8h{+^4=yyAC9ijSkaV?LWoof%fCBeM?+#4L23dT|?& zrYb-LK+L6F-{n7*YwC|F>_JWE|Jq+jym9U4E6_m;|@aXfyBmC_hn%mb;`tWlG0kT()z$DPocm z<|s$UM9CHQA@b({TfA-&bsEJapVp&ulz!i$wVGo+#Un&Wt+oo9(6d}2e{9#y^K996 zm^<>t`A7J57=GAnc#Y>#yUozzNBf4a2dZ`+V>4nU2_SuE^3$?cdJ$1b(qE#9Uq$&I z8<$YA+W!#!r9zol>X2^FBp+_YE9tiRzB*K%yCPP?VRS6_m87_%5g`uDgS=`uO4L^p zS{?+Hm`h6a!kKyCa7r%wH@g_nT&yXoIddOgJ-_%nkdeP4TRSHp0}uQAu-xHSN+Kw( zABJ}5-cN6>6T{WPY_{KK-v)|#KRHsC?y5wFG5g*o#?RMy(9va2vgyYVP58S@lAf5pZ` z3lI=ky|{z~hBgM-)_$L<-@?;*l|8b((QWl?E7*%`FXZRunIPZL*sGd*j%@d1`Ln$U zv6+g%8*84CD_k1(WtBvTrSxHc&zVKpx)!Lety8MWNP$gC7Wi2UQm) zx+V^=j0o^I0#2OXsd}x5sF6mJXp=)sbWEnck#b~Iy20XWCY)s8aGB>jJHbeMeV7L* z=5ksQIZeyLa1r&lHL|*v7CRY@mW5N0FqDdyuz37G56v?QU#XffUYejkTXwH>SI$MXo-q*x9(if^XHW9_IU&>W!OeijegTxUB9yEAq%cmpTXS3 zaI!cTuVB&5;m|oqq?tl`lOFmu{_Z%VAv@aA+UeIucod)1$YSUZ(40bg%(#);udz2v zo@1%WZRB({?zi`!cKj->M|8(Zh;nXYS;19f4d%1jj)u^abE+`!gCeZc$9EF5@5_B_ zy53TFI@P9+694+{aj_`rJMCWMy>mJka(o%%SEo0KE!nrXt?B046x;%|!cFrlsqlP0 z;6CR6k0c3Z99~3!$D=*f)ZkWL>qyQiI%=Qf;&Ah|^e(Kd^|1^PFPK{E_#wVqtS>*a z3-awnyQ?Fragnl~Af8LpL^-((c`MZL)! zB2KtjqgGC0S?$?Q>b&<@+$~63`erooLwh1(Lq^H)y|h(DY6^&Z)g&Pu9&ok%-q(9+ zePrLzk;28V+1ms`q;M%>*XneQGFiQ>4orJLtN&`Gg!5>$*D$tgUaUfnf;)pp!>4C) zL`KHJV|?_wL{roA0TFU!!pP_GIp&H{CAQMb_%V2cb|@MtgsYWA@S^yaa7J7g?R6N% zY%yIV*mbA5tqd%y_c7eUh4zYtg%s*0spmdynEqtUpQKO0c1|LgQO+}XD0NatK=U>X zD}lq|SGDj=O!A-1mI&96m}>0G%3IosnhVQ*pUN1Kx>Mily ze^1NE->~=X9mEH%)2aeuXAl!@OtW(^KvU*ig+KmqN4xR)WGDZtly^Ia=&)T&UuHR> zqf)LsftRNtW_-zM(0F=YNTAK8jUuo;R8*+Rh6^jFCH4v1)t^Qxzhjc~^X}^+yo-D+ z)9mufQyyVKZ5B$UhPZ1{?s^Ma8p#Oh-kt6FF@g5;gh5GX#ZT4MK<63Eju;qX$6s~7 zxCnH9Nb1T9F#fRGvaluXC@3Hl8N8@iBRX~XN?)wP5c#RX9pf@aT$o9k?Y5giBJ=SQP7lWf9F8cF`A$`gU@1uLjZ-QeyayMuw9m+_mkC ztmvXj7x<(M4uKx8vqRNJg)}the4Hnl8SKVJtgwLkF>7|gdr7mVco9dCWgPoALoFKG z%XRr)-O$`$J=)t`mhSVX*kR#@Q*l*8|DLH!n>|Id#%H~rU#&Y0ixxZ452>umV|mqvY`ghyH4U}GRG z3OJ|F;rl#1nDTTV#<*;kd)qF1t$7e#Y#!$?NcILbH`|~2)r8#o0L`=Liz}#Dw<;S^ zHc}%S8+@Yd-wJv0O|H%Hw^h#0&$Ej(OigKs)>SU9ECM*qABb8zLT-zH6qft$wn!8v z+V1OI%m+6$tj)MB!SU<+=deJnwE>GdextjM)!pxct8)9pcZ-`2bcfw*jt+U8^PP_m zPZxBujExP0ES`KMjxOg1S6V#jtnu`hmUtC*$LjkFxPhL&J>AWOKDc-`PBwawQ>+)* zN&_m(s;c%*pK`Oy&(9g8?@;dlizfta9PCg(G5_ed7q7ABKR}RA z1&Z{9uD!`{5xmw(gqk{?!jsA)+V{|6H;}4uu zTXT3vFSi~b!gn^i5HCOmjxP&Tf1c2?in z=ETOam~~A1)xF*~xgV|JQ;)GjtB9V>-{fD>O8?|?_i!v7DFSSBN@Q8pocFgKlz`xg zt$=YdEv7t%6(##eCzN|unp~bX^50Okop0~M$C=Az>nyzs94RnWsgf^-qMBgM>xU(e zdPl-D>Z832Bz@g)&`=iqu%fY6oLTsRegM~JKs?`r_E6r)=#ogUCbOI(DbU<8Hto%-4rNA$ zab}zHa>z!r(xN(DDf5)jahsl@zTW4FouQPi>4cKkvwPvBaq(-}M#UZcFqo!xJ*D63 zq%N1HiGNk&No~}DK)BGcwarcnR`TYyD4MeVJQ51K*bUH1vI^50o)+qSwa2I;kQ8D_ zn*pu`0AEeLz#4#Eer)7*0#<3=N~0d!xD=rOv71t|{kd>6-1SM!-bGn{=Xm+?e$fsT zbNd$4Sf6uc4HY)Ip+Y$Zjg@%x%?+Mb|3g1*|6#e|+~CEJZ(j~)pX;u!j+v+K!&MD` zv{##A5k``Uu&|7(;#h|8<|yfd4FE#PuIcixc? z&GkvRWV+vW$JkhSK=P5k1_X21uK8~?4;Pxk{6KPftXhn?(?B4G08?%~avnI3nKxth z=bD{&rODLMN0t&F?l`QVSb23WQkPe;F{R8k-k3%y&l~4m=V8PlTL!dw#ZTp#62`nl zKf79x!U?y3pmB0%M9#*+{PX?KGE8kl8*e6^OsAvTA`Bz`g9))9xd~VNPEbzA$3B;B z4;g<#JaDk=KK_vRZB6Y{$m%*I(u*X^n*DM@TV*RP{z0Un?nxXrgX*DFY9wcn+voCU zzwFomsy*;`yCYKD0YoVPHTtMO7!<0i*=FvZ>XWcm-0Dea+rMGqHDtoyw@le(Y;x2Z zfE4RO!pA^pFMt0xW@jf$z0MJ(3bfN_XY4p%ct<*eP6Du6kp9-Z@+W1z>eR~0$|7dE z*z7K`1*1lG&JF{pYERgqUTR_?-=lYWo-PxTk>zAVRAhFu_eEhDPVNaLME%#Hb%T1h zAOGRsC&<5?!yzTETh%AxB+3xodV?zZq*SO1)c0|u!$M!7bsDL=`7^Em+_|ZiQlh?s zD_3t2xIkA~UG_WpBC14tnBW`Wm zFKPXzZ_QTJiTX3}`l-Dlu=V}r+|R(SCmy`UCI=kQJcdWGFe@mEVZrl zm{;CD2R=Qt->ijw_;iowt+hY$vFcl4pW3+*L~#C_8f=KSq{7}5JRih=)ERoXL>1Wx zWeT$*!ZrCyA>R6W-S!I+wCAK}63Gq8?-^Z1Dazt%wdAaFEyLpqBZMOTS@Y<^5+y{B zrcKpy!ni|LPLcJilf2^C3`is8yY0#ip2Z?enF4flvO3k)G?-YuM}ajk!0xO+D>41n z&3^Q6Xy{LB&VRC5{zJ921Kca#@L!g#h||$MZHiVG2vJE({CsH1Hu;%oHBGhDYXa8Z zVCcf#g#B4n>Hk5BbZDUE;_Nd&K#|=m5Bl9jU+U`?@ntV#%}F(r1k5}upiAzrYfTnZ z)bXtXdPq@rE$4q~B%;g*zLnP}4x;*N9@zwPrcA&$gTfA4Zb;8UH$My&_@M=w+F4kb z)zcf-0))x&-k({az9=R^h&KB_BN`@9fAf+da3}-%zcX?EI}5AhX{n>jm|1*(6e@7C zzT@O2H;N+k^&&h3MTsNj8or3)|3^NGBT_z#EvFZ(!QbO|}#K5*$q$T;B6GPJK)y~qT| zs)l7f-N4XrG#=7QVqVTO$$y~zVob1ps_n1?(xL41;K0_u?-dHl)bz9|l-~26=7D5 z^_!)|MLVVyPI6J}nuYr7w)w%qNJr>_sE#%hr<4r$A`MEf&+6cuesTYvH=JYh>oiM^B*JlBKN!UIn^`n=~c8F0iqdcB~Q zd-zLB%hL2THh^_$Tbf)VT=DkTFq`96oVl;@fZ;iU1I*tk_)fO_Ka{pCu1g`G(aL;0 z#wd8c-HNYA7BuHXyETvd?DX^SSP;*y9(2n1K-+b6TbRB2h}hxi(M?>5{Fg5$QVG*~ zo^>BeN=nKu`;Nzt{jbT-a-J{g2CF-P;~W9scPlK6-DK*&K-wdGnG+4Rb0pvrp`?VF zwP*65`a5VKw#oeAC~e=sz>?hW;lR6!-&Y;txjM}C^?QqT_Uurcog?-90cn?)ZuaIu zdS&$>r{tap42h7F4w5F{8`e@9a`N?^pP^a%a7UC-2o6&E*AOld3ZM`z>Z z(75Mm^|53K;1gWBG)nN_@CKC6&T8o!1`Zx}I@5Np7w5ma$HSst;u1_aj_Na8QoyTl zyRP<^hobhaN3Pg_v`ehjv~E(Fjb4N$cFGunX`bQf8mo8fK5C7-Uc!3)+Jwm;%VIa9 zSj6Ec@Zq(d&2Paw>kimOAta0?o8Ppxi%kubf8}VfUqmq2-(LS9IpFbJdQkW{{z};W zcn$@xK`|f}Za&-b*DShXN2WjRHDc+DoJM1rJdi$&f)LjvIWi_ z3}*SewEit0idxNU@5SMjHeY-|P8x}S_1e|iD%|Zth;7C9cE`ZZ!%i(M6P-lIIF@_? z{o=Ex_nt^2`x&tS;FjRr<5-0P<}GxknITX3(R zFN;JS$M^vN82);97L~@nkcL^yuKHHoe^!L&no!E#p2>n7^4ICQy7P)n`O2X3bJ-Vd zg&;>M;8*2V);+Vd(nbF3guP zWiw{Jf*T+s=?Bj~=XP^rWQP?09DT?0!tYDZT9SX)`+@_F@)G5P+a|B)vhe}Ve%YhL zubtzi7rr_am>V94%Jxv|nuL*t$ zKiuUAV|y+AnOmKnV-}$UhoC?5gTY*Y{O=cb8i~Al+N}p z_B{GrJ8nN$F3g)1BrXGWeDMMQX#z8eX^AA&Vb47Y`vLA&>hAhQk?py&9nNcif2vPX z?I3ZOtl_PvNgf&(rhBCMOe!mDC+Tz+7vQ@wk#&N?#`p4QoImLn17{N0-OjyVug7^xyJa&7iplP6M^^ zO+2M3nf8STmrW#0o<|)f4rvC2JilNYUAc!E%si`{IlH>M*Rj}|u6;|yU#6KqELIAE zcf`)FiglLyOP_>Mh}|GRs=OcNu|h)`WbTfLUjPM$$Gc%vWE~KZvKp30no8 z;Ry`Pl1HxzWj;fCQY~85dC9H?J9__zq5n5Si~sfGodr1mAq9#{y#M#$WSDRwRPxaF z`#-F^M4eZxK4FKfG#^J_O6YJ5Pw1C1UbE+_&@XDK@;0Je6=n-W-&;%7g-v`d$`l#u+4szegKFlm-R8-kdjSW$ zku++FL221ZIJmf=^rSA_$O5eMJXx$N8(&UY8!9#?Zo*kyG&3_usx(&dG4C8DR#btR zeo3}GJq|LzTcB|uN(Nh+{AO^lIaYPSR2mBegzlpun5K#6iis4e(C6z@!q#`;Ck*c- znC|ZGI`z8|433S3Gh@;&SS`{_c-dfBe9IVWszdBd^C~1eY44q zT&Y5hSMAEimm}zZ?dN7!?!ZZgjZ%neJh zDQ>1Kk!Z;ZlOy9vqY|ao>)|0Hy)guGWyl#1feBOS-|KOMYU03b+XjI5i-oZ5@G6(b z_~85Vzi*=ys4=7s12%)v$%LhLBHi^gJ1zIV;(Vf2w$)dlujSH#7DS5gW+JP{oU$0a zC_@W(U$Cx8NRzXi8g)t6?Hm*cJcW@j)nEdtfOH05oxSJZ@C##0bPUL0tqRpY(len- z`PLe9`&nJYRG2p_n2hQt{8jLih289Ws25uNgA+d{7+E5U=S{2GT zAhQUUEUks5;9#OzWh18-VrFI((WM9N*}B14r7FKC=;cNTLEDHK#ui_$WjRCAkjk6P zRt$n1@2GD7!B2y6S1J?%E+RZ4JltY?>W8--($nmFRA~H8ayXTAb@<6>0@^|>>}>#g z1R8dJWha$nSbV?fdXz1m%HY;{wp>tI)KQJ_nVgA>y|Nih%xm$MK2NVdBJ3Bn$QdolkFRcoPu;%vOb<_Q zO;u41h;IVOM|82*xlokF6ouW+bkOBxsKE*PC6U~d%WE7&dUHXxbE04hD?Hf^QV49t94U!}v zSb=$665*EQ@vdmAXzT$#tP=k90O9GLQa1lj6wRh=QQ)r;DFJP`5^|b|Y=MLAldY4} zQ}Ej_h`yP?CM=9p z5f9G5gWu(T8N{S*FqSRk+a*t)Xh}VgDG;zf&@;eld_J0AwWDVG^#;CZdhat0X&NgD z|87dUREQB)6>vP0FJp9_NmK1*`R=ncfT1MZ!g@zYEiy2lMcQ*+n(`rsoF!mkV-aAc zVd1+@ipFGT5fI^J;1O>eVxn%mo)TRG;HmtG##%3$g+VS!mv`^jPR&fr%1UO!LGFh2 zlMom8e+=1AQLx6}W5zo8n5NB|g^RgQobw6y4OaT6?2|or4n9_iPRbU69K|tHOj$0~ zG)W44NZB!hRN*&nf#RS8?*lbER%|TW;cpI~iw#(B7U0qqXhoM`E8y@NuBmA|ktk~Q zNvNR1TUlu*rm5I@l#`1z_Ba4$kk#@o9~d+b4~kbXx}0A-;_r895R*6#xgm)_fya1V>3BDlM|#!Nxr z?s6D2Kwi#oi|JR(Hc57Z`5j)yso$=o00^UrkC`%Q@OI{M%X*Ac%Fb0Ta=1XAviOR= zN`-a9Sm+4nlT5Id3w^PYQcyN`Ug|!RGcGJmtLI?q@i# zTs-P~(ZB`m;#pd0#LR2-MBTBUn->(hT9I%h`_yWz{0!Z{kKxI36)3Edv&NgZ**RXK zB^L5Q6i*=|uftE?LZO|X#|>K?)_sEXsU6vKHRDN^l51QimK>EsLW`#=p!K?!9;Rp& zLH-sD_Y=Z}J~QDuyvQ9cX5yUqq|qv$n2rwgC$f?%fca>48@p5 zhOMChe#|UpC8pwD$N{J`FqjC2X z#{ZO=QIsSGLy{;)iDkli^$1P|yM5452-VEhVf<_@4x@nojXnXYrR5bhihXNc_Lcwr zj4fk^@4@5HKG(OAQ@Edd)ScqFauipt!aHOciA6Yu9{kA(qiRD1z3(vJrbRxh701W~ z`A5R(Fej=`<;9Z-Cw`I$5o1!P2NSxCou)$?LB95ZflI`vfpq<+KsiT-iAuRWN0+1r zYl!z6NA0|4RK2{sO3w9)My?Dau&XW&Mrvh;O<=@1Ue>sYHZs`kWOOmX%a#(~oKvop z+YF>c4imRoy(nLO3?{)9)6`cEf}ChC?)BNz#K0&Uu)HQnFCeVUa&^;60?K3x#0lo@ z+I$(q#OdM@GCQ2A2-VU2q&e8F9j<#ZPYs;D=elWQ1CaXu{r>8b|N9mk-_0?bwW|&# zILLeBvI>YVBoQ3aR^jE{-10`ql{$h!O-6?mQJHS%H8Q&f9CC5RQdC8N$CrypC^Y_j z1++585AYm+iT=st_xMMk%OME34FdR(X{nWA@5j)nPvW9VScnC%V@4j!R< zD`}~TO34~9=TiwyxD9`W`r)6+$ss)l^e+KP^h-)nH1Ep%iZg@B(f zp0s`cfS812duPXc@@jd~oYf&pyn9I4e^Y@cq(V&|Hp|d2IN1{AuU3X%ShRv^1uI~w z-VB+Vyn)Zin}s%EL7Y|ndf0@_o;(z~JPx4ZC~}9=NrSo0OZX-pT8AD&N4tOqdqiJJ zR!4@Akv9Q_9&zCSgIZQc+c~>%oE=5m1N8{2NQc0Dz>BKW<)HP4ljXo5s?OJI`PBp3 zC5smPYxAFaMcTP=5+lDmq=ACrDO})ZodYe^2rU}@K0sMjqKoy(f!C*+k|%9biqOj$ zapb@n-Fp|Nq)29|(H32B6x1~;8`yKvK1l?wTEluQ_|?@dl=xgwA9pf3)^Ud-T^^2X zG4Z>Su;zAr+zfQ-Q<#1<$>v%c2!&!bt?)Qe9#WSFT0%cTb@$k-_C?*s6-PSJ{6kyxuD=0k8|Ob49!M{i3-Z11t3M`80%F4I4HPF`1;gmr zg!{J6OFbpMSaryjPDJ zplc<*pGZYF%|HT{l=-fpEGriyudsvMXMo2-!Ai?RAw>_O4ZW2fptiK$L!wa=pyB1F z_&#)?<0laNZs-d;Kc$Eu2djVxL#(`kp6*EAp27PTg*|!QCa}wSlxYAdU6wGM8G|q{ zCnMmK!d@i&^5tc3%FJa-3Kv2I+d5!s3g9iSko2;9(eUOk`L3TaO+@nRuqfClXg8}L z3T|gcf`*+)+q*U>o+(_AT}&y4qGV6^#^9tR5#esb!r^_r?~yI!zzVGRuC1-CmYiOa z_e@xcoa&U6l)`K+;dHcNcV3ngQZXYs$~h)g3J6!6u1RD3#*xuc?>){-Zq1*1?5kN5yT11GR=4<)0K zOvHta^5`i!-z-4QAb+nQT6Jh)L3Z+kYVkqU+W<`2J0HdL9Ah2H+Ml?_?LzV3tnDp) z5Kk>R~LmY4nmF;G8#H6D#}nH zU~212jVl;c&BsJcOvVN-YcxWVmz|xRk1MllgGMUsU2h?#XAyq%6t-Eg1XZ_0$fo-A zR$jO3zTZ0~S1*fJBrFqBP9d($p)`6N6k2{NNIomAP;ft{>eSX27AO4zgNmVrmyCj+ zoRylN9-b!4R!f#>R(g-tcS(-i59bW|Gu!*9C?Sa%m^e5DI3#jks!c#JtW2zoLeyMb z^nBD=l6&l~k590K%pPiPUO|B-4r+MuifCx)koE{D1(YK5N7crm3amAbJTLOSYW8m# zMVqu?<;n~yD=UnI;do{QOfX?Zea#=qzhst~ag=&lQ$8)GFRp?h+~0ko+&1`^i$x0b z1gKYG;wWKBiHV6}M#>%@9zH%kko=?FS7LNMLJ(+qr(O55fiyt|^Y;h7!q9k8lKlMq z%y{y-Dl#k!vh@g zbctZSUTM4zugG zK-v&_@(>PVY=O$)z6MIHT;8OP3ue3ZO50a1Mo^d9U;&OAdInpq#Wa?E0~A3x4*t{} zlXiJ;U*8)MzxkylK>%QCZH>$aqphFVQa3va~X#ONs4gmYzO6;6kBy=5SA3Jeos zK$5IpdpWyGjq*-1?h7U|A9&T=ursHkqdUPN>^)UJBu!rIS`?8HJ5VRf?Dq9Bvctwc>Oq_v{gY9a+-f6b~!4~oKUPm99!eF&wi1gZ;F zgwk{AH5pKBs0o|6t65s4dm?~Hafz_7iQf=`I>{{&!fDij*#1;z7dVuG&N=hx^uH5q zz~ZLG>JBG(P=;{2B{ek{H*0|y$dyJF5f0Zg#pFDQ}|Xd_~K zIqZ@z4<6A$VG0|=g_PjW(^1d`^_so+GWftQl7*Ey9HUHSJ?*s`m5)mMTaILiB?MF2 z)SAQlL)7+rMrjJXT@|oM6m>ifV>I1sQv}F@8|-@PH}D671e;TLx(Pg~LOiCZyF}Am zjX0Sytyk&!m61BRK|4RUdT_o=l^Ph68D~olz{<_UM^DeiocVooFTW4&UGLy_^;hyW4M2pf+%-mAQpwEr$hOI5d3T~h zJ39k_8q}Ne%k~3Bu6QCnbEjxTzxww+j*VQ%sU<{IyDAdhd8TUO8j?0THa0q3+VpZr zuP!gIFWsY30j^mx#8ntdRT{r<%T z4l9v8ZEVcy*C47AYXsZ2YhLv}2fv$)8I5=VAPO@{ijFgCI=4^!EiFiD_l!I~Ocf<0 zt7lW~z=2j<%({AWh&eGK=hHCKSiZWB0alix*#$KvH26E}XukCXU-}bd$HE8J57GK#x`|lOD=W)IgqF0rN0~gd^s{Hjc-LB z=6{A^82WGGN`KsmYn*=*_dxlBhl~C*arHlU3queP_3J1aGYU2;ZhqltxE{*f37#%F z`lO*9%E{!grMJw9NR6c_+xamhA0-+00IpP2W{u+K>PLZi$9V74QHf%aVSB&IDAbCw z@Y4uKvn53u*A+u{`8#7#F@_3VEC9ti)YYJ$XqB-BJXC^$5d#r#bAtwk#=e^ZO?!EI zfN$55II#?b{L_UtrrGwRbr1KZ4!B5-E1P0;m^Z2phK7dRc$6vemgGD^I+S(oz-pi^ zRZ2Ak}+0=1r|wP zC)z62_E~7N#x~!Z5G!(FG132*Z(tdbkg(7g-S`pjIE>@uZI;6jvs zxpibp?8!>C?!W$BV?BN!F(A$>YK>V;&C9*I#FVbss!XOF?r1$Z7$rM|%45tNz6z>5 z*v{Y9;88{j%w?y;_|#`22Alil>`v;tg8b-UIKJye1(}_Rnyf5?ElK;1TC*7@1CuZf zOEQMA120Barg^azR0YutIPp_bN=o`C@Tl+DHN~aiADHV4;kdIP*Z^)r7j&}|O)AplmYqJ1f`*QSiUK(X1Qr(Thb$~OB+AZA$F#6CkTFE#k+%b= z8t})$QrhU2|wI=g>eA+-2 z(C++l>($t^1iShX5XDXb7+f0PoA(rL^zPfX>VJR>yP$B!jk~Z! z`!2`tze}S3ZDX67FU!OH6%7f`!pVHp=dTK&cUdHd{{0K%DtZL28?8lwt$KM{-!u$d z56{*27O=Q^dCzBL@l#d0tr9Yo$xxL?XkA^RG+5Il%=#@kSdICP@Cfp>N`{J6mG+it z?B4M6ACGurv}@G2*b;DYFmwag9)6PYZ7?R->nxnF1zb-KtUV_6VSV%-5hII_POGp` z*Kuu%K?z(j(q7I|4)DH3&FYK%82SDC2;bv0eomk-Ilmw;10^L#Y-xggl6g0)!TWgS z(Zr#hnd20uRmc{C=+)Luk*^6u>GRiGm7G_rn2?X4 ziY0L8K5DTf0sgM{Ve2d7FGUlM=LCgW$ zqR1Z$k{yhErjI^_95r`G6*1=f9Y=1^d)|RItq0|%!}aj;0Cp|F0?t)`|qx+?gH4gz~ls`luEUL+ta<<{6@0&XFwS3k4PJ1{|CkQ8Y5k> zYkihgkS4Yb!!AWY{J7uu>S7LsYPmte0cHbg^eHI(_=a(GiSvN@CEVy86kJZ;yY4V1 zstRpzHFp%h$cqABj8u5B6BVSqs0 zbA^YgXj#XmIHr(@@W-vgpGKJFPbQ#Cz~|sKx)@&7=T@)RKL4XqiL9i_4)q zrz&efJHOEfuJVgvLphQPnW63@U*6c>_^WFK)yakLQpOkfMHUw8hHRX$DLTSMKhLGi z88TCz$Jrt!B%uSJ?)h}SBe)1&j~;I3i3S~XICZ1OLBPW z;LwUPv0mMpH+Fz{`=gUb=Joxg(BW-3=G@F+F0Ykb72Jy*bcl}$!U_5Ha& zKvp$R`1w>d(&#rEfZy}3$tkdK@oj6$hBboWcD`;j19}MN@oH2#)}zxqn;~hA%OZDO zC_F}pLiqGI|3^lhDzzy8NeSPKLJfx5oqkr|XG?4ACqEOk_=MQ2Zr6*iI{r#+r~6El z+4?zJ@}flknxHB;U>1n9%LTG;uCYi3YlD z_l2_s@r`KPHWmelh`MLw=G^QqZCY_sZ|BP<=0B)a0_nQnHa;@*Y|U<~c7wKG+vi06 zA7VRlPSH)?$25-Q)VnqVJmM%)`rrkBo>m#L;V2G3wLH+YUJWS4D;(?xiZG@Z&6HCH zusuc4GA`I@C>-h8P(tF}5^P*tnAOWyT&rIgcU^OEOqNYaNz=9&{lLhRUnd5yH@SY84+cOb*J1tDj z)Fo+YJv}x-ClhfQ;?Eh9M|$A*ek{)!KW6KGwo=vOeLF0D(ETnfiqiqyv?~6Je4l; z$xsL?AumdWVwA@J61fbWRPZ=(=03)xMC#YAP|(iRbt)_C|@K8fre};s9z)QB3>zdc;i+(%TYa#?lEbq z56&VUk5}8DCNFS!->;vFJ7A1mmi?FJhSACSU9Yyb3$jo=9d8mvNkPp~cCI_5t zsSbm+)q6`8{XHyhKrM5;%Rd=sqmYy1{brO(^ws@pUcO9HR+V~R&8)XSavRl;l9u0q zF?nQ9A_#veDN89_VzSioN3N@YE6zrX&73@nVh|D#OWp7)y}0fdM;W~?j9l0TzN!rE z;YdlMs#C^z2?dDkqSwW>U5Roh(#J%|_3=u*Y%Y356R{+u18KuMx-c_H#9ieBCOMdl;n>sez)+sot+{J^;6<5P@*G{_tM5SgpxFQM9!E^V=k?q?|f8DE_k-hecZB|EoZ*y38J*6w$$DUxvt}}90 z3{0D{*a0kS$CIbj;ezP}E;;H{SYy7o^9OhpfDj@;zc8BcNTBEew5a5|p%4Qu%?$@&+d;9=Mf?o0r>u`Dv&%qcD$6ZGkH53uA1 z%w4ThPM_v%CQal<3-yBT=o>W6*6pbS*$^L@FOd&xV1}crx~;hSE3iy^`L>}}LJCjnmLMa#2&oqY|s zImEVW^oo^cu~j*ZE9i^cvcgxEg*;2mouvcRFA3BNWDmqMsu_^u-vPN!Uc#%d!^HRH zE}q2pYXUpCt&WjaOi_pfYr8XoUzbgpvKBZc()4@Sf7w_WIJ*Jy*k7z$m!Cm1M^sYB zT(Qd$A2CnYnVU5&1FRmtPKfx-4-I#IIVNAbI$$!-CgcsFZ)H|sR{XhEg>2wA`ePb9 z79+rZ34VZ@=~VOdYhuUbEb|)s43_!OM6@>h@B!tbS>;4c%i?FNFIe+W4#EhXwExh) z>i;I2{=!rxzwyfj7iph&>Hb5I9pe=L z(`+I84{)Bd{)aQ0mU{DpjcwHE_cXGlXuX2rn?6-fhVriQZejjAfY(20f>0rPqYaInxO9;p#-2u@2f70UUE|8jYCTo zAED!!tAldj0E74Yby6a^YI9B#zc2Su=*Gxy||MT73I5vQiVrf6X1?D^kZ*#P_-z{77ZgG5MD6=qIvt8q_mkfp1doJ8K1 zydv`k83VeEou;%5fVi#MDgOa<1y$@#~o}B=W7qg_$GO754cR+G_V5XhtQV+_gu>5 z+(%?KH;JE{V4sD^4~yR)m*62?R>H$o0eQ`%&&na%#iMNW1trqpwVj#jpXZ_av03KD zDD&uUg&uCv>3&Nouvm@^cwu-CkbyHef9h#^jNgSYZ;qq4RJXP*eMr!suPl$Q4bk}d z?hTpwdBgYiajrnu1&L-6yW%gZFhTyzw(k|wY`I_mkfMW@Q@#cI)0>)5rYe>ClA?M~ zjdJ#XK1C6KNrVrA>K}#@`^lJbNv>)2c7R_{bYsvm8%EnGPVx6{=+STZ0;E(r#>_(Hb%|qgx zPY5VPfJV{FmxH!hwOk_KCqU5CEyxKSktaN^BZQ1s2s_kA{$=$82cSN@w7zfH1(vF31CILyq8%l(Tp zPY#Y$4PD)&Y>Yn(!{lAJ7qVrn&n2bQ-o{-L`{RYE9EFe^6?=U}lro+-gX6|Z$wlR2 zs^co{{xgFU>rAnIv&2YuMAAx8s?Of#)~<%ShWeiVBYr^vqRi=9`X#Zbe_T4xCNP=q z649hiZ%{Qn7c6QW$43VG~)zO#e*4tEHt`Qs@L7gLsu-e z;k*f}LEizRU%&`b)MwssLR{&a$x;{+#O2FuXUY%jp`#NwG5p@VXR#JisSc=(Je-fa zCPEul|0)~(qAh59h~jD9UM_A;Ch@d2>7E7OPm60SpseIwI0U&)iW5cRm6Zh_*L8Yb zDs0dLgZQaMdiJmI;injz;5tQ27ke*|>B_jkYVk|&kXSWe$PdCCT7R{#R9mbgL? z(@J{0HeX;|EfPPObU&P9M)Qi^%w7k*p6*g($ugLcKmQ4x3KX%RXGIixIemFSztWN( z^yxF{dOeB@f&!#8y_*ERAB~%|n^&B&nSfj;@n^gHO#<$oLbwK&wSC!te8a&(QiH}`vOJrD07aWU`LW0Nk>Yma=PMrL<*hn+jDz~ED;NnpTob;);u zgR$cW5l}wE02jzLW5qUNH@t9R8ktP3{{=`k(G0m4iRC#$HXqBYgWV zM73KqP#s+NIHl};=@jIKC|CZy8dw_U4_Y}SWaek1J8*h`v@zvuE-huG>wPzQfAy2& zoG91}?08?tCQE)6ngI`v_gZEtuM=|vZ4HyZIvZ-M(T*xVU$MRW(1738!pk-GavAil z!yK)ui1zxjxrwL<#KjYOfBZ{I-(j`DEbo%5Bx%6~{(R!Yy8?|)f3j4WtSInO4FeQ4 ze)7l8laJE{>?!&OCU||d=lyu2+ap?>bv#o6ANU7!7%rvCNww3qDT)r~pFJcOH;Pis zUX5O;I4f+SI`^owIj~C@H!v4sLNG~_dZM(a)p(r3l z#flT_HN_~EzBgnvbGNZGVD|O%@37R6OLFAjPMbm_VL|OEi0uElenApWNLG60Uon3I z-q*dlA8#tBMBiU4YrCGW-n@c@Pk{{d4AXLX=z+JBqVG@ZW|=?xT=f-}!F|JihoR^J z<_(GpF|bvJL82y{2AbN&#s*&T>3FZL-LJ#@BX>o8Q01OnkRk`T#u~<>G=o8}y&dF% zR~vMqg7P=q#&qaEZ?~5!EL${D)Dd@5s7-4B2)Jy$B?cXg+>R^8&h-h2KJ7Htc0V&x zrjxkrzb=^s-42$S06F)48E#Jl-k$r+& z*UL4euHR=cbyB$a@On*-mS0Z_2|AO_Fx1gD)KpV5W#3!-p;{b*GJpE37py%;;G3fU zaWT%e@wNotJId{-a<&QjgWetXJ7&x^Pn!kj>bB{rJ(?ouWmqs|H0|U>!5)evO^mUY zo^J3Z==E5~Muq(CEXTwLDIi(Jb20@&@iw-dkc0enU$m1_Ls4NI2{kE({P)9(4j|xl zJ6f^u30B(s3LoqqFHMz$gKi!>XzIhL-QMdVcEsc0{M|<$0>+PIBi~F-Hz_tB(4M=z zMlRoq)plNb>w^;$A3K8vf&ibkhGpMG`OY2+t$N>NUrit1Bm>EHBg_s0BHyZzyWo+@ zZUP>3uXL`{mXjVs*%N`QUWt!E2#UQs?C;{6UWMOxLlzf0{g&UU?AOS6e$9^by#4cr z#=G8NjRdeAss}#$Z^|b+OPVFCRI)HLmI5P!?m)63*X>rgz$D_J$KI|HcV9Czvo0CW z?Z<~CjRv5PZ=QDTl+7p3$vmN(K^wru`(x_gNG3T8IComzED6PI4Gg+H_AB!*zCncx z2n>mn1?^Y90Z4@gKOM!~@F1FrYzDmzg5Jo3?#~m=qF1D82G4Q_0NrnA#cV-i+f2x} zQo}*duVty33lSR4S=Zy4FNqy+wl~O8{gWD#R)^St0C4m~2LQM|U@|m^`-Y#^J9P`X z6Jc%j6-g*aT!9`$5)^DQGmko_$bEy}GZ`%NDNJe?h)Z(Mzya1)t``pV*kU{l9c<85 zudG=`Q$tE$)nlDW;G^$5=nW8Xe;&?6p^@IwCU$xmXt@bW1QW*Cb(h8HUC-ClIx?>j zD{5+DG03l1Z*S^^aYaQE)hZ^M<>;QG^_REg*;w(x-+a$9$^Tq#KJ2%O!b#Cej^FNm zRkTU?`3`~yU9ZIb8VMlpBL61E8kQztg6-UUY;qZdl{(5yop7SCo)B<2aV#_ zk^i{$hHe1W})ZCIpAJjm0>bhul zN|{7pLkAO3|K6F{^%&ikNqi^hPxA%r_nlZ3?`B}=yh;8ndyVY&OXicGzYU8gqN_go z=P4_W2i<7*)cr^HvAWL3nidMHRMXb1YZ)5mCRVV4uj9O6bnYms1C?(?Qr6IHcF|q% zpQvB_tLgh&c=aF6_&+Ep4D{ju`|FyIbdcJN=}6!M89y9~CSca^sC|p;6Km$$rSV$h#kcnZcsBnH2~@GN ze&qGSR@hf{Ip8e*+j-QWIawk+|CQ54(|gj-9hMZR|z@ticMN=kNfwPG~N*Z7u~PLoz~ z>wcb%jrNCNavZ9XPwp`72u-#7$fjqcAD$M{8gPMm;M$Nx1*Kqa4!r{O<&JPlsr=_265NSmjx zn?z22;q`lTbX+uM%EH)H#I5gmAiaQ~UFm4w_h746Ql!vjrnid>GTO>2T%7Epu>M%Y zCXrku@Ma|0f6_=(bp8ApbE_ME7LZG71s@Z0`}~}gfB<3Y^XJcykdPp}z`(#H zxw;hx0@He3_A=vI8+HPA10^Mt`Rvrx)V#be>;yZzyYkc;W@g)tMvg>3#LMQ$9->~3 zY93v>@BK&AH6U^v`iLs*2r0k3^FAS;!io<-%C zLw6M}2Q*mR<*x{v-4LC{#lbA z1Bp$eNl>aH(#6T;OGz6zq+$K|4!jl4jsoh`KeH zngDd8iGb4IASw{q&;AQqE5Jiw{+m-OK^DX%=VS4|_DAqF<^L@!@kR32yikKe;b#f$ zeY_qfH!?CpCl%N`IM4>$(fs_tn?3n*R54%w{V`lQ$MNxTaLr9_Ztm>ttjO~bm0VV1 zLjxMQ2#S5=4Y*#)$;nAnv^y&+t5`NsLI&K$7|2z-Oi`!u0>dW|y@#I%nSK6n*hgWn zJXHv|mcL4ndq7Z*SNip|fv_dnx@{xm;2ESAS^g78F2-X;@eNI!d@;~OLH=x}R@Uy~R zp$+^KiGOv)cb*}MV|jv5RT>pl$bF5gefl8gJXlL)-%hgpLYNyHf?%YNiFbYM!4eQW z2FUNGbv!wUS9B`k#%2}6tixxbGOt*Vx7fW&1#nU}5~U}5n8;H}rTGuaC~=c_u}bd? zEJ&Pt*ktuOeRKX)oI;XwT_U6>_}MPAOcz&!M?G20??*~mC#3nFJ^VW*Ho1OkH&Zpq zbq;C{c+|_0Q9hi7uH}T_xbuu$E)>z*rsFO zCDdhSb*In#0C_Tq{|WA={}junj6guw#pr-5v3To_bX^PD5AoW${2wV-+n75adpd3& z=NXQ6cSAHYAh5UAVS{k~y40j%zff$`cnZ;}wFw655KUcEdhR1=;Yp(eB?eZ;uOxC6 z8U|P@s3lR1K!vh7`vnEGM5;_AEbLDu3aDq~m0FBDWj*?oUuO4u3FCn%j-wo|XiX+^eYWS5S$im;x7MZ8ChSG#z0b3cu)AlI+O z2(+q`sl<_mdybGEZiK-q3L@*gkTNmw+ywm2 z6*5;W6uo~U0`f8N%NPB^zFjttrW6(3y!p1aK``*c)Os8NMUuFx8Pb;C!8_lI*0w?0 zqGEBjaXOHK>$HKqX%j+Nx@q$!KWxnG)@=T{K?1tTSF%f=#aBOu*y%&~ofc-hTkdYZ>o3+mq?i*FZg(IJxePIl`(owl91*&+v=~>g{ z^9m|E(NhDZpJj)z^Bh(LvXJbj*qE`VXC=NC-G>iEMk`dev|wP6S{}nHHv5j-RpVmg z>Tg;u^0QRaYzSq1Y5hr}a0GukoKRCffIpnKc4@3{$ zT!%w{qVYcH2$$72D5jRYtIucqOFdIk&&dND8VQargatdnua9|7jS!AY$eiiH{kt!_ zKHbVwJ1*R4nUZwr1VVZG5#xAmRlazNzmMmiP<+`*a233d-E#+V4v;_dhUV8aby@?J zoYHTP;8cIE!NIP291lt~uiL20H(LXPPor>J%%$PHsX(FfD#iu!;mol}tv5|0; zOVb7kSN-!s>L*RGW*Rxi$F!l?9cP2M17lg`7TMTc>2UE{5Q z;cRTxV)6}u1V$Bmgb{}m#IiLKrYm(dtTWah-PsB;?;*tO|BR!$@*{DmXtY4BJ0Ls!uW|$TOM+kPX+|`2F$a+5J+1eEI9R(JS zNRcLAJbt{@sQ2NP8{I3Ju5dESSz<{6!13afC*euoV| zx`+9V);VulXA4AX>^73W=A%s2p3FEI`r$#5M}`nd*hJAm4r2+)O`*nuZ$1;HOjqWX zhE}Ox((FZqn@NX|-#B<;M?rBgN*P!tRvP>4pbZr)j(jI0R5*{VF1O7vsm^(rP=t|mo!NK!=5V_!}v`=AjvTYv7u-t#LaB7iu7 z4qU#n_L-E-3~%P4mcCIX_cbZw&TugVn5F#LCg19Jvt)0!L=C$TV}9~$z7Y^ zQ!1U7vJasHMbxTT&#But24>^Rbxg25>PY1f+Pi@zlw@kAB~DdwfwO2QK_Ws)0OR!W zraYOD2`j<8jBQNo4_o>i+zyS|_e8PMYoKSwIiQ6~n7I#x zdM3z`U9V)QAF)P84`$2@uFDi_sYEW5h!?`yu%o6Y?Z)l()6Vn(?Ovt8sB zyFg^WV!&zNl!02`-Y3>WhZRL7&K5cOy=j=#H+lBN^@Lgi2wXTWsD)m30IM-x@$7}Y zl|vrBynebc98^|c@|`a!W~$@$P@G1WoRyoNJDQ0ui+N?Wafd!F*VC&^wyq-?`RVr( z!@Tvfbj}rp&ZSbVlWLX5jlDYqck|>8<0!usLv`vsV*Rc@JKmXjqs~GC9^r==^J8eMC*}} zuf6*(B*tHa9z@bm&7a+yYBSX~b%&~&^;g`#wWX~yQVVhC(_^|eWEH7&Q(0)_ZA(xQ z>)x$GIsJeei=V=duyE$hihd?#%%j=jW`E*LRGdmHkEtlgVvC3EG_2txa;+sWYZLYq zh|N?O&X(+-k@_ZU^PIxpnY4?xzXm)qsAY4OioN#_8^#VZkG7@Ot|+wnWn8&o>K3}S zHx^HpV_d{bvom8TQntl`Qd6fqn#vfjPcgis+|0y)nRs~*5B67c)+G&(d7$zvNghFH zh2-h|L@A4C2Tn?z@?ta5FJXA2ntsCWuvx{^4{KJmIort3;ZPJ!WU3|G7E-KS%gUS) zY8PJFSweah2^kjdYp9rCMv)R+-J8lXk$7m!q?s00g~(DhzSsXioi#(k7eV>4o}fMn zMC1wVAVVdOa<8x1v>$^#vXG_2U-nn8PU}@C5YmoUD@6CLmdGX&*(o@F-c`$SjxvLc z>-9(6D(HbC2<GOr^U{Ph3X=vF zqWEOe>We8Fx_#!($<`I4PA-k*am92dW^P`SYNTI>OJcCh_}Py!sU6J?)gb?|AjHnY z*^h$y1M)JQ*4E=AF><8Jj3b|6;fISDL+69 zC|`u%s3rT$T7AH7pNFAR3$BXt|GI$*3dUSU{*&B4aNbc~E9Dk;OOK$2;#x?7V@8Q5 zMX%--synfMhg?YUvr?3g1p4Daa1A8%co^3R2TquP8RC}|aoQhB1mgXgk-loNM~j98 zGX%+r3*t0|*kDfIa#~@3RRXp;IQ+*n-W?iaFybMj+qb%G~(Pe@m| z48+!v3MerjdO2>{$7?b9*`S8Tz2(9X@X~>DC{*#{azY$Q%>c)(1302@;-?$%pP-rz z0LZl4{N6DnN1oA9m}1_S!x-V2b)l4S9#J515q%yd7*u7rW#pW7V^IK-{J@S>jRZ5j zj2nO(p#?4^+!({LU#@sDI)spq{m?Sg0S#(70vbuV!WX#Z!hcT`u3=M=va1X+naUA4 ziPax6gu{9GC1n_DhwByz6|xEHGdFJZBo;3M)quWbANf3!YhP+1?SY#Ydnr1&z*wx_ z2~C8%AmoWmJTI`@X-<&`?S0^p08_?Nl<-efNsK@21k^kd-wds`J$flBcPz6cSTH`5 znw2a1Dh~NOTTY)y3|GjubM~&1NG=UX8q)eQOgc=|GIrx-R<3d~3v4f)bv=OhY6P zI;773g6nWQF;BGWg*&9Q9%9I}3&vT^6fDE0?3?ag3s70!w#wBS+6V+1#a<3gI;;n= zR(EY53Uo)(8F_Xnbvm;mx%a5lH5vD!IFCwx>W*ZNY0c8RRN#s2hd37hvO>ub;uxVr z)m8`xw*lZdbQ-hb-iBjYN(^c@I&yul0_py)F1s!n zu}YIGg;`s1fcr*M+k$(mS3YaM(4-Jem2~F5Ivs1+g^(^+E2fG~Mlp=wVN{zDo9#g6 zfOTDt7u6xg1T?SLtXcYg1s-zonerq_{HTdoChzwNvSe+D18p+HULI}r#=(mKf-Bh9 zdy5Z?;PoWRb&i5wS=(ISpx+;Mj~vJ_-E_aVR>HWqs0|e-mRFN;q*7{}c>7!boJG`Mpsa}L zC(zE$!}=4YTeIy#5aM1f`TKe8!adg)oNP{aEoZLSC`n%FG$RBY$LP!&Q|T0?ToXV6 z_2{-6!W5#j&ZBTS#knNuW$jrzNE@{st_B++xr_=(E?d1FGQg>MeU7thUu{;S9fZRI zHID85y6}6j$S1%<8y~Q1IeFYX!?PnaxJh*Zyt06k{&3 zdEw6N=T)(Ck%S;!Va|eyD#$`Kh9HRdXZAREa=FScCD`6yb+NX&$)*eSqxv zurBUp!##?7{AGs~5zCcr1xYXBR}jWXWXu4503f95#imk}6&yYEGAc9svC8{U$Ui-` z-lXeZlYa(L-r3%;k$?-^O}qZu*njfbsS|t(URC;G+f4}#-OI9KgYb{uyh8Qp;kETG zY^wfu-sPVnPOO>MbD8$cXcfWs_tJTA;j5x4^?I`_z;R_NS3ls|0Hpy-c=sSBq_)@Tn#dZ8Li}i{`pD11 z67?ai?4OQ}DmE_1xKPoHF^=mFUYvoqIk7q!L@bLjgG5f0*bN-svvNK1#dUq+=&_^r z@d-JWB-#AataN(rp6poG>PKjaiT&n#cEXYR1?)cJcVI8(9&1qsZ#45&q@{un>kCj* ziJI%tA0hOK7ZS|T$U%g5p~67bcK#un-@kog(yoH|M3yKE)Bx|iv~6CcQOv-2kZ3ip zUtV+SetSNxl|=KOXVY&QacoVDj}J)*?}WgSB+vI0BnX4iLk`w9P3_-)eO~I0&{xc4 z4L?D~XMOEIK`-qcg`e9q_J$WFzk62=cC46++EA)`HTi(^DGe|z6G*1}BoQN!l<=8x zEKDaNX10!rGmckXL>=y&#xr@JTqza2L6DmF&?{u(YI-XE^7U8iPPow9;UAzV*U#HV zk~e%cl;2miQeR(t8E-#(PfZ8r7hu#(>QP~%3qT+?9Pf=Fk0u{7RbX_Xy~6f{_5MFT zSf+Iyt4w)d;>VG?zyKlocgcKX9($h(rL-FEjy<3XXScG5Te%U7b$>E_?lZ=aopT?I z^_Dv#hz4L3#yhiKa`cKg*3VC*NrFRl!AZkZq}V(HUqpHBO?(A;77V>7=@KR39Jojg zkb))qKovGMlG9#>-5d>2%)50~Lw{1@mTHQ1?ZrOgbU^dZ@+-hR=HgtE7@A>q$5Yg# zB1e{j;4l9?LILQJ0u!FS{`SGppi#svQ})M7led%1?pGRwt!DcrqIj9_)vX&)!oN@N!7EEU)-Q6Lx+=6Q#i_ZnmCEKA@M2AT_Hn(-)aa4Iq3po( zcJN}G{hwUR(e?>ZhGN;eAX zFp$Cvs2|0?!A7HD=~rk<1Qj+0d51qWCP6*2Xh4LTr~SMZ^6FLnq9~pWlDPkKyCW@% z%lcda$^)=GPrNs<_=w;Bnfg6$Qpfz1ZMv-*jvR#a{ONk}_G|dnbH&p-09G4Bg4OUb z(9ZY4My^;R$kF(QYrF4od*9&ctLOF9a_zfj!;#OznyBJjV1DtN;q%aKlAhJuY~v2> z#@9oS*r1lz!FSZ`n2!K-w9XHKyFSkHPm8w=AM(k0ngqyOY!GNj%)uOB6P7dC z`c9!6l)%gzz9ggt5NJWH~AEB)s4Rr-Mx_p*GdjDkZ z_jd{o(P{%a{q5`CMwA|q?|1R(;0^veKPnhfoB3ctwQbn8j2+_#-M?Zb_}+gP@wm=$ z0NOkFH|aCz*vD%(%KyIAV#yp=Bj+p>qThD~uAV*=vr>gJ&}%VzRthIGeAVOYrwVjN z!0~9*Wc_GxuHUS|m_E|-_o;|s{7VB~V6F!H*Y>bNAdQs+{O zzuE}{5OoPrB6zYo0uMJ@GS)uXIvr;ao&FKq4#;`lwoQ2+x(s}b)$t_b@BC8qbGMl5 zgGUY_Tb@i~ge$(|Z(5@ECDm_)i$d9~rG56pf^4rxFSY2mQ>vSS^-iHt<9p-okyD19 zUWaxfJGb6H!(Az`n3N=sb8MhCddgD0)F+7P@VeX2_{KUPMknhn-EgUSn`V{Z)=6t6 z6#;<_n?>m}*=IM)+RM!?$@hHcGZGfoHwq)Ar5w7)2R{V8Y|b1C>2P*A%8w^y=smq| zTxYAx8kehi1kG-Dg^7Xwc(U{+-7g3Z=6_}87U$oMOF*^hDY58ZA;k-DN?4(?8PLvp zOBkohF&jU=Y^uQ!9qhomS2Sm!zFsV`2^2j!3{c@AR$MZBf94pp*Jd$ns!CGr{xd6) zv-SeE9_2jWTk+T$zu|U2Ph5JF3{3&v)7jLio4Ef@tM7 zB=wlA*G{7(TdT8{)dN4SB{y-V%zphV09)C&mxti>qul z*e4o~c1SrS*pO`BNKM+)S3Uib-nAgVV6ib5!n4^8vFHpwcwpelu=q(svX$^dB#7DB2hE|sr22xOhh&LjjO*NNUYB)3@MW-P(V^k>ppU0^ zz_+bm1dCN;sTzoDG|!y5PpiT-PhUzFkrXKrYgML-Due~nAhhV8qos*=Lx;r_$hM0? zods82cy=5Gn(t&%caO0AjpFrhzF_y5WHd&$pmsL4HSdS^{z=`ssIJQ%o_i{*gBt|f z(O)Kzx)7qws!D&k29$%_|8Nobm3%PlRsYw2W?G1+4vd=q=_B=DeS8u?Hsx#eL#VvB zZseB(@t=%rwThR2B$^OiLvK2IP0S;agvq~==i-JBp_`LB-Hf34(7stuCrfJmIETmI zBk5T^^LqQ~THN#`@ZR9T%&t`*-ETf!p8fi!$yAd=-dR0n%b;sY-i@r5$;^xkb%u1LwU* z2WIXdMTbSf^%-rBp`EM#nK~JU!cP?v^}o*(AD-Vlk>|;OXc3(BwY!SsjqM?$RS%pb zh_CxrlO#%kQ(@SgoGQQlP=W=h+(vRT)~1=A-!(fn9Mejm96#ut@r(<^(`q>aLp`&H z=Fh#(eU<6+5!;xN!m)mAA<~Ut%kl-mgqk8!!qBB!x=ritv>aN;wuuw@&Y!n@s@E0J zk$RArN~d$ol?kBxYT%?fo=pF^iGi4vZ)sMwDX9)E8jUoe-I%0Ir@=q1Snc`I_R}r! z2WSB1Sd<=)e*XMEC9u-4)agOS3_F;w*Vq{vs6NVgLVL_I|CxvU&dmAt&j-*E|8J=Q zIj2)onBcxJ9jU;wxl0dar2OA!IRxaP2iPL964nl$KP+QMh#*&x#Jm*~kej3tNE@Va zxZP_X4Gl(Ua130NqD0UrKh_1`m?0Ap@U47CCm|-FFpxpvjE0iBRD-m|Lq*raRtgob zQ$isbgFUgTh$B}x)Tp;@M`~7+$KmKxErN-`;*)nMf=Ed<3+zf3ql+F&t}G|*LrVeN z%Q(4L;dssIVe#cgC14~&ZmOw{xKO+Z5^Um)%)tHlLUusL@ve?ZFlb1dJ%)R_@6Svm zdyXlXR8#X24w5>7Z5Cm*{9sV%GqcILr#@ua0n309cz;c1?Qikm+*=`!zNUscyAc|HlP05)O_SD^Wpni8Dk@{w*u|yC_A8l+t-U~U z4}O#!tb-TdXAOloG{Dy>E_mehw$vfq_A0oL-$^LTk@R;Gq$-1MhD0nWP74ho`;tsl zD_FUAk(BDG8uZ%wl4zAmm#%~*cse+f;W-O&VS@=$RGKGI;29ZV#Xv@cNEwbCr0_o8 zyj&^{8AAa^Edjk z^o7lub+-@()~)mA_A`*$c@qJ{1RQNeoyM(cSG5F0qiOb7WYUL7;$BijZuLnaj&_3% zz}|hH3PLCria}qBj+j0i%UMjk*i&?Ge#5TK!;)z|)=25HW)K&|JDD zgKeYloCqu2&BAB1<1mbhz$|20O1N;js(L{btcZamBz``BpJn@{a+bidWV*SwUyMiw zhV~xfK*n%~PA=OyBtlLjFuOn>HyR~NonqjwP|=%*whDuluFpEVBIF9GXvL0L-v7sx z_kxSLtiB-|CUrE%GUnQrkHo#P{Fknf3bFo4yp0xR#vnE){h+DPR$Ue;S#w%hYsbFO zw_jTk5y^{o+FDp>2#mGsw)c;5NQH|Bw`=#Dr1V~;Ql}`oX_qyo)*9+~Ipj#*^y9KS z6=}ip4>DK^zz;ZyJ%$RnjLCBJdyQPjxdlrqM)Ha_bN;kk1o4VbLMGIoIqdStTBF82 zo}ih>>V$J4-x3nid|5D&`!#VI%Xv*SSxe}vL~5mJX0y(G+YK*K__-xfFjLm^T9m2M z%fDO)D}VR|FFcfv;wb>TJAVDtX^1v_={56NsZzZocZ?zJ6az1d0FF><)p|zpQQsb1 zwSus>MXg#QN7rXqIDgq#OF|@n!0AuBjz2|PlmaB|F_w_TZ1&LW||}RE6Zog5zr)( z9oj@s4?IGt(U&1+s9i2vxYI{9PmRPkQURY6W9jIE&0+}RWs;irbPzj@(cRA!**amq^MJ>)@4$XRfg-`&Z6?5vwT#b1-=Z9mU`D7!Ubj!?yp& zJVogz63;3%t{a9}ZRh7*i@rjyj5^#-$8m>g*;$}*<46gL50*6FQe68)LGt(b3`w@7 z)m*sfkzK^7wkqe+v*|HS+E!_n89qve#QZ)iT@Sm8Nv$})j9QXWD#%aa*J0lZ`e~OsNQeq&FbNS%c?Ag)*1jY-P_{W7$EcO^E?(M&GuKb% zpzS6UU5#@q^NP@r(YtxDV~DVy4=Xy; zij*2w{3KnH1Jh}Cr!(mqRS;e}qqdbGa@hEUR{fmAlEP_*KD$1ZrIE-m{l%<+4_r?{tqDCkv%<%pN%q z2C$k@JAbiljcFnloh1_8p9nDQ<^6W4b5O1hhaNdf}J`?sP3ysOWVk<5k}{eL8UO+c_n?>uGhL zKJV(c2*fKa1gw>w>M@q6IY7rZ)Z)5)6^8F4B*V2x_kRr+X6zh?<{qs!?wwXX$o z$0}Rd?*PPxhKZbJW01L*w&lID~vknVpndtml1eV1>1TwW|;mwOFEM4D!%*j zdrAGTJuCGCg-4Ut`#HC?w%7vE)|h93+XEDS1oY-%YxvU;?E82Ua-^I%ja9ENtFW@w zwPl~b3qJ*je7sQ8+1cLSemDx11`iz&MG^kzVg1x!LdAh91r5nW0Ra;_>e^W_@2Fs| zb8dt3^Zx$+;^Lx6GH9Q6Dd>9F($M$M8M*AQRle{yOe-aQQkbM(+L}B013}kU_G{Ng z8$Kw98rt(;^NW;Tg1-H^8VG9_TX?1FK8B@)Q0{S%=Q;F2P^k%>y$5I|DoTwbWfqAYj&ZIiaBFH5PoH@ z!EL>wMT!j7oI@<1MRqEcox<(7{amPx^57^rhrEJa&eJvore{pi1Lf*)@y`r|b6zT+cA>K}?wkfPTNSR-M)5e)2Ff!G*$68X)?y{% z6VjB6C(@B1Gw9TMx36A4jPlZ|m!I7$PZP4=BG$%GQO01eD#cT8axz`u<2-$pOKW1H z*C9Vb-uRTIc2Y=QZnJ{b_GS<1w=4!>0ZVNtEfp(nhEGIdEu(G73qzh}2Y^})=;4gi z8_~d67(+|qT5G~XF4w!6qSk6*>^1_^3@>IVDdTW28+}iZDsf_xzl3m=p@6`;kNZf- zn?9dDp^KWOEu6@EPIQRrHa3inX*(<>@Rb8E=FV@Gj(-1`cmSP3PRRK$^N+|eaA+~Q z-_ddjmy+j#(_d3WobsUawMM=#zi;3Fo_s&_tIK1%)MSCj@5ore)`^cNi+cQmFn_n} zK1D3?&jT7^_dsBOK|8Rt6^AEWQm;0NGRx3BQ0%-BUv@+Bt^7{deU`2USKvfUR`#}x zL^?mD=%zqH^kPbLMFFi^3PX?bE$#nJ9R8!Wi{ z%LZQkN@G~Psqyke8Rp-sdlApX3|3AvO`RfNL5_{~ykQxH1pEH36JWjHVEE${tTFnh z1}Kk``}M)8_(}6bIlOZQ?K)FmAO5eWUEH<`{`>yl?eUl3 zTu#|{0lw;Di#C3%Y?GVn>w2P`%BPmA^;kVp*}I{)BiT1#@52n%S<{Tv4@LY~bw=+O zY_giS{@lF6H<>!4X4XrGz5=1#r-MQ6$IeO~>U+Im}+KLcAA6C*=w3<=w6*W}uwo1D{)CQ+XIzgZ?`iF8i`IbmtT4E$GD6fgzidslByAEYfG@a>+Tb4-&p?1T{ zbwFB)GyWFl)o93@HU$+CXGZEapN(=Qbjt)}0VIbZrVvd`OFgzwbpyrYIzvJ3meig~ z(I87~s}mnkEyY$+lXO|nd@KnNZHoY?Jcb9meE6(106M?8@3&uw&i#bunC?JwtyLIY zPJ{>}OXR(f^B|zjZ^o9^M!zIM`?5xv6w-(l-M;6R(2L{MW})?*1<>cs)R}Rh>eMUO zsktS!e;l6m1X0Oj2nmxUbE?yelo3`;)g~@ybRLhWE=6$}Lrv(lYlW_cOP8 z63Y>#fiMbCGKYo{NFoPg>Ek0C8 zrR97Cs=#0d^y4Pg_EDE}m2slKz<(e%7NzWB^+%AX%>G+CnE19jq62@o# z{r0MYf1&vnQk7}bSy=fq*0VLEwoN@T)zn$QY|I~b#%{W^6%}@#(V$Yn*gsl`@dCm? zLl@0_+s1WT4YOK|zryFMCQ?Ro6D$^1T~cYUDMpf%E$XY)u66ql@zz%gUY`zu+(fa+ zHiNnbS$UCD+AF-332CC%NMe{yQ|K0iH}PGrhbrPm1=J4W8G!uK1TOA1Ya&s%SeC+t zTO~bEaGK_KYmh(~|H#zRXBE1G(h0~7Fbp=PwD{_((C@uM9F~syy(d!G7xI(xFmsP+ zD34fF$Mn`)VYtE2Mw04QG4l-v1dG@KO;eV#lzcA~@prt2mge4|G&210J>4we_VE(F zd=m~XIH&;eUgM{FMc#yjq4D@Bg~=-r6Fiiz&6SeP~GbQ>#jZ05Iqk2`D3$!5MmK)IG^_;A6X)F=^u?;bB3>r{8dLfD{drt6BC-(M>g~ zU3#;k7dJwe9F}6yD|50U5CecZB5#k`xof!Qa}mG*EYrTTZW-zZYkH!d9g-Jltj3;A zmCP2AYuAD|pe;4d`D5Q``D^|F7V{>R7j7qpIpx%Btg6g9TS}Io{yZF=y3ZD!`I<_0 zt^Dyy-611-jOrXYiP>@POez(E?+|4J@?81PmGdrqtEL=a?=aK!cEDq*v^J!(tdNLC zF=t8|T^ZsE9g0nW#2xQZ`#0yga4;AQR`94 zB*$;yCs1cWj2T+#>ep;Zs9qU5pf&XaAR^HTbi}Tlfmd@Y{YW~1`6D(WdUjy@TqiQB zailLCB{IerFOdDR%(0;|uE`Wo1Q6H)@r3f`I2FP1+dRkE(K2GGd_38SWcA}Nt3n$i z5$l8C7ZoH6cTwMb0~RuUY*V$0^-te#4ZF-3l`577U!LX?hF{@eAv|gQe*Xw898Qf#;?Ci0tWXBegeZ0UPuXUrLgi zy~Q$I^-8@#9V6c3lMX_!HmDN0$}G&8g~)$7o)c!DC~s+VH>o#mP=^$G8RJfMVm;(S zRo0d**b1W!EX<;+u;jHqxwPVp|D;0=KLg*E+Z$mR7?r3pL&X((O9KuuB-0mI^eM#! z`--Z~IJ$lTnaP}cc9FVmbmnZuTJXfI6jC>a<3Cf!+Ofjklc z&9E>eB3QiaR{Ezg;^F_~vga@gjcQjc?j>09Zxgz%VJw*1#Xg+QLS?5W#H+cRQf5V=zpXq-3H@z@bvc0=AfN7`Tl!bD0_-^_H16 z*Nl2bn&3&Ol?zwfA~ueHYjw?I^5CRAy6t2vN#W9Q)F-4%rN{c^%xyFv_9>%9STugz zU9CE!;TtL0+fUn<210~7dDH$GG8!p|YQA{0)^}JT8rlqF4z1EwV!2!@heJ7?IO=5JL^`K zomSoG++yTtw%YB4hj^Ud>tOCtXJ2p6`tDzq7@1 zM1B!FzVUz&DfP=@U7GHcDK)a#F3%SSH*e2RAeRd16E03+EZYd(jelaQ-S%CzN%J<0 z^L*c7s>K)b!!TB4rLii;-Aep`{O9j2b&LlHiVaZsU0wJS?cp8l+mRwbwW|JfANjbr2Hok)-NJP;*p<_FwtjysGREE8S zxheORY&K+Jszr=Igc|46Ai2%9SE%6nDbyxDl6{RteO#jpdM^B|;DvwF@yAMk#%>e& z2FUxCtI|2E3{;10N#J@ZI$+`$=p<*pDMi@r1FwcEXi~L0NK_7(V`4anlnq|Dh7w_7y7|#z_A2YkIPl%Hh;} z#gBR>JlrDI(`GXV7zQX*xx0Xdsyu=qTaZ)KSdQ&SjGYZ;QW2-9^#{Xm6dpn4T0AMu z++%-8sJczuM4&d*ByFhaDpSsZW5`_&T&KNe)HI?qid0E_XYHFGc{vLmF&($6#0#fY z9q+!TSB2J_Gm^ZPyTq#=Ka50H_)GE_^wnC-K;ujYOSR{Y(vif;{d74l%-VS!+bzl} z4Y}4f2h327FEL8%Z!bMJnyT6k50R2dq>XAv?LYLTfYSk)$!E!q{id_IXM&IjIR?K1 z5&y{Yy-zS@iW}ecrv3VRysEsq4iqG#PLs0rgcmG7hO?!16p2DBCa8E=_R3F;s+Ehv z%6qXKSYkkj2J#2hqP!~pU&uy{IyP#`((c6!ZyB3sWC;fykb-@EeJ4NAmPY>H;qlvH z_>0KOtT4wH#vbsZbI6P=5z(xX`sV^>Ze z7NJK(OX`$E$N(1)oCT&#!LbMJR(vKz0>PpDt2~&tKW;`tOqE1!vUk_fa z<&MrW8fBsK<%IlN4Md8l7*12c1QW2#%%PwS#j#lL2$PNE2p>i@pdHBkzzYK(36GFD zjzBsQlPXS1xB#TefgE;~%O2hv6b|ED0ahUK+13I43C=PP(RreT_K~TO?)wd`DZ%ms zF&e&d!&AsE{IPM6k0~);P=^&P(+CWbd|CEjsD>P}((eKRS1OSk^diWagyQ#_;r9k2G+55a4SF_b|0^RXTR zQ;;QzpP-Ik;}DxLRxz>kJMY_y(VxQtNRnf}>9ZohZQp;ls){R&#b_|2>$t;&89c=p zkap>=MaL})q(4&A)Bctb{e;>NvuCo^s}JfQ@a5$s#Eyp0*bvCi_4Qg2PfY)2M-jgF zAR5xw*FRn?p?Ck!I*Wdpjf5NKw;~}JYsPTsH`4DZWcbeM`SZ3n9xhWz%gwR;NOI3x zpO!zdVEF`KJ~u$ObNuzc#k+ViWYN2)?j~BrxI2)z0(bEmTAe zO62<$TQ4x*^Qp~wRG@^$f0J*&8eC6fyPFcG`rNBC%J$RxyWj6`D$-N?=9mO8l`Zdw zFkCa-6Q-UkCg{nnf19&KEEY+MZ4CXNFPMw`KOGLi+?VL<0a>v|FB|(asavoE*KJ(A zn;=>W$Kk(fta!$WA?^UzwhdTjZQ5VZdcwXxiB`=pKZybvCToJpZ7hy%2zHsR2PS35=q~1)J7BVBoKe&6A*1d90Yq# zP1SoB;rZYa1VmyG!f00xd!e0$BDt$nY6q%z;|3a9yD8imAR)z{kqLlAoHyWoRKW;e z4E6+0`MA&P*T0f|V`tVbE9#^0Cr~09Lj_uWPX*t8T53ET1KTvM-BGdPlzDdSrK!jM z^#;|aou?>4Ob#$utoN-gzRT1YFs-|g5XE+x^uOPE_EK8)MZHx(j2=Y+bZjy9!(#=9Tp}9{1~z6ymU)G9Qvv>E)RxU?c7CN= z?#oSDpkSj}_+gCMF=VpzTW-ehG8;m+9p%s<_b{i+^tL-*y!sTl z66q$za}{q(o5+M*V>O)kRalvfISvJ;YZb5%6n@TK-R5-Jbos7oe>r{nzX5F zXtG-V0{6jka~=R{1-Ig6?uE(FIuAf4lyKav6>l{kfjMT`K`pMZi7kogZKV3N4-&Lhwv=r z76z9tsAe_W7g0?D*B8zFASnNZ$fMrWug6lpJ9gX{4h+*NUp;J?(74nu>m`UgCP6gI z$f-S2(p;XD;2H3*2Qvs8sWi>UESc z_KQu?Q5sPu`?K-vIoFN57jb>P46J9M2>xz8^k(F{=ym{I;SuCmo;t1d>Z!fJ+?W8U$NR|4jTfWpQ=fHjQcnK2VO? zW_Ma~DVFOt=5ZPoxJ%@JJ!q~5kNOYpG?cZ)hS!AW&FHC(0UNtN-twACShxzqTee4k zltt!mQbfyo9AR0}&oKGHulm2V$@845m4+qGGPCvQ_l-y)4)sW ztqMC6qim6=`%`Ehv%<9NHU~W7!OQ<$HA{gE*Sr!P7qeiV;Rj$&2Kt+SO@ejt2p_|g zM7ffr?Gwng-D-vvJv5KiE#P%0P;tl>mDq*z-3BQq$X%^&%T;Jvq)BJXi>}-k*=iEX zui&K93QGJt=9((cW{@X2U?fO}8FD$Qz}>w*9c9K7| z>7SgnYuC%pQDh@I|H=>{|B3yNXdT%HjLew>%4@Nn6~Zo)Dt#^kG;>kH2!VMvpaNH2 zWUvIf5LUHX&H0i#NWz%$DDDU8QC0GyzzfmkBlEfT&wETv>sq}!gZ*W30t~o2-?8;^ zibZoc41EWQUnLWh=(!{Q)}HMYIUj8b3943Su;eVUB32raSU^ zF7sAlA$k6+1rNDiCR2g92R1!KYNONhB2;1G%qQ?2gGhxF_c1@fX!E36ZeuvvtBpA= zjf1toAwfwgLBc)KWLBbS3xJA)AfRZ_Xu@dYGaObxX-VM1dM*+ktQFfj^5b|^p|aN% zp|23EJq1TjQarM_`P3BfzYWLJc=WK5T50z>RjUgdTDhn(XUla&6 z8;S{Fd$dQ+%D;F9^lbg&1*aJbhq0Vy7<%<(h+~;KD}mTn<^Y+fcON&kgoA(yk!t^A2ZG9Z89s@3^GqHwPqc3R}wuGSQv z$Fl!>_c+i=z0z8mE8-!%{TUo(4PE?!1wFxjmWOtbIJRyIVB||EH=tPEu$aZ_cw(;T zMG_XYY@R3N3nz_^mkWG9QQDUBFh|34F;cdJvEV zCH6}c%&5kEA*Ocp9>g~5@FDMGAYO`@)cNQd+z3p;{iE4yy3odGnXQ+k1b> zr~>+T;Pt0cN#jUm{r1xt@ba!cize4j31Q)m;G6I8l>wBWz>0{!VaoJHQX&7d1){&K z{vXamNBkej>xwCSBV1~R%cBh9A~`?V)J;pF6H<_}!f4C`ap6D;jUl98bm(`|6Ug*4 zQnQ(6h!+c(xS6bp7ixx?%%U&?5>N#3NTK?EP&@atu~f_oBS;MjVg8A&nctO0x=B5x z_`@>zr;EA0Uku~M8|Mu05NU_nMeGPvVkL?;rrw!UEQqH?;a2y)5Ac@3@sco zV>8|c9f=l->ej=&y`TML;;boG8A9dd@}kTR#DPi9tdg+h$m29*x>ChC``R+ztz}Mf zLC+ff`m8fG_!r0UK zYyF&H*bE|{A|0_unX1t!BVDuCkTWpC=IowCmySGp8dZ@>#5yb;pKzuQ1zyP4gVPxg z7y$_kjwBI|BxYu^Vy}L!Op{q1sxeMi#!l0lAB+ylx%v<;qG*KebXA4z(kxrnfH~8M zNTwK!z+VuD>G!Uss_RFWnGU67HpJ3wSfX;{j9v*~ewjS9F%qV)^6yyUC`8cLbf`{$ z8ciL4sDUN=PyPOQ7j60)atupWM8j-W(LRcbQ1VWbdjrbu-6k&OezOKeS&0qZ7jh>o zqoY~p;Ep+lE)9k;A|P}wsDk7T2z_sHKFL4{NjSMU)8NT&Oc;k5~c22qP~{Y}7>`nXtd2 z`|jV{w%oAyUN1?V94CEwR|* z=k}>tz2kz{h8Ui-<-#ja^mCxADDQt$$VaPC{8pm}X=@>5=E&cl`S+=?M6u}&z@rTB zWZv>qpd8YtD9JM_aN)%>6JWrx!8Qq!2(oWNvT(>yvyIo@tkGx#+ocvSu|W8C1C@UY zpP=u+N<~9+an3^4!-xx52NccR?D-L$itpaJ`4Q%9;^kX180z=*+BHefd$1g6eE)ni z`px>_>%(T)a&EcIUfHs-yffYf(HtZ=`WtM26i`}X8dBDl2